Add GitHub account binding and a personal Sealos preview

.env.example

@@ -15,6 +15,9 @@ DATABASE_URL=postgresql://doc:doc@localhost:5432/doc?schema=public
 # GitHub authentication (both values are required to enable the provider)
 AUTH_GITHUB_ID=
 AUTH_GITHUB_SECRET=
+# Optional comma-separated numeric GitHub account IDs. Omit to permit GitHub signup.
+# If present but empty or malformed, GitHub sign-in is denied.
+# AUTH_GITHUB_ALLOWED_IDS=12345678
 
 # Email authentication and notifications
 # The defaults use the local Mailpit service without credentials.

.github/workflows/preview-container-images.yml

@@ -0,0 +1,86 @@
+name: Build Sealos preview images
+
+on:
+  push:
+    branches: ['preview/sealos-*']
+  workflow_dispatch:
+    inputs:
+      app_url:
+        description: Public HTTPS origin compiled into the web image
+        type: string
+        required: true
+      collaboration_url:
+        description: Public WSS collaboration URL compiled into the web image
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: doc-preview-images-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  images:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        include:
+          - image: doc-preview-web
+            file: Dockerfile
+            target: runner
+          - image: doc-preview-schema
+            file: Dockerfile
+            target: migrator
+          - image: doc-preview-collaboration
+            file: services/collaboration/Dockerfile
+            target: ''
+    env:
+      DOC_PREVIEW_APP_URL: ${{ inputs.app_url || vars.DOC_PREVIEW_APP_URL }}
+      DOC_PREVIEW_COLLABORATION_URL: ${{ inputs.collaboration_url || vars.DOC_PREVIEW_COLLABORATION_URL }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Require public build configuration
+        if: matrix.target == 'runner'
+        run: |
+          test -n "$DOC_PREVIEW_APP_URL"
+          test -n "$DOC_PREVIEW_COLLABORATION_URL"
+          case "$DOC_PREVIEW_APP_URL" in https://*) ;; *) exit 1 ;; esac
+          case "$DOC_PREVIEW_COLLABORATION_URL" in wss://*) ;; *) exit 1 ;; esac
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and publish commit image
+        id: build
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          target: ${{ matrix.target }}
+          platforms: linux/amd64
+          push: true
+          tags: ghcr.io/bytefolk/${{ matrix.image }}:${{ github.sha }}
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          build-args: |
+            NEXT_PUBLIC_APP_URL=${{ env.DOC_PREVIEW_APP_URL }}
+            NEXT_PUBLIC_COLLABORATE_EDIT_URL=${{ env.DOC_PREVIEW_COLLABORATION_URL }}
+          cache-from: type=gha,scope=doc-preview
+          cache-to: type=gha,scope=doc-preview,mode=max
+      - name: Record image digest
+        env:
+          IMAGE_NAME: ${{ matrix.image }}
+          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          printf '%s\n' "ghcr.io/bytefolk/$IMAGE_NAME@$IMAGE_DIGEST" >> "$GITHUB_STEP_SUMMARY"

CHANGELOG.md

@@ -4,8 +4,24 @@ All notable changes to `doc` are documented here.
 
 ## [Unreleased]
 
+### Fixed
+
+- Allow explicitly opted-in managed PostgreSQL monitoring views during fresh
+  preview initialization only when their definitions, owners, dependencies and
+  extension membership match the same server's template database. Existing
+  application tables and unknown or altered views still prevent initialization.
+
 ### Added
 
+- Show GitHub account connection status in profile settings and let signed-in users
+  connect GitHub through the existing authenticated OAuth account-linking flow.
+- Add an optional stable GitHub account-ID allowlist for private self-hosted previews.
+- Require an expiring, single-use actor/session-bound intent when connecting a new
+  GitHub identity; retain only the provider subject rather than OAuth tokens.
+- Add two-stage personal Sealos preview templates with guarded empty-database
+  initialization. Live Sealos deployment and GitHub OAuth remain unverified until
+  the operator completes the deployment and interactive sign-in checks.
+
 - #86: Host Memory ranking abstains without a confirmed task intent. Overlay candidates drop `NONE` access via `resolveDocumentAccess`. `GET /api/v1/documents` returns list abstain copy in `meta.hostMemory`. Default advice payload never includes document bodies. Overlay does not change `shareRelations`. Refs #82.
 
 - Migrate the app to Next.js 16.3.5 / React 19.1.2: async `params` via

Dockerfile

@@ -23,6 +23,7 @@
 FROM prisma-base AS migrator
 WORKDIR /app
 COPY prisma ./prisma
+COPY services/collaboration/scripts/initialize-preview-database.mjs ./services/collaboration/scripts/initialize-preview-database.mjs
 CMD ["npm", "run", "db:push"]
 
 # Rebuild the source code only when needed
@@ -38,7 +39,7 @@
 ARG NEXT_PUBLIC_APP_URL=http://localhost:3100
 ARG NEXT_PUBLIC_COLLABORATE_EDIT_URL=ws://localhost:1234/collaborate
 ARG NEXT_PUBLIC_OSS_CDN_HOSTNAME
 ENV NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL \
     NEXT_PUBLIC_COLLABORATE_EDIT_URL=$NEXT_PUBLIC_COLLABORATE_EDIT_URL \
     NEXT_PUBLIC_OSS_CDN_HOSTNAME=$NEXT_PUBLIC_OSS_CDN_HOSTNAME \
     AUTH_SECRET=doc-image-build-only-secret \

deploy/sealos-preview/01-schema.template.yaml

@@ -0,0 +1,84 @@
+apiVersion: app.sealos.io/v1
+kind: Template
+metadata:
+  name: doc-personal-schema
+spec:
+  title: 'doc personal preview schema'
+  url: ''
+  gitRepo: 'https://github.com/bytefolk/doc'
+  author: 'ByteFolk'
+  description: 'Initialize a newly created empty doc preview database; deploy applications only after this Job succeeds.'
+  readme: ''
+  icon: ''
+  templateType: inline
+  locale: en
+  categories: []
+  defaults:
+    app_name:
+      type: string
+      value: doc-schema-peterguy326-f5396ac8
+    app_host:
+      type: string
+      value: doc-peterguy326-f5396ac8
+  inputs:
+    migrator_image:
+      description: 'Pinned linux/amd64 migrator image from this checkout'
+      type: string
+      default: 'DOC_MIGRATOR_IMAGE'
+      required: true
+    runtime_secret:
+      description: 'Existing Secret containing DATABASE_URL for the new empty database'
+      type: string
+      default: 'doc-preview-secrets'
+      required: true
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ${{ defaults.app_name }}
+  labels:
+    app: ${{ defaults.app_name }}
+    cloud.sealos.io/app-deploy-manager: ${{ defaults.app_name }}
+    cloud.sealos.io/deploy-on-sealos: ${{ defaults.app_name }}
+spec:
+  backoffLimit: 1
+  template:
+    metadata:
+      labels:
+        app: ${{ defaults.app_name }}
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      containers:
+        - name: ${{ defaults.app_name }}
+          image: ${{ inputs.migrator_image }}
+          imagePullPolicy: IfNotPresent
+          command: ['node', 'services/collaboration/scripts/initialize-preview-database.mjs']
+          env:
+            - name: DOC_FRESH_PREVIEW_DATABASE
+              value: '1'
+            - name: DOC_FRESH_PREVIEW_ALLOW_MANAGED_MONITORING
+              value: '1'
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: ${{ inputs.runtime_secret }}
+                  key: DATABASE_URL
+          resources:
+            requests: { cpu: 50m, memory: 51Mi }
+            limits: { cpu: 500m, memory: 512Mi }
+---
+apiVersion: app.sealos.io/v1
+kind: App
+metadata:
+  name: ${{ defaults.app_name }}
+  labels:
+    cloud.sealos.io/app-deploy-manager: ${{ defaults.app_name }}
+    cloud.sealos.io/deploy-on-sealos: ${{ defaults.app_name }}
+spec:
+  data:
+    url: https://${{ defaults.app_host }}.${{ SEALOS_CLOUD_DOMAIN }}
+  displayType: normal
+  icon: ''
+  name: 'doc preview initialization'
+  type: link