@cachly-dev/mcp-server 0.10.48 → 0.10.50

package/apps/travel-chaos-organizer/backend/app/routers/trips.py

@@ -0,0 +1,134 @@
+from typing import Annotated
+from uuid import UUID
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.auth.keycloak import user_id, user_id_or_bot
+from app.db.database import get_db
+from app.models.schemas import TripCreate, TripOut, TripUpdate
+from app.services import quota
+from app.limiter import limiter
+
+router = APIRouter(prefix="/trips", tags=["trips"])
+
+
+@router.get("", response_model=list[TripOut])
+async def list_trips(
+    uid: Annotated[str, Depends(user_id_or_bot)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    result = await db.execute(
+        text("SELECT * FROM trips WHERE user_id = :uid ORDER BY start_date ASC, created_at DESC"),
+        {"uid": uid},
+    )
+    return [dict(r._mapping) for r in result.fetchall()]
+
+
+@router.get("/search", response_model=list[TripOut])
+async def search_trips(
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    q: str = "",
+):
+    if not q.strip():
+        return []
+    pattern = f"%{q.strip()}%"
+    result = await db.execute(
+        text("""
+            SELECT DISTINCT t.* FROM trips t
+            LEFT JOIN trip_items ti ON ti.trip_id = t.id
+            WHERE t.user_id = :uid
+              AND (
+                t.name LIKE :p OR t.description LIKE :p
+                OR ti.title LIKE :p OR ti.provider LIKE :p
+                OR ti.booking_ref LIKE :p
+              )
+            ORDER BY t.start_date ASC, t.created_at DESC
+        """),
+        {"uid": uid, "p": pattern},
+    )
+    rows = [dict(r._mapping) for r in result.fetchall()]
+    from app.services import telemetry
+    await telemetry.track(db, uid, "trip_search", {"q": q.strip()[:100], "result_count": len(rows)})
+    return rows
+
+
+@limiter.limit("30/minute")
+@router.post("", response_model=TripOut, status_code=status.HTTP_201_CREATED)
+async def create_trip(
+    request: Request,
+    body: TripCreate,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    await quota.check_trips(db, uid)
+    result = await db.execute(
+        text("""
+            INSERT INTO trips (user_id, name, description, start_date, end_date)
+            VALUES (:uid, :name, :desc, :start_date, :end_date)
+            RETURNING *
+        """),
+        {"uid": uid, "name": body.name, "desc": body.description,
+         "start_date": body.start_date, "end_date": body.end_date},
+    )
+    await db.commit()
+    return dict(result.fetchone()._mapping)
+
+
+@router.get("/{trip_id}", response_model=TripOut)
+async def get_trip(
+    trip_id: UUID,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    result = await db.execute(
+        text("SELECT * FROM trips WHERE id = :id AND user_id = :uid"),
+        {"id": str(trip_id), "uid": uid},
+    )
+    row = result.fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Trip not found")
+    return dict(row._mapping)
+
+
+@limiter.limit("30/minute")
+@router.patch("/{trip_id}", response_model=TripOut)
+async def update_trip(
+    request: Request,
+    trip_id: UUID,
+    body: TripUpdate,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    updates = body.model_dump(exclude_none=True)
+    if not updates:
+        raise HTTPException(status_code=400, detail="Nothing to update")
+
+    set_clauses = ", ".join(f"{k} = :{k}" for k in updates)
+    updates.update({"id": str(trip_id), "uid": uid})
+    result = await db.execute(
+        text(f"UPDATE trips SET {set_clauses}, updated_at = CURRENT_TIMESTAMP WHERE id = :id AND user_id = :uid RETURNING *"),
+        updates,
+    )
+    row = result.fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Trip not found")
+    await db.commit()
+    return dict(row._mapping)
+
+
+@limiter.limit("30/minute")
+@router.delete("/{trip_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_trip(
+    request: Request,
+    trip_id: UUID,
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    result = await db.execute(
+        text("DELETE FROM trips WHERE id = :id AND user_id = :uid"),
+        {"id": str(trip_id), "uid": uid},
+    )
+    await db.commit()
+    if result.rowcount == 0:
+        raise HTTPException(status_code=404, detail="Trip not found")

package/apps/travel-chaos-organizer/backend/app/routers/users.py

@@ -0,0 +1,169 @@
+"""
+User profile endpoint — returns current user's plan info and upserts user row.
+"""
+import secrets
+from typing import Annotated
+from datetime import datetime, timedelta, timezone
+from fastapi import APIRouter, Depends, HTTPException, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import text
+from app.auth.keycloak import user_id
+from app.db.database import get_db
+
+# In-process PIN store (sufficient for single-process; use Redis for multi-replica)
+_pending_links: dict[str, tuple[str, datetime]] = {}  # pin -> (uid, expires_at)
+
+router = APIRouter(prefix="/users", tags=["users"])
+
+@router.get("/me")
+async def me(
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    # Upsert user row (first login creates it)
+    await db.execute(
+        text("""
+            INSERT INTO users (id) VALUES (:uid)
+            ON CONFLICT (id) DO NOTHING
+        """),
+        {"uid": uid},
+    )
+    await db.commit()
+
+    row_check = await db.execute(text("SELECT created_at, updated_at FROM users WHERE id = :uid"), {"uid": uid})
+    user_row = row_check.fetchone()
+    # Track first login (created_at == updated_at means fresh insert)
+    if user_row and str(user_row[0])[:19] == str(user_row[1])[:19]:
+        from app.services import telemetry, notifier
+        await telemetry.track(db, uid, "user_first_login", {"uid": uid})
+        await notifier.notify("tco", "new_user", {"uid": uid[:8] + "..."})
+
+    row = await db.execute(
+        text("""
+            SELECT id, email, plan, plan_expires_at, created_at, telegram_chat_id
+            FROM users WHERE id = :uid
+        """),
+        {"uid": uid},
+    )
+    r = row.fetchone()
+    now = datetime.now(timezone.utc)
+    plan = r[2] if r else "free"
+    plan_expires_at = r[3] if r else None
+    telegram_linked = bool(r[5]) if r else False
+    # plan is only active if not expired
+    if plan != "free" and plan_expires_at is not None:
+        if isinstance(plan_expires_at, str):
+            from datetime import datetime as _dt
+            try:
+                plan_expires_at_dt = _dt.fromisoformat(plan_expires_at.replace("Z", "+00:00"))
+            except ValueError:
+                plan_expires_at_dt = None
+        else:
+            plan_expires_at_dt = plan_expires_at
+        if plan_expires_at_dt and plan_expires_at_dt < now:
+            plan = "free"
+
+    return {
+        "id": uid,
+        "plan": plan,
+        "plan_expires_at": plan_expires_at,
+        "free_daily_parses": 50,
+        "free_max_trips": 3,
+        "is_pro": plan != "free",
+        "telegram_linked": telegram_linked,
+    }
+
+
+@router.post("/telegram-pin")
+async def generate_telegram_pin(
+    uid: Annotated[str, Depends(user_id)],
+):
+    """Generate a 6-digit PIN valid 10 min to link Telegram account."""
+    pin = str(secrets.randbelow(900000) + 100000)  # 100000-999999
+    expires = datetime.now(timezone.utc) + timedelta(minutes=10)
+    _pending_links[pin] = (uid, expires)
+    return {"pin": pin, "expires_in_seconds": 600}
+
+
+@router.post("/telegram-link")
+async def confirm_telegram_link(
+    pin: str,
+    chat_id: str,
+    request: Request,
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Called by the bot: validates PIN and stores chat_id. Requires X-Bot-Token header."""
+    from app.config import get_settings as _gs
+    s = _gs()
+    bot_token = request.headers.get("X-Bot-Token", "")
+    if not s.telegram_bot_token or bot_token != s.telegram_bot_token:
+        raise HTTPException(status_code=401, detail="Unauthorized")
+    entry = _pending_links.get(pin)
+    if not entry:
+        raise HTTPException(status_code=404, detail="PIN not found or expired")
+    uid, expires = entry
+    if datetime.now(timezone.utc) > expires:
+        del _pending_links[pin]
+        raise HTTPException(status_code=410, detail="PIN expired")
+    del _pending_links[pin]
+    await db.execute(
+        text("UPDATE users SET telegram_chat_id = :cid WHERE id = :uid"),
+        {"cid": chat_id, "uid": uid},
+    )
+    await db.commit()
+    return {"ok": True, "uid": uid}
+
+
+from pydantic import BaseModel as _BaseModel
+
+class TelegramNotifyBody(_BaseModel):
+    message: str
+
+
+@router.post("/telegram-notify")
+async def telegram_notify(
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+    body: TelegramNotifyBody,
+):
+    """Send a Telegram message to the current user's linked chat.
+    Used by MCP tools and external integrations."""
+    from app.services import notifier as notifier_svc
+    await notifier_svc.notify_user(db, uid, body.message)
+    return {"ok": True}
+
+
+@router.delete("/telegram-unlink")
+async def telegram_unlink(
+    uid: Annotated[str, Depends(user_id)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Unlink Telegram from the current user account."""
+    await db.execute(
+        text("UPDATE users SET telegram_chat_id = NULL WHERE id = :uid"),
+        {"uid": uid},
+    )
+    await db.commit()
+    return {"ok": True}
+
+
+@router.get("/by-telegram/{chat_id}")
+async def get_user_by_telegram(
+    chat_id: str,
+    request: Request,
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    """Bot-internal: get user's trips by telegram chat_id. Authenticated by bot token header."""
+    from app.config import get_settings
+    s = get_settings()
+    bot_token = request.headers.get("X-Bot-Token", "")
+    if not s.telegram_bot_token or bot_token != s.telegram_bot_token:
+        raise HTTPException(status_code=401, detail="Unauthorized")
+    result = await db.execute(
+        text("SELECT id, email, plan FROM users WHERE telegram_chat_id = :cid"),
+        {"cid": chat_id},
+    )
+    row = result.fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Not linked")
+    return {"id": row[0], "email": row[1], "plan": row[2]}

package/apps/travel-chaos-organizer/backend/app/routers/waitlist.py

@@ -0,0 +1,37 @@
+from typing import Annotated
+from fastapi import APIRouter, Depends, Request
+from pydantic import BaseModel, EmailStr
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import text
+from app.db.database import get_db
+from app.services import notifier, email as email_svc
+from app.limiter import limiter
+
+router = APIRouter(prefix="/waitlist", tags=["waitlist"])
+
+
+class WaitlistBody(BaseModel):
+    email: EmailStr
+    source: str = "landing"
+
+
+@limiter.limit("5/minute")
+@router.post("")
+async def join_waitlist(
+    request: Request,
+    body: WaitlistBody,
+    db: Annotated[AsyncSession, Depends(get_db)],
+):
+    try:
+        await db.execute(
+            text("INSERT INTO waitlist (email, source) VALUES (:email, :source)"),
+            {"email": body.email.lower(), "source": body.source},
+        )
+        await db.commit()
+        # Fire-and-forget: notification + welcome email
+        await notifier.notify("tco", "waitlist_signup", {"email": body.email.lower(), "source": body.source})
+        await email_svc.send_waitlist_welcome(body.email.lower())
+        return {"joined": True}
+    except Exception:
+        await db.rollback()
+        return {"already_joined": True}

package/apps/travel-chaos-organizer/backend/app/services/cache.py

@@ -0,0 +1,131 @@
+"""
+Cachly Redis cache for Ollama parse results.
+
+When CACHLY_REDIS_URL is configured, parsed documents are stored by
+content hash (SHA-256). Uploading the same PDF or text twice returns
+the cached result instantly — no second AI call.
+
+Hit/miss counters are stored in Redis (tco:stats:hits / tco:stats:misses)
+so they survive restarts and are visible in the /api/v1/cache/stats endpoint.
+
+Cache key format: tco:parse:{hex16}
+Stats keys:       tco:stats:hits, tco:stats:misses
+TTL: 7 days (parse results are deterministic for the same input)
+"""
+import hashlib
+import json
+from typing import Any
+
+_redis_client: Any = None
+_redis_available = False
+
+CACHE_TTL = 7 * 24 * 3600  # 7 days
+
+
+def _get_client():
+    """Lazy-init Redis client. Returns None if Cachly is not configured."""
+    global _redis_client, _redis_available
+    if _redis_client is not None:
+        return _redis_client if _redis_available else None
+
+    import os
+    redis_url = os.getenv("CACHLY_REDIS_URL", "")
+    if not redis_url:
+        _redis_available = False
+        return None
+
+    try:
+        import redis.asyncio as aioredis
+        _redis_client = aioredis.from_url(redis_url, decode_responses=True, socket_connect_timeout=3)
+        _redis_available = True
+        return _redis_client
+    except Exception:
+        _redis_available = False
+        return None
+
+
+def _cache_key(content: str | bytes) -> str:
+    if isinstance(content, str):
+        content = content.encode()
+    digest = hashlib.sha256(content).hexdigest()[:16]
+    return f"tco:parse:{digest}"
+
+
+async def cache_get(content: str | bytes) -> dict | None:
+    """Return cached parse result for this content, or None on miss/error.
+    Increments tco:stats:hits on hit, tco:stats:misses on miss."""
+    client = _get_client()
+    if client is None:
+        return None
+    try:
+        key = _cache_key(content)
+        raw = await client.get(key)
+        if raw is None:
+            await client.incr("tco:stats:misses")
+            return None
+        await client.incr("tco:stats:hits")
+        return json.loads(raw)
+    except Exception:
+        return None
+
+
+async def cache_set(content: str | bytes, parsed: dict) -> None:
+    """Store parse result. Fire-and-forget — never blocks or raises."""
+    client = _get_client()
+    if client is None:
+        return
+    try:
+        key = _cache_key(content)
+        await client.set(key, json.dumps(parsed), ex=CACHE_TTL)
+    except Exception:
+        pass
+
+
+async def cache_stats() -> dict:
+    """Return cache statistics. Returns zeros if Redis is not configured."""
+    client = _get_client()
+    configured = cachly_configured()
+    if client is None:
+        return {
+            "configured": configured,
+            "hits": 0,
+            "misses": 0,
+            "key_count": 0,
+            "hit_rate": 0.0,
+            "ttl_days": CACHE_TTL // 86400,
+        }
+    try:
+        hits_raw, misses_raw = await client.mget("tco:stats:hits", "tco:stats:misses")
+        hits = int(hits_raw or 0)
+        misses = int(misses_raw or 0)
+        total = hits + misses
+        hit_rate = round(hits / total, 4) if total > 0 else 0.0
+
+        # count tco:parse:* keys — SCAN is O(1) per call, safe on large keyspaces
+        key_count = 0
+        async for _ in client.scan_iter("tco:parse:*", count=100):
+            key_count += 1
+
+        return {
+            "configured": True,
+            "hits": hits,
+            "misses": misses,
+            "key_count": key_count,
+            "hit_rate": hit_rate,
+            "ttl_days": CACHE_TTL // 86400,
+        }
+    except Exception:
+        return {
+            "configured": configured,
+            "hits": 0,
+            "misses": 0,
+            "key_count": 0,
+            "hit_rate": 0.0,
+            "ttl_days": CACHE_TTL // 86400,
+        }
+
+
+def cachly_configured() -> bool:
+    """True if CACHLY_REDIS_URL is set."""
+    import os
+    return bool(os.getenv("CACHLY_REDIS_URL", ""))

package/apps/travel-chaos-organizer/backend/app/services/drip.py

@@ -0,0 +1,128 @@
+"""
+Email drip sequence for waitlist signups.
+Triggered manually via admin endpoint or a cron job.
+
+Sequence:
+  Day 0  — welcome email (sent at signup, already handled in waitlist.py)
+  Day 3  — "Import your first document" nudge
+  Day 7  — "Upgrade to Pro" offer
+  Day 14 — "What are you organising?" feedback request
+"""
+from datetime import datetime, timedelta, timezone
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import text
+from app.services import email as email_svc
+from app.config import get_settings as _get_settings
+
+
+SEQUENCE = [
+    (3,  "day3_nudge"),
+    (7,  "day7_upgrade"),
+    (14, "day14_feedback"),
+]
+
+SUBJECTS = {
+    "day3_nudge":      "Hast du schon dein erstes Dokument importiert? ✈️",
+    "day7_upgrade":    "Unbegrenzte Trips mit TCO Pro 🚀",
+    "day14_feedback":  "Was organisierst du mit TCO? Wir wollen's wissen 💬",
+}
+
+BODIES = {
+    "day3_nudge": """
+<p>Hey,</p>
+<p>du hast dich vor 3 Tagen für Travel Chaos Organizer angemeldet – super!</p>
+<p>Hast du schon versucht, ein Buchungsbestätigungs-PDF oder Screenshot zu importieren?
+Einfach in der App auf <strong>„Dokument importieren"</strong> tippen –
+unsere KI erkennt Flüge, Hotels und Mietwagen automatisch.</p>
+<p>Viel Spaß beim Aufräumen des Reisechaos 🗂️</p>
+""",
+    "day7_upgrade": """
+<p>Hey,</p>
+<p>nach einer Woche mit TCO: wie läuft's?</p>
+<p>Mit dem <strong>kostenlosen Plan</strong> hast du 3 Trips und 50 KI-Parses pro Tag.
+Für Vielreisende gibt's <strong>TCO Pro</strong>: unbegrenzte Trips, unbegrenzte Parses.</p>
+<p><a href="{upgrade_url}" style="background:#4f46e5;color:#fff;padding:10px 20px;border-radius:8px;text-decoration:none;display:inline-block;">Jetzt upgraden →</a></p>
+""",
+    "day14_feedback": """
+<p>Hey,</p>
+<p>du nutzt TCO jetzt seit 2 Wochen – wir würden gerne wissen, was du organisierst
+und was wir verbessern können.</p>
+<p>Einfach auf diese Mail antworten – jede Rückmeldung hilft uns sehr!</p>
+""",
+}
+
+
+async def run_drip(db: AsyncSession, dry_run: bool = False) -> dict:
+    """
+    Check all waitlist signups and send due emails.
+    Tracks sent emails in the events table to avoid duplicates.
+    Returns a dict with counts.
+    """
+    sent = 0
+    skipped = 0
+    now = datetime.now(timezone.utc)
+
+    rows = await db.execute(text("SELECT id, email, created_at FROM waitlist ORDER BY created_at ASC"))
+    signups = rows.fetchall()
+
+    _s = _get_settings()
+    _app_url = getattr(_s, 'app_url', 'https://tco.app')
+    _upgrade_url = getattr(_s, 'stripe_success_url', 'https://tco.app/upgrade').replace('/upgrade/success', '/upgrade')
+
+    for signup in signups:
+        signup_id, email, created_at = signup
+        if isinstance(created_at, str):
+            from datetime import datetime as _dt
+            try:
+                created_at = _dt.fromisoformat(created_at.replace("Z", "+00:00"))
+            except ValueError:
+                continue
+        if created_at.tzinfo is None:
+            created_at = created_at.replace(tzinfo=timezone.utc)
+
+        days_since = (now - created_at).days
+
+        for day, event_name in SEQUENCE:
+            if days_since < day:
+                continue
+
+            # Check if already sent
+            already = await db.execute(
+                text("""
+                    SELECT 1 FROM events
+                    WHERE user_id IS NULL
+                      AND event_name = :name
+                      AND properties::text LIKE :email_pat
+                    LIMIT 1
+                """),
+                {"name": f"drip_{event_name}", "email_pat": f'%{email}%'},
+            )
+            if already.fetchone():
+                skipped += 1
+                continue
+
+            if not dry_run:
+                subject = SUBJECTS[event_name]
+                body = BODIES[event_name].format(upgrade_url=_upgrade_url)
+                html = f"""
+                <div style="font-family:system-ui,sans-serif;max-width:560px;margin:0 auto;padding:24px">
+                <img src="{_app_url}/logo.png" height="32" style="margin-bottom:24px">
+                {body}
+                <hr style="border:none;border-top:1px solid #eee;margin:24px 0">
+                <p style="color:#999;font-size:12px">Travel Chaos Organizer · <a href="{_app_url}">tco.app</a></p>
+                </div>"""
+                await email_svc._send(email, subject, html)
+
+                # Track as sent
+                import json
+                await db.execute(
+                    text("""
+                        INSERT INTO events (user_id, event_name, properties)
+                        VALUES (NULL, :name, :props)
+                    """),
+                    {"name": f"drip_{event_name}", "props": json.dumps({"email": email, "signup_id": str(signup_id)})},
+                )
+                await db.commit()
+            sent += 1
+
+    return {"sent": sent, "skipped": skipped, "dry_run": dry_run}

package/apps/travel-chaos-organizer/backend/app/services/email.py

@@ -0,0 +1,61 @@
+"""
+Transactional email via Resend API.
+No-op when RESEND_API_KEY is not set.
+"""
+import os
+from typing import Any
+from app.config import get_settings
+
+
+def _configured() -> bool:
+    return bool(os.getenv("RESEND_API_KEY", ""))
+
+
+async def send_waitlist_welcome(to_email: str) -> None:
+    """Send welcome email after waitlist signup."""
+    if not _configured():
+        return
+    try:
+        import httpx
+        api_key = os.getenv("RESEND_API_KEY", "")
+        from_addr = os.getenv("RESEND_FROM", "noreply@tco.app")
+        async with httpx.AsyncClient(timeout=10) as client:
+            await client.post(
+                "https://api.resend.com/emails",
+                headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"},
+                json={
+                    "from": from_addr,
+                    "to": [to_email],
+                    "subject": "Du bist auf der Liste 🗺️",
+                    "html": _welcome_html(to_email),
+                },
+            )
+    except Exception:
+        pass
+
+
+async def _send(to: str, subject: str, html: str) -> None:
+    """Generic send — used by drip and other services."""
+    s = get_settings()
+    if not s.resend_api_key:
+        return
+    import httpx
+    async with httpx.AsyncClient() as client:
+        await client.post(
+            "https://api.resend.com/emails",
+            headers={"Authorization": f"Bearer {s.resend_api_key}", "Content-Type": "application/json"},
+            json={"from": s.resend_from, "to": [to], "subject": subject, "html": html},
+            timeout=10,
+        )
+
+
+def _welcome_html(email: str) -> str:
+    return f"""
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;background:#0f0f1a;color:#e2e8f0;padding:40px;max-width:560px;margin:0 auto">
+  <h1 style="color:#a5b4fc;font-size:24px;margin-bottom:8px">🗺️ Du bist auf der Liste.</h1>
+  <p style="color:#6666aa;margin-bottom:24px">Wir melden uns, sobald Travel Chaos Organizer bereit ist.</p>
+  <p style="font-size:14px;color:#3a3a5e">Registriert mit: {email}</p>
+</body>
+</html>"""