feat: add authentication and configuration for sync operations

- Implemented SyncAuth to control sync access with server-only mode and secret key authorization
- Consolidated environment variables into single .env.example with improved sync configuration
- Protected all sync API endpoints (ubuntu, fedora, arch, homebrew, winget) with authentication checks

src/app/api/auto-sync/route.ts

@@ -0,0 +1,148 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { SyncAuth } from '@/lib/sync/auth'
+import { MetadataFetcher } from '@/services/metadataFetcher'
+import { PackageFetcherV2 } from '@/services/packageFetcherV2'
+import { WingetPackageFetcher } from '@/services/wingetPackageFetcher'
+import { HomebrewPackageFetcher } from '@/services/homebrewPackageFetcher'
+import { FedoraPackageFetcher } from '@/services/fedoraPackageFetcher'
+import { ArchPackageFetcher } from '@/services/archPackageFetcher'
+
+export const dynamic = 'force-dynamic'
+export const maxDuration = 1800 // 30 minutes timeout for auto sync
+
+// Simple in-memory store for last sync time (in production, use database)
+let lastAutoSync: Date | null = null
+
+export async function POST(request: NextRequest) {
+  try {
+    // Check if auto sync is enabled
+    if (!SyncAuth.isAutoSyncEnabled()) {
+      return NextResponse.json({ 
+        message: 'Auto sync is disabled',
+        next_sync: null
+      })
+    }
+
+    // Check if enough time has passed since last sync
+    const now = new Date()
+    const nextSyncTime = SyncAuth.getNextSyncTime(lastAutoSync || undefined)
+    
+    if (now < nextSyncTime) {
+      return NextResponse.json({ 
+        message: 'Auto sync not due yet',
+        last_sync: lastAutoSync?.toISOString(),
+        next_sync: nextSyncTime.toISOString(),
+        hours_until_next: Math.ceil((nextSyncTime.getTime() - now.getTime()) / (1000 * 60 * 60))
+      })
+    }
+
+    console.log('🔄 Starting automatic package sync...')
+    
+    // Sync all platforms in sequence
+    const syncResults = []
+    
+    try {
+      // Sync Debian/Ubuntu packages
+      console.log('Syncing Debian/Ubuntu packages...')
+      await PackageFetcherV2.syncAll()
+      syncResults.push({ platform: 'debian/ubuntu', status: 'success' })
+    } catch (error) {
+      console.error('Debian/Ubuntu sync failed:', error)
+      syncResults.push({ platform: 'debian/ubuntu', status: 'failed', error: error instanceof Error ? error.message : 'Unknown error' })
+    }
+
+    try {
+      // Sync Windows packages (Winget)
+      console.log('Syncing Windows packages...')
+      const wingetFetcher = new WingetPackageFetcher()
+      const wingetPackages = await wingetFetcher.fetchAllPackages()
+      await wingetFetcher.storePackages(wingetPackages)
+      syncResults.push({ platform: 'windows', status: 'success', package_count: wingetPackages.length })
+    } catch (error) {
+      console.error('Windows sync failed:', error)
+      syncResults.push({ platform: 'windows', status: 'failed', error: error instanceof Error ? error.message : 'Unknown error' })
+    }
+
+    try {
+      // Sync macOS packages (Homebrew)
+      console.log('Syncing macOS packages...')
+      const homebrewFetcher = new HomebrewPackageFetcher()
+      const homebrewPackages = await homebrewFetcher.fetchAllPackages()
+      await homebrewFetcher.storePackages(homebrewPackages)
+      syncResults.push({ platform: 'macos', status: 'success', package_count: homebrewPackages.length })
+    } catch (error) {
+      console.error('macOS sync failed:', error)
+      syncResults.push({ platform: 'macos', status: 'failed', error: error instanceof Error ? error.message : 'Unknown error' })
+    }
+
+    try {
+      // Sync Fedora packages
+      console.log('Syncing Fedora packages...')
+      const fedoraFetcher = new FedoraPackageFetcher()
+      const fedoraPackages = await fedoraFetcher.fetchAllPackages()
+      await fedoraFetcher.storePackages(fedoraPackages)
+      syncResults.push({ platform: 'fedora', status: 'success', package_count: fedoraPackages.length })
+    } catch (error) {
+      console.error('Fedora sync failed:', error)
+      syncResults.push({ platform: 'fedora', status: 'failed', error: error instanceof Error ? error.message : 'Unknown error' })
+    }
+
+    try {
+      // Sync Arch packages
+      console.log('Syncing Arch packages...')
+      const archFetcher = new ArchPackageFetcher()
+      const archPackages = await archFetcher.fetchAllPackages()
+      await archFetcher.storePackages(archPackages)
+      syncResults.push({ platform: 'arch', status: 'success', package_count: archPackages.length })
+    } catch (error) {
+      console.error('Arch sync failed:', error)
+      syncResults.push({ platform: 'arch', status: 'failed', error: error instanceof Error ? error.message : 'Unknown error' })
+    }
+
+    // Update last sync time
+    lastAutoSync = now
+    const nextSync = SyncAuth.getNextSyncTime(lastAutoSync)
+    
+    const successCount = syncResults.filter(r => r.status === 'success').length
+    const totalCount = syncResults.length
+    
+    console.log(`✅ Auto sync completed: ${successCount}/${totalCount} platforms synced successfully`)
+    
+    return NextResponse.json({
+      message: 'Auto sync completed',
+      timestamp: now.toISOString(),
+      last_sync: lastAutoSync.toISOString(),
+      next_sync: nextSync.toISOString(),
+      results: syncResults,
+      summary: {
+        total_platforms: totalCount,
+        successful: successCount,
+        failed: totalCount - successCount
+      }
+    })
+
+  } catch (error) {
+    console.error('Auto sync failed:', error)
+    return NextResponse.json(
+      { 
+        error: 'Auto sync failed', 
+        details: error instanceof Error ? error.message : 'Unknown error',
+        timestamp: new Date().toISOString()
+      },
+      { status: 500 }
+    )
+  }
+}
+
+export async function GET() {
+  const now = new Date()
+  const nextSyncTime = SyncAuth.getNextSyncTime(lastAutoSync || undefined)
+  
+  return NextResponse.json({
+    auto_sync_enabled: SyncAuth.isAutoSyncEnabled(),
+    auto_sync_days: SyncAuth.getAutoSyncDays(),
+    last_sync: lastAutoSync?.toISOString(),
+    next_sync: SyncAuth.isAutoSyncEnabled() ? nextSyncTime.toISOString() : null,
+    status: lastAutoSync && now < nextSyncTime ? 'waiting' : 'ready'
+  })
+}

src/app/api/sync-arch/route.ts

@@ -1,5 +1,6 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { ArchPackageFetcher } from '@/services/archPackageFetcher'
+import { SyncAuth } from '@/lib/sync/auth'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 300 // 5 minutes timeout
@@ -19,7 +20,16 @@ export async function GET() {
   return NextResponse.json(syncStatus)
 }
 
-export async function POST() {
+export async function POST(request: NextRequest) {
+  // Check if sync is allowed
+  const authResult = await SyncAuth.isSyncAllowed(request)
+  if (!authResult.allowed) {
+    return NextResponse.json(
+      { error: 'Sync operation not allowed', reason: authResult.reason },
+      { status: 403 }
+    )
+  }
+
   if (syncInProgress) {
     return NextResponse.json(
       { error: 'Sync already in progress' },

src/app/api/sync-fedora/route.ts

@@ -1,5 +1,6 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { FedoraPackageFetcher } from '@/services/fedoraPackageFetcher'
+import { SyncAuth } from '@/lib/sync/auth'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 300 // 5 minutes timeout
@@ -19,7 +20,16 @@ export async function GET() {
   return NextResponse.json(syncStatus)
 }
 
-export async function POST() {
+export async function POST(request: NextRequest) {
+  // Check if sync is allowed
+  const authResult = await SyncAuth.isSyncAllowed(request)
+  if (!authResult.allowed) {
+    return NextResponse.json(
+      { error: 'Sync operation not allowed', reason: authResult.reason },
+      { status: 403 }
+    )
+  }
+
   if (syncInProgress) {
     return NextResponse.json(
       { error: 'Sync already in progress' },

src/app/api/sync-homebrew/route.ts

@@ -1,5 +1,6 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { HomebrewPackageFetcher } from '@/services/homebrewPackageFetcher'
+import { SyncAuth } from '@/lib/sync/auth'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 300 // 5 minutes timeout
@@ -19,7 +20,16 @@ export async function GET() {
   return NextResponse.json(syncStatus)
 }
 
-export async function POST() {
+export async function POST(request: NextRequest) {
+  // Check if sync is allowed
+  const authResult = await SyncAuth.isSyncAllowed(request)
+  if (!authResult.allowed) {
+    return NextResponse.json(
+      { error: 'Sync operation not allowed', reason: authResult.reason },
+      { status: 403 }
+    )
+  }
+
   if (syncInProgress) {
     return NextResponse.json(
       { error: 'Sync already in progress' },

src/app/api/sync-winget/route.ts

@@ -1,5 +1,6 @@
-import { NextResponse } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { WingetPackageFetcher } from '@/services/wingetPackageFetcher'
+import { SyncAuth } from '@/lib/sync/auth'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 300 // 5 minutes timeout
@@ -19,7 +20,16 @@ export async function GET() {
   return NextResponse.json(syncStatus)
 }
 
-export async function POST() {
+export async function POST(request: NextRequest) {
+  // Check if sync is allowed
+  const authResult = await SyncAuth.isSyncAllowed(request)
+  if (!authResult.allowed) {
+    return NextResponse.json(
+      { error: 'Sync operation not allowed', reason: authResult.reason },
+      { status: 403 }
+    )
+  }
+
   if (syncInProgress) {
     return NextResponse.json(
       { error: 'Sync already in progress' },

src/app/api/sync/route.ts

@@ -4,8 +4,17 @@ import { DebianPackageFetcher } from '@/services/debianPackageFetcher'
 import { PackageFetcherV2 } from '@/services/packageFetcherV2'
 import { SimplePackageFetcher } from '@/services/simplePackageFetcher'
 import { PlatformInitializer } from '@/services/platformInitializer'
+import { SyncAuth } from '@/lib/sync/auth'
 
 export async function POST(request: NextRequest) {
+  // Check if sync is allowed
+  const authResult = await SyncAuth.isSyncAllowed(request)
+  if (!authResult.allowed) {
+    return NextResponse.json(
+      { error: 'Sync operation not allowed', reason: authResult.reason },
+      { status: 403 }
+    )
+  }
   try {
     const body = await request.json()
     const { platform_id, all_platforms, source } = body
@@ -107,11 +116,16 @@ export async function POST(request: NextRequest) {
 
 export async function GET() {
   try {
-    // Return sync status (would need to implement status tracking)
+    // Return sync status with configuration info
     return NextResponse.json({
       status: 'ready',
       last_sync: null,
-      platforms: ['ubuntu', 'fedora', 'arch', 'windows', 'macos']
+      platforms: ['ubuntu', 'fedora', 'arch', 'windows', 'macos'],
+      sync_config: {
+        server_only: process.env.SYNC_SERVER_ONLY === 'true',
+        auto_sync_enabled: SyncAuth.isAutoSyncEnabled(),
+        auto_sync_days: SyncAuth.getAutoSyncDays()
+      }
     })
   } catch (error) {
     console.error('Error getting sync status:', error)

src/lib/sync/auth.ts

@@ -0,0 +1,86 @@
+import { NextRequest } from 'next/server'
+
+export class SyncAuth {
+  private static readonly SERVER_ONLY = process.env.SYNC_SERVER_ONLY === 'true'
+  private static readonly SYNC_SECRET = process.env.SYNC_SECRET_KEY
+
+  /**
+   * Check if sync operations are allowed from the current request
+   */
+  static async isSyncAllowed(request: NextRequest): Promise<{ allowed: boolean; reason?: string }> {
+    // If server-only mode is disabled, allow all requests
+    if (!this.SERVER_ONLY) {
+      return { allowed: true }
+    }
+
+    // In server-only mode, check for secret key in header
+    const secretKey = request.headers.get('x-sync-secret')
+    
+    if (!this.SYNC_SECRET) {
+      return { 
+        allowed: false, 
+        reason: 'Sync secret key not configured on server' 
+      }
+    }
+
+    if (!secretKey) {
+      return { 
+        allowed: false, 
+        reason: 'Sync secret key required in server-only mode' 
+      }
+    }
+
+    if (secretKey !== this.SYNC_SECRET) {
+      return { 
+        allowed: false, 
+        reason: 'Invalid sync secret key' 
+      }
+    }
+
+    // Additional check: verify request is from localhost or same server
+    const clientIP = request.headers.get('x-forwarded-for') || 
+                    request.headers.get('x-real-ip') || 
+                    'unknown'
+    
+    const allowedIPs = ['127.0.0.1', 'localhost', '::1']
+    const isLocalRequest = allowedIPs.includes(clientIP.split(',')[0].trim())
+
+    if (!isLocalRequest && secretKey !== this.SYNC_SECRET) {
+      return { 
+        allowed: false, 
+        reason: 'Sync operations only allowed from server in server-only mode' 
+      }
+    }
+
+    return { allowed: true }
+  }
+
+  /**
+   * Get automatic sync frequency in days
+   */
+  static getAutoSyncDays(): number {
+    const days = parseInt(process.env.AUTO_SYNC_DAYS || '1', 10)
+    return isNaN(days) ? 1 : Math.max(0, days)
+  }
+
+  /**
+   * Check if automatic sync is enabled
+   */
+  static isAutoSyncEnabled(): boolean {
+    return this.getAutoSyncDays() > 0
+  }
+
+  /**
+   * Get the next sync time based on frequency
+   */
+  static getNextSyncTime(lastSyncTime?: Date): Date {
+    const days = this.getAutoSyncDays()
+    if (days === 0) {
+      return new Date(0) // Return epoch time if disabled
+    }
+    
+    const nextSync = new Date(lastSyncTime || new Date())
+    nextSync.setDate(nextSync.getDate() + days)
+    return nextSync
+  }
+}