@bonginkan/maria 4.3.12 → 4.3.13

package/dist/server/express-server.cjs

@@ -6913,7 +6913,7 @@ function startRateLimitCleanup() {
     });
   }, 10 * 60 * 1e3);
 }
-async function getFirestorePlan(uid) {
+async function getFirestorePlan(uid2) {
   try {
     const admin = await import('firebase-admin');
     if (!admin.apps?.length) {
@@ -6924,7 +6924,7 @@ async function getFirestorePlan(uid) {
     }
     const { getFirestore } = await import('firebase-admin/firestore');
     const db = getFirestore();
-    const doc = await db.doc(`projects/default/users/${uid}`).get();
+    const doc = await db.doc(`projects/default/users/${uid2}`).get();
     const plan = doc.exists && doc.data()?.plan || "FREE";
     return String(plan).toUpperCase();
   } catch {
@@ -8608,7 +8608,7 @@ app.get("/api/user/profile", async (req, res) => {
     if (!decoded) {
       return res.status(401).json({ error: "invalid_token" });
     }
-    const uid = decoded.uid || decoded.sub || "unknown";
+    const uid2 = decoded.uid || decoded.sub || "unknown";
     const email = decoded.email || "";
     const displayName = decoded.name || decoded.displayName || (email ? String(email).split("@")[0] : "User");
     let provider = decoded.firebase?.sign_in_provider;
@@ -8619,7 +8619,7 @@ app.get("/api/user/profile", async (req, res) => {
     }
     const plan = "FREE";
     const response2 = {
-      id: uid,
+      id: uid2,
       email,
       name: displayName,
       provider: provider || "unknown",
@@ -8703,6 +8703,9 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
     await loadProviderKeys();
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    const uid2 = decoded?.uid || decoded?.sub || "current";
     const { prompt, model, size = "1024x1024", format = "png", count = 1, seed } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "bad_request", message: "prompt required" });
     const m2 = /^(\d{2,4})x(\d{2,4})$/.exec(String(size));
@@ -8730,10 +8733,11 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
       kind: "image",
       manifestPath: saved.manifestPath,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      uid: uid2
     });
     const idemKey = req.headers["idempotency-key"] || void 0;
-    await recordConsumption("current", { requests: 1, image: Math.max(1, buffers.length) }, idemKey);
+    await recordConsumption(uid2, { requests: 1, image: Math.max(1, buffers.length) }, idemKey);
     return res.json({ success: true, data: { url: saved.manifestPath, jobId: manifest.trace } });
   } catch (error) {
     console.error("[Image API] Error:", error);
@@ -8779,14 +8783,15 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
       saved = await saveArtifacts({ root: process.cwd(), kind: "video" }, items, manifest);
     }
     const idemKey = req.headers["idempotency-key"] || void 0;
-    await recordConsumption("current", { requests: 1, video: 1 }, idemKey);
+    await recordConsumption(uid, { requests: 1, video: 1 }, idemKey);
     jobIndex.set(String(manifest.trace), {
       id: String(manifest.trace),
       status: "completed",
       kind: "video",
       manifestPath: saved.manifestPath,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      uid
     });
     return res.json({ success: true, data: { url: saved.manifestPath, jobId: manifest.trace } });
   } catch (error) {
@@ -8799,10 +8804,15 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
 });
 app.get("/api/v1/jobs/:id", async (req, res) => {
   try {
+    const auth = req.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    const uid2 = decoded?.uid || decoded?.sub || "current";
     const id = String(req.params.id || "").trim();
     if (!id) return res.status(400).json({ error: "bad_request", message: "id required" });
     const info = jobIndex.get(id);
-    if (!info) return res.status(404).json({ error: "not_found", message: "job not found" });
+    if (!info || info.uid && info.uid !== uid2) return res.status(404).json({ error: "not_found", message: "job not found" });
     let manifest;
     if (info.manifestPath) {
       try {
@@ -8981,14 +8991,14 @@ function calcNextReset() {
   d.setUTCHours(0, 0, 0, 0);
   return d.toISOString();
 }
-async function recordConsumption(uid, consumption, idempotencyKey) {
+async function recordConsumption(uid2, consumption, idempotencyKey) {
   const db = await getFirestoreSafe();
   if (!db) return;
-  const docPath = `projects/default/usage/${uid}`;
+  const docPath = `projects/default/usage/${uid2}`;
   const usageRef = db.doc(docPath);
   const nowISO = (/* @__PURE__ */ new Date()).toISOString();
   if (idempotencyKey) {
-    const idemRef = db.doc(`projects/default/usage/${uid}/consumptions/${idempotencyKey}`);
+    const idemRef = db.doc(`projects/default/usage/${uid2}/consumptions/${idempotencyKey}`);
     const idemSnap = await idemRef.get();
     if (idemSnap.exists) return;
     await idemRef.set({ createdAt: nowISO, consumption });
@@ -9022,8 +9032,8 @@ app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
     const db = await getFirestoreSafe();
-    const uid = "current";
-    const docPath = `projects/default/usage/${uid}`;
+    const uid2 = "current";
+    const docPath = `projects/default/usage/${uid2}`;
     let data = null;
     if (db) {
       const snap = await db.doc(docPath).get();
@@ -9042,7 +9052,7 @@ app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
         };
         await db.doc(docPath).set(data);
       }
-      const historySnap = await db.collection(`projects/default/usage/${uid}/consumptions`).orderBy("createdAt", "desc").limit(20).get();
+      const historySnap = await db.collection(`projects/default/usage/${uid2}/consumptions`).orderBy("createdAt", "desc").limit(20).get();
       const history = historySnap.docs.map((d) => ({ id: d.id, ...d.data() }));
       data.history = history;
     } else {
@@ -9070,11 +9080,11 @@ app.post("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
     const { consumption } = req.body || {};
     const idemKey = req.headers["idempotency-key"] || void 0;
     const db = await getFirestoreSafe();
-    const uid = "current";
-    const docPath = `projects/default/usage/${uid}`;
+    const uid2 = "current";
+    const docPath = `projects/default/usage/${uid2}`;
     let data = null;
     if (db) {
-      await recordConsumption(uid, consumption || {}, idemKey);
+      await recordConsumption(uid2, consumption || {}, idemKey);
       const snap = await db.doc(docPath).get();
       data = snap.exists ? snap.data() : { ok: true };
     } else {

package/dist/server/express-server.js

@@ -6913,7 +6913,7 @@ function startRateLimitCleanup() {
     });
   }, 10 * 60 * 1e3);
 }
-async function getFirestorePlan(uid) {
+async function getFirestorePlan(uid2) {
   try {
     const admin = await import('firebase-admin');
     if (!admin.apps?.length) {
@@ -6924,7 +6924,7 @@ async function getFirestorePlan(uid) {
     }
     const { getFirestore } = await import('firebase-admin/firestore');
     const db = getFirestore();
-    const doc = await db.doc(`projects/default/users/${uid}`).get();
+    const doc = await db.doc(`projects/default/users/${uid2}`).get();
     const plan = doc.exists && doc.data()?.plan || "FREE";
     return String(plan).toUpperCase();
   } catch {
@@ -8608,7 +8608,7 @@ app.get("/api/user/profile", async (req, res) => {
     if (!decoded) {
       return res.status(401).json({ error: "invalid_token" });
     }
-    const uid = decoded.uid || decoded.sub || "unknown";
+    const uid2 = decoded.uid || decoded.sub || "unknown";
     const email = decoded.email || "";
     const displayName = decoded.name || decoded.displayName || (email ? String(email).split("@")[0] : "User");
     let provider = decoded.firebase?.sign_in_provider;
@@ -8619,7 +8619,7 @@ app.get("/api/user/profile", async (req, res) => {
     }
     const plan = "FREE";
     const response2 = {
-      id: uid,
+      id: uid2,
       email,
       name: displayName,
       provider: provider || "unknown",
@@ -8703,6 +8703,9 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
     await loadProviderKeys();
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    const uid2 = decoded?.uid || decoded?.sub || "current";
     const { prompt, model, size = "1024x1024", format = "png", count = 1, seed } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "bad_request", message: "prompt required" });
     const m2 = /^(\d{2,4})x(\d{2,4})$/.exec(String(size));
@@ -8730,10 +8733,11 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
       kind: "image",
       manifestPath: saved.manifestPath,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      uid: uid2
     });
     const idemKey = req.headers["idempotency-key"] || void 0;
-    await recordConsumption("current", { requests: 1, image: Math.max(1, buffers.length) }, idemKey);
+    await recordConsumption(uid2, { requests: 1, image: Math.max(1, buffers.length) }, idemKey);
     return res.json({ success: true, data: { url: saved.manifestPath, jobId: manifest.trace } });
   } catch (error) {
     console.error("[Image API] Error:", error);
@@ -8779,14 +8783,15 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
       saved = await saveArtifacts({ root: process.cwd(), kind: "video" }, items, manifest);
     }
     const idemKey = req.headers["idempotency-key"] || void 0;
-    await recordConsumption("current", { requests: 1, video: 1 }, idemKey);
+    await recordConsumption(uid, { requests: 1, video: 1 }, idemKey);
     jobIndex.set(String(manifest.trace), {
       id: String(manifest.trace),
       status: "completed",
       kind: "video",
       manifestPath: saved.manifestPath,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      uid
     });
     return res.json({ success: true, data: { url: saved.manifestPath, jobId: manifest.trace } });
   } catch (error) {
@@ -8799,10 +8804,15 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
 });
 app.get("/api/v1/jobs/:id", async (req, res) => {
   try {
+    const auth = req.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    const uid2 = decoded?.uid || decoded?.sub || "current";
     const id = String(req.params.id || "").trim();
     if (!id) return res.status(400).json({ error: "bad_request", message: "id required" });
     const info = jobIndex.get(id);
-    if (!info) return res.status(404).json({ error: "not_found", message: "job not found" });
+    if (!info || info.uid && info.uid !== uid2) return res.status(404).json({ error: "not_found", message: "job not found" });
     let manifest;
     if (info.manifestPath) {
       try {
@@ -8981,14 +8991,14 @@ function calcNextReset() {
   d.setUTCHours(0, 0, 0, 0);
   return d.toISOString();
 }
-async function recordConsumption(uid, consumption, idempotencyKey) {
+async function recordConsumption(uid2, consumption, idempotencyKey) {
   const db = await getFirestoreSafe();
   if (!db) return;
-  const docPath = `projects/default/usage/${uid}`;
+  const docPath = `projects/default/usage/${uid2}`;
   const usageRef = db.doc(docPath);
   const nowISO = (/* @__PURE__ */ new Date()).toISOString();
   if (idempotencyKey) {
-    const idemRef = db.doc(`projects/default/usage/${uid}/consumptions/${idempotencyKey}`);
+    const idemRef = db.doc(`projects/default/usage/${uid2}/consumptions/${idempotencyKey}`);
     const idemSnap = await idemRef.get();
     if (idemSnap.exists) return;
     await idemRef.set({ createdAt: nowISO, consumption });
@@ -9022,8 +9032,8 @@ app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
     const db = await getFirestoreSafe();
-    const uid = "current";
-    const docPath = `projects/default/usage/${uid}`;
+    const uid2 = "current";
+    const docPath = `projects/default/usage/${uid2}`;
     let data = null;
     if (db) {
       const snap = await db.doc(docPath).get();
@@ -9042,7 +9052,7 @@ app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
         };
         await db.doc(docPath).set(data);
       }
-      const historySnap = await db.collection(`projects/default/usage/${uid}/consumptions`).orderBy("createdAt", "desc").limit(20).get();
+      const historySnap = await db.collection(`projects/default/usage/${uid2}/consumptions`).orderBy("createdAt", "desc").limit(20).get();
       const history = historySnap.docs.map((d) => ({ id: d.id, ...d.data() }));
       data.history = history;
     } else {
@@ -9070,11 +9080,11 @@ app.post("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
     const { consumption } = req.body || {};
     const idemKey = req.headers["idempotency-key"] || void 0;
     const db = await getFirestoreSafe();
-    const uid = "current";
-    const docPath = `projects/default/usage/${uid}`;
+    const uid2 = "current";
+    const docPath = `projects/default/usage/${uid2}`;
     let data = null;
     if (db) {
-      await recordConsumption(uid, consumption || {}, idemKey);
+      await recordConsumption(uid2, consumption || {}, idemKey);
       const snap = await db.doc(docPath).get();
       data = snap.exists ? snap.data() : { ok: true };
     } else {

package/dist/server-express.cjs

@@ -6913,7 +6913,7 @@ function startRateLimitCleanup() {
     });
   }, 10 * 60 * 1e3);
 }
-async function getFirestorePlan(uid) {
+async function getFirestorePlan(uid2) {
   try {
     const admin = await import('firebase-admin');
     if (!admin.apps?.length) {
@@ -6924,7 +6924,7 @@ async function getFirestorePlan(uid) {
     }
     const { getFirestore } = await import('firebase-admin/firestore');
     const db = getFirestore();
-    const doc = await db.doc(`projects/default/users/${uid}`).get();
+    const doc = await db.doc(`projects/default/users/${uid2}`).get();
     const plan = doc.exists && doc.data()?.plan || "FREE";
     return String(plan).toUpperCase();
   } catch {
@@ -8608,7 +8608,7 @@ app.get("/api/user/profile", async (req, res) => {
     if (!decoded) {
       return res.status(401).json({ error: "invalid_token" });
     }
-    const uid = decoded.uid || decoded.sub || "unknown";
+    const uid2 = decoded.uid || decoded.sub || "unknown";
     const email = decoded.email || "";
     const displayName = decoded.name || decoded.displayName || (email ? String(email).split("@")[0] : "User");
     let provider = decoded.firebase?.sign_in_provider;
@@ -8619,7 +8619,7 @@ app.get("/api/user/profile", async (req, res) => {
     }
     const plan = "FREE";
     const response2 = {
-      id: uid,
+      id: uid2,
       email,
       name: displayName,
       provider: provider || "unknown",
@@ -8703,6 +8703,9 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
     await loadProviderKeys();
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    const uid2 = decoded?.uid || decoded?.sub || "current";
     const { prompt, model, size = "1024x1024", format = "png", count = 1, seed } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "bad_request", message: "prompt required" });
     const m2 = /^(\d{2,4})x(\d{2,4})$/.exec(String(size));
@@ -8730,10 +8733,11 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
       kind: "image",
       manifestPath: saved.manifestPath,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      uid: uid2
     });
     const idemKey = req.headers["idempotency-key"] || void 0;
-    await recordConsumption("current", { requests: 1, image: Math.max(1, buffers.length) }, idemKey);
+    await recordConsumption(uid2, { requests: 1, image: Math.max(1, buffers.length) }, idemKey);
     return res.json({ success: true, data: { url: saved.manifestPath, jobId: manifest.trace } });
   } catch (error) {
     console.error("[Image API] Error:", error);
@@ -8779,14 +8783,15 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
       saved = await saveArtifacts({ root: process.cwd(), kind: "video" }, items, manifest);
     }
     const idemKey = req.headers["idempotency-key"] || void 0;
-    await recordConsumption("current", { requests: 1, video: 1 }, idemKey);
+    await recordConsumption(uid, { requests: 1, video: 1 }, idemKey);
     jobIndex.set(String(manifest.trace), {
       id: String(manifest.trace),
       status: "completed",
       kind: "video",
       manifestPath: saved.manifestPath,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      uid
     });
     return res.json({ success: true, data: { url: saved.manifestPath, jobId: manifest.trace } });
   } catch (error) {
@@ -8799,10 +8804,15 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
 });
 app.get("/api/v1/jobs/:id", async (req, res) => {
   try {
+    const auth = req.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    const uid2 = decoded?.uid || decoded?.sub || "current";
     const id = String(req.params.id || "").trim();
     if (!id) return res.status(400).json({ error: "bad_request", message: "id required" });
     const info = jobIndex.get(id);
-    if (!info) return res.status(404).json({ error: "not_found", message: "job not found" });
+    if (!info || info.uid && info.uid !== uid2) return res.status(404).json({ error: "not_found", message: "job not found" });
     let manifest;
     if (info.manifestPath) {
       try {
@@ -8981,14 +8991,14 @@ function calcNextReset() {
   d.setUTCHours(0, 0, 0, 0);
   return d.toISOString();
 }
-async function recordConsumption(uid, consumption, idempotencyKey) {
+async function recordConsumption(uid2, consumption, idempotencyKey) {
   const db = await getFirestoreSafe();
   if (!db) return;
-  const docPath = `projects/default/usage/${uid}`;
+  const docPath = `projects/default/usage/${uid2}`;
   const usageRef = db.doc(docPath);
   const nowISO = (/* @__PURE__ */ new Date()).toISOString();
   if (idempotencyKey) {
-    const idemRef = db.doc(`projects/default/usage/${uid}/consumptions/${idempotencyKey}`);
+    const idemRef = db.doc(`projects/default/usage/${uid2}/consumptions/${idempotencyKey}`);
     const idemSnap = await idemRef.get();
     if (idemSnap.exists) return;
     await idemRef.set({ createdAt: nowISO, consumption });
@@ -9022,8 +9032,8 @@ app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
     const db = await getFirestoreSafe();
-    const uid = "current";
-    const docPath = `projects/default/usage/${uid}`;
+    const uid2 = "current";
+    const docPath = `projects/default/usage/${uid2}`;
     let data = null;
     if (db) {
       const snap = await db.doc(docPath).get();
@@ -9042,7 +9052,7 @@ app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
         };
         await db.doc(docPath).set(data);
       }
-      const historySnap = await db.collection(`projects/default/usage/${uid}/consumptions`).orderBy("createdAt", "desc").limit(20).get();
+      const historySnap = await db.collection(`projects/default/usage/${uid2}/consumptions`).orderBy("createdAt", "desc").limit(20).get();
       const history = historySnap.docs.map((d) => ({ id: d.id, ...d.data() }));
       data.history = history;
     } else {
@@ -9070,11 +9080,11 @@ app.post("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
     const { consumption } = req.body || {};
     const idemKey = req.headers["idempotency-key"] || void 0;
     const db = await getFirestoreSafe();
-    const uid = "current";
-    const docPath = `projects/default/usage/${uid}`;
+    const uid2 = "current";
+    const docPath = `projects/default/usage/${uid2}`;
     let data = null;
     if (db) {
-      await recordConsumption(uid, consumption || {}, idemKey);
+      await recordConsumption(uid2, consumption || {}, idemKey);
       const snap = await db.doc(docPath).get();
       data = snap.exists ? snap.data() : { ok: true };
     } else {