chore(sync): merge upstream main (Mastra 1.67, CopilotKit 1.72, MCP ChatGPT app, provider fixes)

apps/backend/src/api/api.module.ts

@@ -16,6 +16,8 @@ import { IntegrationManager } from '@gitroom/nestjs-libraries/integrations/integ
 import { SettingsController } from '@gitroom/backend/api/routes/settings.controller';
 import { PostsController } from '@gitroom/backend/api/routes/posts.controller';
 import { MediaController } from '@gitroom/backend/api/routes/media.controller';
+import { MediaWidgetController } from '@gitroom/backend/api/routes/media.widget.controller';
+import { UploadWidgetAuthMiddleware } from '@gitroom/backend/services/auth/upload.widget.auth.middleware';
 import { UploadModule } from '@gitroom/nestjs-libraries/upload/upload.module';
 import { BillingController } from '@gitroom/backend/api/routes/billing.controller';
 import { NotificationsController } from '@gitroom/backend/api/routes/notifications.controller';
@@ -79,7 +81,7 @@ const authenticatedController = [
 @Module({
   imports: [UploadModule, EcosystemModule],
   controllers: process.env.MCP_ONLY
-    ? [RootController, OAuthController]
+    ? [RootController, OAuthController, MediaWidgetController]
     : [
         RootController,
         PaymentController,
@@ -90,6 +92,7 @@ const authenticatedController = [
         EnterpriseController,
         NoAuthIntegrationsController,
         OAuthController,
+        MediaWidgetController,
         ...authenticatedController,
       ],
   providers: [
@@ -101,6 +104,7 @@ const authenticatedController = [
     OpenaiService,
     ExtractContentService,
     AuthMiddleware,
+    UploadWidgetAuthMiddleware,
     PoliciesGuard,
     PermissionsService,
     CodesService,
@@ -124,5 +128,6 @@ const authenticatedController = [
 export class ApiModule implements NestModule {
   configure(consumer: MiddlewareConsumer) {
     consumer.apply(AuthMiddleware).forRoutes(...authenticatedController);
+    consumer.apply(UploadWidgetAuthMiddleware).forRoutes(MediaWidgetController);
   }
 }

apps/backend/src/api/routes/auth.controller.ts

@@ -7,7 +7,10 @@ import {
   Query,
   Req,
   Res,
+  UseGuards,
 } from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import { ThrottlerRealIpGuard } from '@gitroom/nestjs-libraries/throttler/throttler.provider';
 import { Response, Request } from 'express';
 
 import { CreateOrgUserDto } from '@gitroom/nestjs-libraries/dtos/auth/create.org.user.dto';
@@ -24,6 +27,7 @@ import { UserAgent } from '@gitroom/nestjs-libraries/user/user.agent';
 import { Provider } from '@prisma/client';
 import { makeId } from '@gitroom/nestjs-libraries/services/make.is';
 import * as Sentry from '@sentry/nestjs';
+import { FarcasterProvider } from '@gitroom/nestjs-libraries/integrations/social/farcaster.provider';
 
 @ApiTags('Auth')
 @Controller('/auth')
@@ -295,6 +299,30 @@ export class AuthController {
     }
   }
 
+  // public and creates a signer at Neynar per call, so cap it per client
+  @UseGuards(ThrottlerRealIpGuard)
+  @Throttle({ default: { limit: 30, ttl: 3600000 } })
+  @Post('/farcaster/signer')
+  async farcasterSigner() {
+    try {
+      return await new FarcasterProvider().createSigner();
+    } catch (err: any) {
+      return { error: err.message || 'Failed to create signer' };
+    }
+  }
+
+  // the modal polls every 2s for up to 10 minutes, so leave room for that
+  @UseGuards(ThrottlerRealIpGuard)
+  @Throttle({ default: { limit: 1000, ttl: 3600000 } })
+  @Get('/farcaster/signer')
+  async farcasterSignerStatus(@Query('signerUuid') signerUuid: string) {
+    try {
+      return await new FarcasterProvider().signerStatus(signerUuid);
+    } catch (err: any) {
+      return { error: err.message || 'Failed to check signer' };
+    }
+  }
+
   @Post('/oauth/:provider/redirect')
   oauthRedirect(
     @Param('provider') provider: string,

apps/backend/src/api/routes/copilot.controller.ts

@@ -8,12 +8,10 @@ import {
   Query,
   Param,
 } from '@nestjs/common';
-import OpenAI from 'openai';
 import {
   CopilotRuntime,
   OpenAIAdapter,
   copilotRuntimeNodeHttpEndpoint,
-  copilotRuntimeNextJSAppRouterEndpoint,
 } from '@copilotkit/runtime';
 import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
 import { Organization } from '@prisma/client';
@@ -24,13 +22,24 @@ import { Request, Response } from 'express';
 import { RequestContext } from '@mastra/core/di';
 import { CheckPolicies } from '@gitroom/backend/services/auth/permissions/permissions.ability';
 import { AuthorizationActions, Sections } from '@gitroom/backend/services/auth/permissions/permission.exception.class';
+import OpenAI from 'openai';
 
 export type ChannelsContext = {
   integrations: string;
   organization: string;
   ui: string;
 };
 
+// the copilot runtime writes its own CORS headers on the response, keep them aligned with main.ts
+const copilotCors = () => ({
+  origin: [
+    process.env.FRONTEND_URL,
+    'http://localhost:6274',
+    ...(process.env.MAIN_URL ? [process.env.MAIN_URL] : []),
+  ],
+  credentials: !process.env.NOT_SECURED,
+});
+
 @Controller('/copilot')
 export class CopilotController {
   constructor(
@@ -54,6 +63,7 @@ export class CopilotController {
 
     const copilotRuntimeHandler = copilotRuntimeNodeHttpEndpoint({
       endpoint: '/copilot/chat',
+      cors: copilotCors(),
       runtime: new CopilotRuntime(),
       serviceAdapter: new OpenAIAdapter({
         openai: openai as any,
@@ -82,7 +92,7 @@ export class CopilotController {
     const requestContext = new RequestContext<ChannelsContext>();
     requestContext.set(
       'integrations',
-      req?.body?.variables?.properties?.integrations || []
+      req?.body?.body?.forwardedProps?.integrations || []
     );
 
     requestContext.set('organization', JSON.stringify(organization));
@@ -103,17 +113,17 @@ export class CopilotController {
       ...(process.env.OPENAI_BASE_URL ? { baseURL: process.env.OPENAI_BASE_URL } : {}),
     });
 
-    const copilotRuntimeHandler = copilotRuntimeNextJSAppRouterEndpoint({
+    const copilotRuntimeHandler = copilotRuntimeNodeHttpEndpoint({
       endpoint: '/copilot/agent',
+      cors: copilotCors(),
       runtime,
-      // properties: req.body.variables.properties,
       serviceAdapter: new OpenAIAdapter({
         openai: openai as any,
         model: process.env.OPENAI_MODEL_NAME || 'gpt-4.1',
       }),
     });
 
-    return copilotRuntimeHandler.handleRequest(req, res);
+    return copilotRuntimeHandler(req, res);
   }
 
   @Get('/credits')

apps/backend/src/api/routes/media.controller.ts

@@ -1,4 +1,5 @@
 import {
+  BadRequestException,
   Body,
   Controller,
   Delete,
@@ -10,7 +11,6 @@ import {
   Res,
   UploadedFile,
   UseInterceptors,
-  UsePipes,
 } from '@nestjs/common';
 import { Request, Response } from 'express';
 import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
@@ -19,7 +19,7 @@ import { MediaService } from '@gitroom/nestjs-libraries/database/prisma/media/me
 import { ApiTags } from '@nestjs/swagger';
 import handleR2Upload from '@gitroom/nestjs-libraries/upload/r2.uploader';
 import { FileInterceptor } from '@nestjs/platform-express';
-import { CustomFileValidationPipe } from '@gitroom/nestjs-libraries/upload/custom.upload.validation';
+import { streamUploadOptions } from '@gitroom/nestjs-libraries/upload/multer.stream.engine';
 import { SubscriptionService } from '@gitroom/nestjs-libraries/database/prisma/subscriptions/subscription.service';
 import { UploadFactory } from '@gitroom/nestjs-libraries/upload/upload.factory';
 import { SaveMediaInformationDto } from '@gitroom/nestjs-libraries/dtos/media/save.media.information.dto';
@@ -85,19 +85,19 @@ export class MediaController {
   }
 
   @Post('/upload-server')
-  @UseInterceptors(FileInterceptor('file'))
-  @UsePipes(new CustomFileValidationPipe())
+  @UseInterceptors(FileInterceptor('file', streamUploadOptions()))
   async uploadServer(
     @GetOrgFromRequest() org: Organization,
     @UploadedFile() file: Express.Multer.File
   ) {
-    const originalName = file?.originalname || '';
-    const uploadedFile = await this.storage.uploadFile(file);
+    if (!file) {
+      throw new BadRequestException('No file provided');
+    }
     return this._mediaService.saveFile(
       org.id,
-      uploadedFile.originalname,
-      uploadedFile.path,
-      originalName
+      file.filename,
+      file.path,
+      file.originalname
     );
   }
 
@@ -128,26 +128,25 @@ export class MediaController {
   }
 
   @Post('/upload-simple')
-  @UseInterceptors(FileInterceptor('file'))
-  @UsePipes(new CustomFileValidationPipe())
+  @UseInterceptors(FileInterceptor('file', streamUploadOptions()))
   async uploadSimple(
     @GetOrgFromRequest() org: Organization,
     @UploadedFile('file') file: Express.Multer.File,
     @Body('preventSave') preventSave: string = 'false'
   ) {
-    const originalName = file.originalname;
-    const getFile = await this.storage.uploadFile(file);
+    if (!file) {
+      throw new BadRequestException('No file provided');
+    }
 
     if (preventSave === 'true') {
-      const { path } = getFile;
-      return { path };
+      return { path: file.path };
     }
 
     return this._mediaService.saveFile(
       org.id,
-      getFile.originalname,
-      getFile.path,
-      originalName
+      file.filename,
+      file.path,
+      file.originalname
     );
   }
 
@@ -159,15 +158,16 @@ export class MediaController {
     @Param('endpoint') endpoint: string
   ) {
     const upload = await handleR2Upload(endpoint, req, res);
-    if (endpoint !== 'complete-multipart-upload') {
+    // a rejected or failed completion has already answered with its own status
+    if (endpoint !== 'complete-multipart-upload' || res.headersSent) {
       return upload;
     }
 
     // @ts-ignore
     const name = upload.Location.split('/').pop();
     const originalName = req.body?.file?.name;
 
-    const saveFile = await this._mediaService.saveFile(
+    const saveFile = await this._mediaService.saveUploadedFile(
       org.id,
       name,
       // @ts-ignore
@@ -178,6 +178,14 @@ export class MediaController {
     res.status(200).json({ ...upload, saved: saveFile });
   }
 
+  @Get('/:id/status')
+  getMediaStatus(
+    @GetOrgFromRequest() org: Organization,
+    @Param('id') id: string
+  ) {
+    return this._mediaService.getMediaStatus(org.id, id);
+  }
+
   @Get('/')
   getMedia(
     @GetOrgFromRequest() org: Organization,

apps/backend/src/api/routes/media.widget.controller.ts

@@ -0,0 +1,48 @@
+import {
+  BadRequestException,
+  Controller,
+  Get,
+  Post,
+  Req,
+  UploadedFile,
+  UseInterceptors,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { ApiTags } from '@nestjs/swagger';
+import { Organization } from '@prisma/client';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
+import { MediaService } from '@gitroom/nestjs-libraries/database/prisma/media/media.service';
+import { streamUploadOptions } from '@gitroom/nestjs-libraries/upload/multer.stream.engine';
+
+@ApiTags('Media')
+@Controller('/media-widget')
+export class MediaWidgetController {
+  constructor(private _mediaService: MediaService) {}
+
+  @Post('/upload')
+  @UseInterceptors(FileInterceptor('file', streamUploadOptions()))
+  async upload(
+    @GetOrgFromRequest() org: Organization,
+    @Req() req: Request,
+    @UploadedFile() file: Express.Multer.File
+  ) {
+    if (!file) {
+      throw new BadRequestException('No file provided');
+    }
+    return this._mediaService.saveUploadSessionFile(
+      org.id,
+      // @ts-ignore
+      req.uploadSession,
+      file.filename,
+      file.path,
+      file.originalname
+    );
+  }
+
+  @Get('/status')
+  status(@GetOrgFromRequest() org: Organization, @Req() req: Request) {
+    // @ts-ignore
+    return this._mediaService.getUploadSession(org.id, req.uploadSession);
+  }
+}

apps/backend/src/api/routes/oauth.controller.ts

@@ -28,6 +28,7 @@ import {
 import { TokenExchangeDto } from '@gitroom/nestjs-libraries/dtos/oauth/token-exchange.dto';
 import { RegisterClientDto } from '@gitroom/nestjs-libraries/dtos/oauth/register-client.dto';
 import { RevokeTokenDto } from '@gitroom/nestjs-libraries/dtos/oauth/revoke-token.dto';
+import { extractBasicCredentials } from '@gitroom/nestjs-libraries/chat/oauth-types';
 
 @ApiTags('OAuth')
 @Controller('/oauth')
@@ -65,18 +66,32 @@ export class OAuthController {
   }
 
   @Post('/token')
-  async token(@Body() body: TokenExchangeDto) {
+  async token(
+    @Body() body: TokenExchangeDto,
+    @Headers('authorization') authorization?: string
+  ) {
     if (body.grant_type !== 'authorization_code') {
       throw new HttpException(
         { error: 'unsupported_grant_type' },
         HttpStatus.BAD_REQUEST
       );
     }
 
+    // client_secret_basic puts the credentials in the Authorization header,
+    // client_secret_post and public clients put them in the body
+    const basic = extractBasicCredentials(authorization);
+    const clientId = basic?.clientId || body.client_id;
+    if (!clientId) {
+      throw new HttpException(
+        { error: 'invalid_client' },
+        HttpStatus.UNAUTHORIZED
+      );
+    }
+
     return this._oauthService.exchangeCodeForToken(
       body.code,
-      body.client_id,
-      body.client_secret,
+      clientId,
+      basic?.clientSecret || body.client_secret,
       body.code_verifier,
       body.redirect_uri
     );

apps/backend/src/main.ts

@@ -33,6 +33,8 @@ async function start() {
         'auth',
         'showorg',
         'impersonate',
+        'x-postiz-org',
+        'x-postiz-include-deleted',
         'x-copilotkit-runtime-client-gql-version',
       ],
       exposedHeaders: [