Initial push of Plunk Next

2025-12-01 09:56:56 +01:00
parent 07cea20262
commit ff1876d580
566 changed files with 89036 additions and 28423 deletions
@@ -0,0 +1,604 @@
+import {randomBytes} from 'node:crypto';
+
+import {Controller, Get, Middleware, Patch, Post, Put} from '@overnightjs/core';
+import {BillingLimitSchemas, ProjectSchemas} from '@plunk/shared';
+import type {Request, Response} from 'express';
+
+import {
+  DASHBOARD_URI,
+  SMTP_DOMAIN,
+  SMTP_ENABLED,
+  SMTP_PORT_SECURE,
+  SMTP_PORT_SUBMISSION,
+  STRIPE_ENABLED,
+  STRIPE_PRICE_EMAIL_USAGE,
+  STRIPE_PRICE_ONBOARDING,
+  TRACKING_TOGGLE_ENABLED,
+} from '../app/constants.js';
+import {stripe} from '../app/stripe.js';
+import {prisma} from '../database/prisma.js';
+import {NotAuthenticated, NotFound} from '../exceptions/index.js';
+import type {AuthResponse} from '../middleware/auth.js';
+import {isAuthenticated} from '../middleware/auth.js';
+import {BillingLimitService} from '../services/BillingLimitService.js';
+import {SecurityService} from '../services/SecurityService.js';
+import {UserService} from '../services/UserService.js';
+
+@Controller('users')
+export class Users {
+  @Get('@me')
+  @Middleware([isAuthenticated])
+  public async me(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    const me = await UserService.id(auth.userId);
+
+    if (!me) {
+      throw new NotAuthenticated();
+    }
+
+    return res.status(200).json({id: me.id, email: me.email});
+  }
+
+  @Get('@me/projects')
+  @Middleware([isAuthenticated])
+  public async meProjects(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    const projects = await UserService.projects(auth.userId);
+
+    return res.status(200).json(projects);
+  }
+
+  @Post('@me/projects')
+  @Middleware([isAuthenticated])
+  public async createProject(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    const {name} = ProjectSchemas.create.parse(req.body);
+
+    // Generate unique API keys
+    const publicKey = `pk_${randomBytes(32).toString('hex')}`;
+    const secretKey = `sk_${randomBytes(32).toString('hex')}`;
+
+    // Create the project
+    const project = await prisma.project.create({
+      data: {
+        name,
+        public: publicKey,
+        secret: secretKey,
+        members: {
+          create: {
+            userId: auth.userId,
+            role: 'ADMIN',
+          },
+        },
+      },
+    });
+
+    return res.status(201).json(project);
+  }
+
+  @Patch('@me/projects/:id')
+  @Middleware([isAuthenticated])
+  public async updateProject(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+    const data = ProjectSchemas.update.parse(req.body);
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+        role: {
+          in: ['ADMIN', 'OWNER'],
+        },
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to update it');
+    }
+
+    // Update the project
+    const project = await prisma.project.update({
+      where: {id},
+      data,
+    });
+
+    return res.status(200).json(project);
+  }
+
+  @Post('@me/projects/:id/regenerate-keys')
+  @Middleware([isAuthenticated])
+  public async regenerateProjectKeys(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    // Verify user has admin/owner access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+        role: {
+          in: ['ADMIN', 'OWNER'],
+        },
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to regenerate keys');
+    }
+
+    // Generate new unique API keys
+    const publicKey = `pk_${randomBytes(32).toString('hex')}`;
+    const secretKey = `sk_${randomBytes(32).toString('hex')}`;
+
+    // Update the project with new keys
+    const project = await prisma.project.update({
+      where: {id},
+      data: {
+        public: publicKey,
+        secret: secretKey,
+      },
+    });
+
+    return res.status(200).json(project);
+  }
+
+  @Post('@me/projects/:id/checkout')
+  @Middleware([isAuthenticated])
+  public async createCheckoutSession(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    // Check if billing is enabled
+    if (!STRIPE_ENABLED || !stripe) {
+      return res.status(404).json({error: 'Billing is not enabled'});
+    }
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+        role: {
+          in: ['ADMIN', 'OWNER'],
+        },
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to manage billing');
+    }
+
+    // Get the project
+    const project = await prisma.project.findUnique({
+      where: {id},
+    });
+
+    if (!project) {
+      throw new NotFound('Project not found');
+    }
+
+    // If project already has a subscription, return error
+    if (project.subscription) {
+      return res.status(400).json({error: 'Project already has a subscription'});
+    }
+
+    // Build line items for subscription
+    const lineItems = [];
+
+    // Add one-time onboarding fee if configured
+    if (STRIPE_PRICE_ONBOARDING) {
+      lineItems.push({price: STRIPE_PRICE_ONBOARDING, quantity: 1});
+    }
+
+    // Add metered pricing for pay-per-email (required)
+    if (!STRIPE_PRICE_EMAIL_USAGE) {
+      return res.status(500).json({error: 'Usage-based pricing not configured. Set STRIPE_PRICE_EMAIL_USAGE.'});
+    }
+    lineItems.push({price: STRIPE_PRICE_EMAIL_USAGE}); // No quantity for metered items
+
+    // Calculate billing cycle anchor to first day of next month
+    // This ensures all subscriptions renew on the 1st of each month
+    const now = new Date();
+    const nextMonth = new Date(now.getFullYear(), now.getMonth() + 1, 1);
+    const billingCycleAnchor = Math.floor(nextMonth.getTime() / 1000);
+
+    // Create checkout session
+    // Note: proration_behavior cannot be set when one-time prices are included
+    // The billing_cycle_anchor alone ensures the subscription is anchored to the 1st of the month
+    const session = await stripe.checkout.sessions.create({
+      mode: 'subscription',
+      customer: project.customer ?? undefined, // Use existing customer if available
+      client_reference_id: project.id, // Store project ID for webhook
+      line_items: lineItems,
+      subscription_data: {
+        billing_cycle_anchor: billingCycleAnchor,
+      },
+      success_url: `${DASHBOARD_URI}/settings?tab=billing&success=true`,
+      cancel_url: `${DASHBOARD_URI}/settings?tab=billing&canceled=true`,
+    });
+
+    return res.status(200).json({url: session.url});
+  }
+
+  @Post('@me/projects/:id/billing-portal')
+  @Middleware([isAuthenticated])
+  public async createBillingPortalSession(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    // Check if billing is enabled
+    if (!STRIPE_ENABLED || !stripe) {
+      return res.status(404).json({error: 'Billing is not enabled'});
+    }
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+        role: {
+          in: ['ADMIN', 'OWNER'],
+        },
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to manage billing');
+    }
+
+    // Get the project
+    const project = await prisma.project.findUnique({
+      where: {id},
+    });
+
+    if (!project) {
+      throw new NotFound('Project not found');
+    }
+
+    // Project must have a customer ID to access billing portal
+    if (!project.customer) {
+      return res.status(400).json({error: 'No customer found for this project'});
+    }
+
+    // Create billing portal session
+    const session = await stripe.billingPortal.sessions.create({
+      customer: project.customer,
+      return_url: `${DASHBOARD_URI}/settings?tab=billing`,
+    });
+
+    return res.status(200).json({url: session.url});
+  }
+
+  @Get('@me/projects/:id/billing-limits')
+  @Middleware([isAuthenticated])
+  public async getBillingLimits(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    if (!id) {
+      throw new NotFound('Project ID is required');
+    }
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to view billing limits');
+    }
+
+    // Get billing limits and usage
+    const limitsAndUsage = await BillingLimitService.getLimitsAndUsage(id);
+
+    return res.status(200).json(limitsAndUsage);
+  }
+
+  @Put('@me/projects/:id/billing-limits')
+  @Middleware([isAuthenticated])
+  public async updateBillingLimits(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    if (!id) {
+      throw new NotFound('Project ID is required');
+    }
+
+    const data = BillingLimitSchemas.update.parse(req.body);
+
+    // Verify user has admin/owner access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+        role: {
+          in: ['ADMIN', 'OWNER'],
+        },
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to update billing limits');
+    }
+
+    // Get the project
+    const project = await prisma.project.findUnique({
+      where: {id},
+      select: {
+        subscription: true,
+      },
+    });
+
+    if (!project) {
+      throw new NotFound('Project not found');
+    }
+
+    // Require active subscription to set billing limits
+    if (!project.subscription) {
+      return res.status(400).json({error: 'An active subscription is required to set billing limits'});
+    }
+
+    // Update billing limits
+    await prisma.project.update({
+      where: {id},
+      data: {
+        billingLimitWorkflows: data.workflows,
+        billingLimitCampaigns: data.campaigns,
+        billingLimitTransactional: data.transactional,
+      },
+    });
+
+    // Invalidate cache so new limits take effect immediately
+    await BillingLimitService.invalidateCache(id);
+
+    const limitsAndUsage = await BillingLimitService.getLimitsAndUsage(id);
+
+    return res.status(200).json(limitsAndUsage);
+  }
+
+  @Get('@me/projects/:id/billing-consumption')
+  @Middleware([isAuthenticated])
+  public async getBillingConsumption(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    // Check if billing is enabled
+    if (!STRIPE_ENABLED || !stripe) {
+      return res.status(404).json({error: 'Billing is not enabled'});
+    }
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    if (!id) {
+      throw new NotFound('Project ID is required');
+    }
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to view billing');
+    }
+
+    const project = await prisma.project.findUnique({
+      where: {id},
+      select: {
+        customer: true,
+        subscription: true,
+      },
+    });
+
+    if (!project) {
+      throw new NotFound('Project not found');
+    }
+
+    if (!project.customer || !project.subscription) {
+      return res.status(400).json({error: 'No active subscription found'});
+    }
+
+    // Get the current billing period (start of current month to now)
+    const now = new Date();
+    const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+    // Get upcoming invoice to see costs and usage
+    let upcomingInvoice = null;
+    let totalUsage = 0;
+
+    try {
+      upcomingInvoice = (await (stripe.invoices as any).retrieveUpcoming({customer: project.customer})) as any;
+
+      // Extract metered usage from invoice line items
+      if (upcomingInvoice && upcomingInvoice.lines && upcomingInvoice.lines.data) {
+        const meteredLine = upcomingInvoice.lines.data.find((line: any) => {
+          const price = line.price;
+          return price && typeof price === 'object' && 'id' in price && price.id === STRIPE_PRICE_EMAIL_USAGE;
+        });
+        if (meteredLine && meteredLine.quantity) {
+          totalUsage = meteredLine.quantity;
+        }
+      }
+    } catch {
+      // No upcoming invoice yet or error retrieving it
+      // This is normal for new subscriptions or if there's no usage yet
+    }
+
+    return res.status(200).json({
+      period: {
+        start: startOfMonth.toISOString(),
+        end: now.toISOString(),
+      },
+      usage: {
+        total: totalUsage,
+        records: [], // Deprecated in favor of invoice line items
+      },
+      upcomingInvoice: upcomingInvoice
+        ? {
+            amountDue: upcomingInvoice.amount_due,
+            currency: upcomingInvoice.currency,
+            periodStart: upcomingInvoice.period_start
+              ? new Date(upcomingInvoice.period_start * 1000).toISOString()
+              : startOfMonth.toISOString(),
+            periodEnd: upcomingInvoice.period_end
+              ? new Date(upcomingInvoice.period_end * 1000).toISOString()
+              : now.toISOString(),
+            subtotal: upcomingInvoice.subtotal ?? 0,
+            total: upcomingInvoice.total ?? 0,
+          }
+        : null,
+    });
+  }
+
+  @Get('@me/projects/:id/billing-invoices')
+  @Middleware([isAuthenticated])
+  public async getBillingInvoices(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    // Check if billing is enabled
+    if (!STRIPE_ENABLED || !stripe) {
+      return res.status(404).json({error: 'Billing is not enabled'});
+    }
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    if (!id) {
+      throw new NotFound('Project ID is required');
+    }
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to view billing');
+    }
+
+    // Get the project
+    const project = await prisma.project.findUnique({
+      where: {id},
+      select: {
+        customer: true,
+      },
+    });
+
+    if (!project) {
+      throw new NotFound('Project not found');
+    }
+
+    if (!project.customer) {
+      return res.status(400).json({error: 'No customer found'});
+    }
+
+    // Get all invoices for this customer
+    const invoices = await stripe.invoices.list({
+      customer: project.customer,
+      limit: 100,
+    });
+
+    // Check for unpaid invoices
+    const unpaidInvoices = invoices.data.filter(
+      invoice => invoice.status === 'open' || invoice.status === 'uncollectible',
+    );
+
+    return res.status(200).json({
+      invoices: invoices.data.map(invoice => ({
+        id: invoice.id,
+        number: invoice.number,
+        status: invoice.status,
+        amountDue: invoice.amount_due,
+        amountPaid: invoice.amount_paid,
+        currency: invoice.currency,
+        created: new Date(invoice.created * 1000).toISOString(),
+        periodStart: invoice.period_start ? new Date(invoice.period_start * 1000).toISOString() : null,
+        periodEnd: invoice.period_end ? new Date(invoice.period_end * 1000).toISOString() : null,
+        hostedInvoiceUrl: invoice.hosted_invoice_url,
+        invoicePdf: invoice.invoice_pdf,
+        subtotal: invoice.subtotal,
+        total: invoice.total,
+        paid: invoice.status === 'paid',
+      })),
+      hasUnpaidInvoices: unpaidInvoices.length > 0,
+      unpaidInvoices: unpaidInvoices.map(invoice => ({
+        id: invoice.id,
+        number: invoice.number,
+        amountDue: invoice.amount_due,
+        currency: invoice.currency,
+        dueDate: invoice.due_date ? new Date(invoice.due_date * 1000).toISOString() : null,
+        hostedInvoiceUrl: invoice.hosted_invoice_url,
+      })),
+    });
+  }
+
+  @Get('@me/projects/:id/security')
+  @Middleware([isAuthenticated])
+  public async getSecurityHealth(req: Request, res: Response) {
+    const auth = res.locals.auth as AuthResponse;
+    const {id} = req.params;
+
+    if (!auth.userId) {
+      throw new NotAuthenticated();
+    }
+
+    if (!id) {
+      throw new NotFound('Project ID is required');
+    }
+
+    // Verify user has access to this project
+    const membership = await prisma.membership.findFirst({
+      where: {
+        userId: auth.userId,
+        projectId: id,
+      },
+    });
+
+    if (!membership) {
+      throw new NotFound('Project not found or you do not have permission to view security metrics');
+    }
+
+    // Get security metrics
+    const metrics = await SecurityService.getProjectSecurityMetrics(id);
+
+    return res.status(200).json(metrics);
+  }
+}