app.py

import os
import base64
import html
import requests
from flask import Flask, render_template, request, jsonify, session
from functools import wraps

app = Flask(__name__)
app.secret_key = os.environ.get('SESSION_SECRET', 'github-profile-manager-secret')

def get_headers(token):
    return {
        'Authorization': f'token {token}',
        'Accept': 'application/vnd.github.v3+json'
    }

def get_username_from_token(token):
    """Securely get username from token - never trust client-supplied username"""
    headers = get_headers(token)
    response = requests.get('https://api.github.com/user', headers=headers)
    if response.status_code == 200:
        return response.json()['login']
    return None

def escape_string(s):
    """Escape string for safe output"""
    if s is None:
        return ''
    return html.escape(str(s))

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/api/validate-token', methods=['POST'])
def validate_token():
    data = request.json
    token = data.get('token', '')
    
    if not token:
        return jsonify({'success': False, 'error': 'Token required'})
    
    headers = get_headers(token)
    response = requests.get('https://api.github.com/user', headers=headers)
    
    if response.status_code == 200:
        user_data = response.json()
        return jsonify({
            'success': True,
            'user': {
                'login': escape_string(user_data['login']),
                'name': escape_string(user_data.get('name', '')),
                'avatar_url': user_data['avatar_url'],
                'bio': escape_string(user_data.get('bio', '')),
                'public_repos': user_data['public_repos'],
                'followers': user_data['followers'],
                'following': user_data['following']
            }
        })
    else:
        return jsonify({'success': False, 'error': 'Invalid token'})

@app.route('/api/repos', methods=['POST'])
def get_repos():
    data = request.json
    token = data.get('token', '')
    
    if not token:
        return jsonify({'success': False, 'error': 'Token required'})
    
    headers = get_headers(token)
    repos = []
    page = 1
    
    while True:
        response = requests.get(
            f'https://api.github.com/user/repos?per_page=100&page={page}&affiliation=owner',
            headers=headers
        )
        if response.status_code != 200:
            if page == 1:
                return jsonify({'success': False, 'error': 'Failed to fetch repos'})
            break
        
        page_data = response.json()
        if not page_data:
            break
        repos.extend(page_data)
        page += 1
    
    formatted_repos = []
    for repo in repos:
        formatted_repos.append({
            'name': escape_string(repo['name']),
            'description': escape_string(repo['description'] or ''),
            'private': repo['private'],
            'url': repo['html_url'],
            'stars': repo['stargazers_count'],
            'forks': repo['forks_count'],
            'language': escape_string(repo['language'] or 'Unknown')
        })
    
    return jsonify({'success': True, 'repos': formatted_repos})

@app.route('/api/update-description', methods=['POST'])
def update_description():
    data = request.json
    token = data.get('token', '')
    repo_name = data.get('repo_name', '')
    description = data.get('description', '')
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    response = requests.patch(
        f'https://api.github.com/repos/{username}/{repo_name}',
        headers=headers,
        json={'description': description}
    )
    
    if response.status_code == 200:
        return jsonify({'success': True, 'message': 'Description updated'})
    else:
        error_msg = response.json().get('message', 'Failed to update description')
        return jsonify({'success': False, 'error': error_msg})

@app.route('/api/rename-repo', methods=['POST'])
def rename_repo():
    data = request.json
    token = data.get('token', '')
    old_name = data.get('old_name', '')
    new_name = data.get('new_name', '')
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    response = requests.patch(
        f'https://api.github.com/repos/{username}/{old_name}',
        headers=headers,
        json={'name': new_name}
    )
    
    if response.status_code == 200:
        return jsonify({'success': True, 'message': 'Repo renamed'})
    else:
        error_msg = response.json().get('message', 'Failed to rename repo')
        return jsonify({'success': False, 'error': error_msg})

@app.route('/api/toggle-visibility', methods=['POST'])
def toggle_visibility():
    data = request.json
    token = data.get('token', '')
    repo_name = data.get('repo_name', '')
    make_private = data.get('make_private', True)
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    response = requests.patch(
        f'https://api.github.com/repos/{username}/{repo_name}',
        headers=headers,
        json={'private': make_private}
    )
    
    if response.status_code == 200:
        status = 'private' if make_private else 'public'
        return jsonify({'success': True, 'message': f'Repo is now {status}'})
    else:
        error_msg = response.json().get('message', 'Failed to change visibility')
        return jsonify({'success': False, 'error': error_msg})

@app.route('/api/delete-repo', methods=['POST'])
def delete_repo():
    data = request.json
    token = data.get('token', '')
    repo_name = data.get('repo_name', '')
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    response = requests.delete(
        f'https://api.github.com/repos/{username}/{repo_name}',
        headers=headers
    )
    
    if response.status_code == 204:
        return jsonify({'success': True, 'message': 'Repo deleted'})
    else:
        return jsonify({'success': False, 'error': 'Failed to delete. Check token permissions.'})

@app.route('/api/get-readme', methods=['POST'])
def get_readme():
    data = request.json
    token = data.get('token', '')
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    response = requests.get(
        f'https://api.github.com/repos/{username}/{username}/contents/README.md',
        headers=headers
    )
    
    if response.status_code == 200:
        content = base64.b64decode(response.json()['content']).decode('utf-8')
        return jsonify({'success': True, 'content': content, 'sha': response.json()['sha']})
    elif response.status_code == 404:
        return jsonify({
            'success': False, 
            'error': f'Profile README not found. Create a repository named "{username}" with a README.md file.',
            'needs_repo': True
        })
    else:
        return jsonify({'success': False, 'error': 'Failed to fetch README'})

@app.route('/api/update-readme', methods=['POST'])
def update_readme():
    data = request.json
    token = data.get('token', '')
    content = data.get('content', '')
    sha = data.get('sha', '')
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    
    if not sha:
        sha_response = requests.get(
            f'https://api.github.com/repos/{username}/{username}/contents/README.md',
            headers=headers
        )
        if sha_response.status_code == 200:
            sha = sha_response.json()['sha']
        elif sha_response.status_code == 404:
            return jsonify({
                'success': False, 
                'error': f'Profile repo not found. Create a repository named "{username}" first.'
            })
    
    response = requests.put(
        f'https://api.github.com/repos/{username}/{username}/contents/README.md',
        headers=headers,
        json={
            'message': 'Update profile README via GitHub Profile Manager',
            'content': base64.b64encode(content.encode()).decode(),
            'sha': sha
        }
    )
    
    if response.status_code in [200, 201]:
        return jsonify({'success': True, 'message': 'README updated'})
    else:
        error_msg = response.json().get('message', 'Failed to update README')
        return jsonify({'success': False, 'error': error_msg})

@app.route('/api/generate-readme', methods=['POST'])
def generate_readme():
    data = request.json
    username = escape_string(data.get('username', ''))
    name = escape_string(data.get('name', ''))
    title = escape_string(data.get('title', 'Developer'))
    skills = data.get('skills', [])
    
    skills_badges = ''
    skill_badges_map = {
        'python': 'Python-3776AB?logo=python&logoColor=white',
        'javascript': 'JavaScript-F7DF1E?logo=javascript&logoColor=black',
        'typescript': 'TypeScript-3178C6?logo=typescript&logoColor=white',
        'react': 'React-61DAFB?logo=react&logoColor=black',
        'nodejs': 'Node.js-339933?logo=node.js&logoColor=white',
        'fastapi': 'FastAPI-009688?logo=fastapi&logoColor=white',
        'flask': 'Flask-000000?logo=flask&logoColor=white',
        'django': 'Django-092E20?logo=django&logoColor=white',
        'postgresql': 'PostgreSQL-336791?logo=postgresql&logoColor=white',
        'mongodb': 'MongoDB-47A248?logo=mongodb&logoColor=white',
        'redis': 'Redis-DC382D?logo=redis&logoColor=white',
        'docker': 'Docker-2496ED?logo=docker&logoColor=white',
        'aws': 'AWS-232F3E?logo=amazon-aws&logoColor=white',
        'git': 'Git-F05032?logo=git&logoColor=white',
        'linux': 'Linux-FCC624?logo=linux&logoColor=black',
        'java': 'Java-007396?logo=java&logoColor=white',
        'cpp': 'C++-00599C?logo=c%2B%2B&logoColor=white',
        'go': 'Go-00ADD8?logo=go&logoColor=white',
        'rust': 'Rust-000000?logo=rust&logoColor=white',
        'vue': 'Vue.js-4FC08D?logo=vue.js&logoColor=white',
        'angular': 'Angular-DD0031?logo=angular&logoColor=white',
        'tailwind': 'Tailwind-06B6D4?logo=tailwindcss&logoColor=white',
        'mysql': 'MySQL-4479A1?logo=mysql&logoColor=white',
        'graphql': 'GraphQL-E10098?logo=graphql&logoColor=white',
        'kubernetes': 'Kubernetes-326CE5?logo=kubernetes&logoColor=white'
    }
    
    for skill in skills:
        skill_lower = escape_string(skill).lower().replace(' ', '').replace('.', '')
        if skill_lower in skill_badges_map:
            skills_badges += f'  <img src="https://img.shields.io/badge/{skill_badges_map[skill_lower]}&style=flat-square" />\n'
    
    readme = f'''<h1 align="center">Hi, I'm {name}</h1>
<h3 align="center">{title}</h3>

<p align="center">
  <a href="https://github.com/{username}"><img src="https://img.shields.io/badge/GitHub-Follow-black?style=for-the-badge&logo=github" /></a>
</p>

---

### About Me

I am a passionate developer who loves building amazing things.

---

### Tech Stack

<p align="left">
{skills_badges}</p>

---

### GitHub Stats

<p align="center">
  <img src="https://github-readme-stats.vercel.app/api?username={username}&show_icons=true&theme=tokyonight&hide_border=true" alt="GitHub Stats" />
</p>

<p align="center">
  <img src="https://github-readme-streak-stats-eight.vercel.app/?user={username}&theme=tokyonight&hide_border=true" alt="GitHub Streak" />
</p>

<p align="center">
  <img src="https://github-readme-stats.vercel.app/api/top-langs/?username={username}&layout=compact&theme=tokyonight&hide_border=true" alt="Top Languages" />
</p>

---

### GitHub Activity Graph

<p align="center">
  <img src="https://github-readme-activity-graph.vercel.app/graph?username={username}&theme=tokyo-night&hide_border=true" alt="Activity Graph" />
</p>

---

<p align="center">
  <img src="https://komarev.com/ghpvc/?username={username}&label=Profile%20Views&color=blue&style=flat-square" alt="Profile Views" />
</p>
'''
    
    return jsonify({'success': True, 'readme': readme})

@app.route('/api/bulk-update-descriptions', methods=['POST'])
def bulk_update_descriptions():
    data = request.json
    token = data.get('token', '')
    updates = data.get('updates', [])
    
    username = get_username_from_token(token)
    if not username:
        return jsonify({'success': False, 'error': 'Invalid token'})
    
    headers = get_headers(token)
    results = []
    
    for update in updates:
        repo_name = update.get('repo_name', '')
        description = update.get('description', '')
        
        response = requests.patch(
            f'https://api.github.com/repos/{username}/{repo_name}',
            headers=headers,
            json={'description': description}
        )
        
        results.append({
            'repo': repo_name,
            'success': response.status_code == 200
        })
    
    return jsonify({'success': True, 'results': results})

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)