feat: support private git repositories with token auth

- Entity: added gitToken and gitBranch columns to Application
- DTO: added gitToken and gitBranch fields to Create/Update DTOs
- Build pipeline: git-clone init container now injects token into
  HTTPS URL for private repo authentication (GitHub PAT, GitLab token, etc.)
- Build pipeline: supports cloning specific branch (default: main)
- Frontend deploy page: added Access Token (password field) and Branch
  inputs when Git Repository source is selected
- Frontend deploy page: Review step shows branch and token status
- Frontend app detail: shows branch badge and 🔑 Private indicator
  when git credentials are configured
- Works with: GitHub, GitLab, Bitbucket, any HTTPS-based git host

backend/src/applications/dto/application.dto.ts

@@ -37,6 +37,16 @@ export class CreateApplicationDto {
   @IsString()
   gitUrl?: string;
 
+  @ApiPropertyOptional({ example: 'ghp_xxxxxxxxxxxxxxxxxxxx', description: 'Personal access token for private git repos' })
+  @IsOptional()
+  @IsString()
+  gitToken?: string;
+
+  @ApiPropertyOptional({ example: 'main', description: 'Git branch to clone (default: main)' })
+  @IsOptional()
+  @IsString()
+  gitBranch?: string;
+
   @ApiPropertyOptional({ example: { NODE_ENV: 'production', PORT: '3000' } })
   @IsOptional()
   @IsObject()
@@ -86,6 +96,21 @@ export class UpdateApplicationDto {
   @IsString()
   description?: string;
 
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  gitUrl?: string;
+
+  @ApiPropertyOptional({ description: 'Personal access token for private repos' })
+  @IsOptional()
+  @IsString()
+  gitToken?: string;
+
+  @ApiPropertyOptional({ description: 'Git branch to clone' })
+  @IsOptional()
+  @IsString()
+  gitBranch?: string;
+
   @ApiPropertyOptional()
   @IsOptional()
   @IsObject()

backend/src/applications/entities/application.entity.ts

@@ -32,6 +32,12 @@ export class Application {
   @Column({ nullable: true })
   gitUrl: string;
 
+  @Column({ nullable: true })
+  gitToken: string; // Personal access token for private repos
+
+  @Column({ nullable: true })
+  gitBranch: string; // Branch to clone (default: main)
+
   @Column({ nullable: true })
   codePath: string; // Path to uploaded zip
 

backend/src/build/build.service.ts

@@ -149,13 +149,30 @@ export class BuildService {
         ],
       });
     } else if (hasGitUrl) {
+      // Build the git clone URL — inject token for private repos
+      let cloneUrl = app.gitUrl!;
+      if (app.gitToken) {
+        // Convert https://github.com/user/repo.git → https://<token>@github.com/user/repo.git
+        // Also works for GitLab, Bitbucket, etc.
+        try {
+          const url = new URL(cloneUrl);
+          url.username = app.gitToken;
+          url.password = ''; // Some providers use token as username, others as password
+          cloneUrl = url.toString();
+        } catch {
+          // If URL parsing fails, try simple injection after protocol
+          cloneUrl = cloneUrl.replace('https://', `https://${app.gitToken}@`);
+        }
+      }
+      const branch = app.gitBranch || 'main';
+
       // Clone git repo into /workspace/source, then copy our generated Dockerfile
       initContainers.push({
         name: 'git-clone',
         image: 'alpine/git:2.43.0',
         command: ['sh', '-c', `
-          echo ">>> Cloning ${app.gitUrl}" &&
-          git clone --depth 1 ${app.gitUrl} /workspace-out/source &&
+          echo ">>> Cloning branch '${branch}' from ${app.gitUrl}" &&
+          git clone --depth 1 --branch ${branch} ${cloneUrl} /workspace-out/source &&
           cp /dockerfile/Dockerfile /workspace-out/Dockerfile &&
           echo ">>> Workspace contents:" &&
           ls -la /workspace-out/source/