feat: members-only Usenet (NNTP) + Forgejo git provisioning + founding-lifetime $99

WIP feature branch: NNTPS news server, per-member Forgejo accounts on email
confirm, and founding-lifetime pricing tier.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/forgejo/forgejo.go

@@ -0,0 +1,143 @@
+// Package forgejo provisions a git.profullstack.com account for every verified
+// AgentBBS member (free and paid alike) on the self-hosted Forgejo backend that
+// powers AgentGit. BBS membership *is* the git account: when a member verifies
+// their email, EnsureUser creates the matching Forgejo user. It is idempotent —
+// an existing account is left untouched. When unconfigured (no admin token)
+// Configured() reports false and callers skip provisioning entirely.
+//
+// This mirrors the AgentGit ForgejoAdapter.ensureUser contract in
+// profullstack/logicsrc (plugins/agentgit). Plan (free vs. premium) never
+// affects whether the account exists — only quotas, which are enforced
+// server-side by AgentGit merge policy, not here.
+//
+// Config (env):
+//
+//	AGENTBBS_FORGEJO_URL          base URL, e.g. https://git.profullstack.com
+//	AGENTBBS_FORGEJO_ADMIN_TOKEN  Forgejo admin access token
+package forgejo
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// Config holds the Forgejo base URL and admin token.
+type Config struct {
+	BaseURL string
+	Token   string
+}
+
+// ConfigFromEnv reads the Forgejo settings from the environment.
+func ConfigFromEnv() Config {
+	return Config{
+		BaseURL: strings.TrimRight(os.Getenv("AGENTBBS_FORGEJO_URL"), "/"),
+		Token:   os.Getenv("AGENTBBS_FORGEJO_ADMIN_TOKEN"),
+	}
+}
+
+// Configured reports whether accounts can actually be provisioned.
+func (c Config) Configured() bool { return c.BaseURL != "" && c.Token != "" }
+
+// EnsureUser creates a Forgejo account for username (forwarding to email) if it
+// does not already exist. It is idempotent: created is false when the account
+// was already present. New accounts are created with must_change_password — git
+// access is via SSH keys, so the generated password is never used interactively.
+func (c Config) EnsureUser(username, email string) (created bool, err error) {
+	if !c.Configured() {
+		return false, fmt.Errorf("forgejo not configured")
+	}
+
+	exists, err := c.userExists(username)
+	if err != nil {
+		return false, err
+	}
+	if exists {
+		return false, nil
+	}
+
+	pw, err := randomPassword()
+	if err != nil {
+		return false, err
+	}
+	body, _ := json.Marshal(map[string]any{
+		"username":             username,
+		"email":                email,
+		"password":             pw,
+		"must_change_password": true,
+	})
+	status, resp, err := c.do(http.MethodPost, "/admin/users", body)
+	if err != nil {
+		return false, err
+	}
+	if status < 200 || status >= 300 {
+		return false, fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
+	}
+	return true, nil
+}
+
+// userExists reports whether a Forgejo user with this name is present.
+func (c Config) userExists(username string) (bool, error) {
+	status, resp, err := c.do(http.MethodGet, "/users/"+username, nil)
+	if err != nil {
+		return false, err
+	}
+	switch {
+	case status == http.StatusOK:
+		return true, nil
+	case status == http.StatusNotFound:
+		return false, nil
+	default:
+		return false, fmt.Errorf("forgejo lookup user %q: %d: %s", username, status, truncate(resp, 200))
+	}
+}
+
+func (c Config) do(method, path string, body []byte) (int, string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	var reader io.Reader
+	if body != nil {
+		reader = bytes.NewReader(body)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, c.BaseURL+"/api/v1"+path, reader)
+	if err != nil {
+		return 0, "", err
+	}
+	req.Header.Set("Authorization", "token "+c.Token)
+	req.Header.Set("Accept", "application/json")
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return 0, "", err
+	}
+	defer res.Body.Close()
+	out, _ := io.ReadAll(res.Body)
+	return res.StatusCode, string(out), nil
+}
+
+func randomPassword() (string, error) {
+	buf := make([]byte, 24)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(buf), nil
+}
+
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n]
+}

internal/forgejo/forgejo_test.go

@@ -0,0 +1,95 @@
+package forgejo
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestConfiguredRequiresURLAndToken(t *testing.T) {
+	if (Config{BaseURL: "https://git.example.com"}).Configured() {
+		t.Fatal("missing token should be unconfigured")
+	}
+	if (Config{Token: "t"}).Configured() {
+		t.Fatal("missing URL should be unconfigured")
+	}
+	if !(Config{BaseURL: "https://git.example.com", Token: "t"}).Configured() {
+		t.Fatal("URL+token should be configured")
+	}
+}
+
+func TestEnsureUserNoOpWhenUnconfigured(t *testing.T) {
+	if _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil {
+		t.Fatal("expected error when unconfigured")
+	}
+}
+
+func TestEnsureUserCreatesWhenMissing(t *testing.T) {
+	var got struct {
+		lookup bool
+		create bool
+		body   map[string]any
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice":
+			got.lookup = true
+			w.WriteHeader(http.StatusNotFound)
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users":
+			got.create = true
+			if r.Header.Get("Authorization") != "token secret" {
+				t.Errorf("missing auth header: %q", r.Header.Get("Authorization"))
+			}
+			_ = json.NewDecoder(r.Body).Decode(&got.body)
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write([]byte(`{"id":1}`))
+		default:
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+			w.WriteHeader(http.StatusTeapot)
+		}
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	created, err := c.EnsureUser("alice", "a@x.com")
+	if err != nil {
+		t.Fatalf("EnsureUser: %v", err)
+	}
+	if !created {
+		t.Fatal("expected created=true")
+	}
+	if !got.lookup || !got.create {
+		t.Fatalf("expected lookup+create, got %+v", got)
+	}
+	if got.body["must_change_password"] != true {
+		t.Errorf("expected must_change_password=true, got %v", got.body["must_change_password"])
+	}
+	if got.body["username"] != "alice" {
+		t.Errorf("expected username alice, got %v", got.body["username"])
+	}
+}
+
+func TestEnsureUserNoOpWhenExists(t *testing.T) {
+	created := false
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			created = true
+		}
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"id":1}`))
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	got, err := c.EnsureUser("alice", "a@x.com")
+	if err != nil {
+		t.Fatalf("EnsureUser: %v", err)
+	}
+	if got {
+		t.Fatal("expected created=false for existing user")
+	}
+	if created {
+		t.Fatal("must not POST when the user already exists")
+	}
+}