@frockbot/cloudflare 0.0.0 → 0.7.292

package/src/billing.ts

@@ -0,0 +1,461 @@
+import { BRAND_V1 } from "#brand";
+import {
+  BILLING_LAUNCH_BLOCKERS,
+  hostedBillingEnabledV1,
+} from "./billing-readiness.js";
+import { COMPUTER_TARIFF } from "@frockbot/app/billing/computer";
+import type { HostedModelRatesV1 } from "@frockbot/app/billing/rates";
+import { normalizeFrockModelIdV1 } from "@frockbot/providers/frock-ai/catalog";
+import {
+  BillingError,
+  type UsageReservation,
+  type UsageSettlement,
+} from "@frockbot/app/billing/ledger";
+import {
+  AccountPayments,
+  StripeClient,
+  boundedText,
+  object,
+  stripeId,
+  verifyStripeEvent,
+  type StripeConfig,
+} from "@frockbot/app/billing/stripe";
+import {
+  billingPageV1,
+  billingScript,
+  billingStyles,
+} from "@frockbot/app/billing/page";
+import type { BillingLedger } from "@frockbot/app/billing/ledger";
+import {
+  SPEND_DIMENSIONS_V1,
+  SPEND_PERIODS_V1,
+  type SpendDimensionV1,
+  type SpendingReportV1,
+  type SpendPeriodV1,
+} from "@frockbot/app/billing/spending";
+import type { BackendRouteContribution } from "./contracts.js";
+
+export interface BillingEnv {
+  STRIPE_SECRET_KEY?: string;
+  STRIPE_WEBHOOK_SECRET?: string;
+  STRIPE_MONTHLY_PRICE_ID?: string;
+  BETTER_AUTH_URL?: string;
+}
+export function stripeConfig(env: BillingEnv): StripeConfig {
+  if (
+    !env.STRIPE_SECRET_KEY ||
+    !env.STRIPE_WEBHOOK_SECRET ||
+    !env.STRIPE_MONTHLY_PRICE_ID ||
+    !env.BETTER_AUTH_URL
+  )
+    throw new BillingError(
+      "Payments are not available yet. Please check back soon.",
+      503,
+    );
+  const origin = new URL(env.BETTER_AUTH_URL).origin;
+  if (!/^price_[a-zA-Z0-9]+$/.test(env.STRIPE_MONTHLY_PRICE_ID))
+    throw new BillingError("Payment plan is not configured", 503);
+  return {
+    productName: BRAND_V1.productName,
+    secretKey: env.STRIPE_SECRET_KEY,
+    webhookSecret: env.STRIPE_WEBHOOK_SECRET,
+    monthlyPriceId: env.STRIPE_MONTHLY_PRICE_ID,
+    origin,
+  };
+}
+export function accountPayments(
+  ledger: BillingLedger,
+  env: BillingEnv,
+  userId: string,
+) {
+  return new AccountPayments(
+    ledger,
+    new StripeClient(stripeConfig(env)),
+    userId,
+  );
+}
+export interface BillingAccountRpc {
+  reconcileBilling(input: {
+    userId: string;
+    command: Parameters<BillingLedger["reconcile"]>[0];
+  }): Promise<void>;
+  readBilling(input: {
+    userId: string;
+    before?: number;
+  }): Promise<ReturnType<BillingLedger["snapshot"]>>;
+  billingCheckout(input: {
+    userId: string;
+    command: { id: string; kind: "subscription" | "topup"; cents?: number };
+  }): Promise<{ url: string }>;
+  billingPortal(input: {
+    userId: string;
+    commandId: string;
+  }): Promise<{ url: string }>;
+  billingWebhook(input: {
+    userId: string;
+    event: Record<string, unknown>;
+  }): Promise<void>;
+  reserveUsage(input: {
+    userId: string;
+    reservation: UsageReservation;
+  }): Promise<{
+    status: "reserved" | "settled" | "released";
+    created: boolean;
+  }>;
+  settleUsage(input: {
+    userId: string;
+    settlement: UsageSettlement;
+  }): Promise<void>;
+  requirePaidAccount(input: { userId: string }): Promise<void>;
+  setSpendingLimit(input: {
+    userId: string;
+    scope: string;
+    dailyMicros: number | null;
+  }): Promise<void>;
+  readSpendingPaused(input: {
+    userId: string;
+    scopes: string[];
+  }): Promise<boolean>;
+  claimSpendingSpike(input: {
+    userId: string;
+    scope: string;
+  }): Promise<{ todayMicros: number; usualMicros: number } | null>;
+  readSpending(input: {
+    userId: string;
+    period: SpendPeriodV1;
+    groupBy: SpendDimensionV1;
+    filters: Partial<Record<SpendDimensionV1, string>>;
+  }): Promise<SpendingReportV1>;
+}
+
+/**
+ * `GET /api/billing/spending?period=30d&groupBy=cause&bot=<id>…`: one view of
+ * the Spending page. Each dimension may also be a filter, named by the key a
+ * grouping by it returned.
+ */
+export function decodeSpendingQueryV1(url: URL): {
+  period: SpendPeriodV1;
+  groupBy: SpendDimensionV1;
+  filters: Partial<Record<SpendDimensionV1, string>>;
+} {
+  const period = SPEND_PERIODS_V1.find(
+    (p) => p === (url.searchParams.get("period") ?? "30d"),
+  );
+  const groupBy = SPEND_DIMENSIONS_V1.find(
+    (d) => d === (url.searchParams.get("groupBy") ?? "bot"),
+  );
+  if (!period || !groupBy) throw new BillingError("Invalid spending view", 400);
+  const filters: Partial<Record<SpendDimensionV1, string>> = {};
+  for (const dimension of SPEND_DIMENSIONS_V1) {
+    const value = url.searchParams.get(dimension);
+    if (value === null) continue;
+    if (value.length > 600)
+      throw new BillingError("Invalid spending view", 400);
+    filters[dimension] = value;
+  }
+  return { period, groupBy, filters };
+}
+function failure(error: unknown) {
+  return Response.json(
+    {
+      error:
+        error instanceof Error
+          ? error.message
+          : "Billing is temporarily unavailable",
+    },
+    {
+      status: error instanceof BillingError ? error.status : 503,
+      headers: { "cache-control": "no-store" },
+    },
+  );
+}
+/**
+ * What an account pays per million tokens for each hosted model it can be
+ * charged for, the conversation-summary model included. These are ceilings: a call is charged for the model that answered it, never
+ * above the rate listed for the one it asked for. A pre-rename `@flock/` id is
+ * the same model under its old name, so it is listed once.
+ */
+export function customerModelRatesV1(table: HostedModelRatesV1 | undefined) {
+  const routes = table?.routes ?? {};
+  return Object.fromEntries(
+    Object.entries(routes)
+      .filter(
+        ([model]) =>
+          normalizeFrockModelIdV1(model) === model ||
+          !Object.hasOwn(routes, normalizeFrockModelIdV1(model)),
+      )
+      .map(([model, rate]) => [
+        model,
+        {
+          inputUsdPerMillion: rate.inputMicrosPerToken * 2,
+          cachedInputUsdPerMillion: rate.cachedInputMicrosPerToken * 2,
+          outputUsdPerMillion: rate.outputMicrosPerToken * 2,
+        },
+      ]),
+  );
+}
+
+export function billingRoutes(
+  env: BillingEnv,
+  account: (userId: string) => BillingAccountRpc,
+  modelRates: () => Promise<HostedModelRatesV1>,
+): BackendRouteContribution {
+  return {
+    packageId: "billing",
+    async publicRoute(request, url) {
+      if (
+        request.method === "GET" &&
+        ["/billing", "/billing.js", "/billing.css"].includes(url.pathname)
+      ) {
+        const type = url.pathname.endsWith(".js")
+          ? "text/javascript"
+          : url.pathname.endsWith(".css")
+            ? "text/css"
+            : "text/html";
+        return new Response(
+          url.pathname.endsWith(".js")
+            ? billingScript
+            : url.pathname.endsWith(".css")
+              ? billingStyles
+              : billingPageV1(BRAND_V1.productName),
+          {
+            headers: {
+              "content-type": `${type}; charset=utf-8`,
+              "cache-control": "no-store",
+              "x-content-type-options": "nosniff",
+              "content-security-policy":
+                "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'",
+            },
+          },
+        );
+      }
+      if (url.pathname !== "/api/billing/stripe/webhook") return;
+      if (request.method !== "POST") return new Response(null, { status: 405 });
+      try {
+        const config = stripeConfig(env);
+        const event = await verifyStripeEvent(
+          await boundedText(request),
+          request.headers.get("stripe-signature"),
+          config.webhookSecret,
+        );
+        const supported = new Set([
+          "invoice.paid",
+          "invoice.payment_failed",
+          "customer.subscription.created",
+          "customer.subscription.updated",
+          "customer.subscription.deleted",
+          "checkout.session.completed",
+          "checkout.session.async_payment_succeeded",
+          "charge.refunded",
+          "charge.dispute.created",
+        ]);
+        if (!supported.has(String(event.type)))
+          return Response.json({ received: true });
+        const stripe = new StripeClient(config);
+        const data = object(object(event.data).object);
+        // Dispute payloads identify the charge rather than its customer.
+        if (!data.customer && event.type === "charge.dispute.created") {
+          const charge = await stripe.call(`charges/${stripeId(data.charge)}`);
+          data.customer = charge.customer;
+        }
+        const customer = await stripe.call(
+          `customers/${stripeId(data.customer)}`,
+        );
+        // Deleting an account deletes its customer, and Stripe then reports
+        // the subscription that took with it. There is nobody left to tell,
+        // and refusing would only have Stripe retry for days.
+        if (customer.deleted === true) return Response.json({ received: true });
+        const userId = object(customer.metadata).frockbot_user_id;
+        if (
+          typeof userId !== "string" ||
+          !/^[a-zA-Z0-9_-]{1,128}$/.test(userId)
+        )
+          throw new BillingError("Unknown payment account", 400);
+        await account(userId).billingWebhook({ userId, event });
+        return Response.json({ received: true });
+      } catch (error) {
+        // An event that raced the account's deletion has nothing to apply to.
+        if (error instanceof Error && error.name === "AccountDeletedError")
+          return Response.json({ received: true });
+        return failure(error);
+      }
+    },
+    async route(request, url, context) {
+      if (
+        !url.pathname.startsWith("/api/billing") &&
+        !["/billing", "/billing.js", "/billing.css"].includes(url.pathname)
+      )
+        return;
+      if (!context.userId || context.userId === "anonymous")
+        return Response.json(
+          { error: "Sign in to manage billing" },
+          { status: 401 },
+        );
+      const headers = {
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+        "content-security-policy":
+          "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'",
+        "referrer-policy": "no-referrer",
+      };
+      if (request.method === "GET") {
+        if (url.pathname === "/billing")
+          return new Response(billingPageV1(BRAND_V1.productName), {
+            headers: { ...headers, "content-type": "text/html; charset=utf-8" },
+          });
+        if (url.pathname === "/billing.js")
+          return new Response(billingScript, {
+            headers: {
+              ...headers,
+              "content-type": "text/javascript; charset=utf-8",
+            },
+          });
+        if (url.pathname === "/billing.css")
+          return new Response(billingStyles, {
+            headers: { ...headers, "content-type": "text/css; charset=utf-8" },
+          });
+      }
+      try {
+        const userId = context.userId;
+        if (request.method === "GET" && url.pathname === "/api/billing") {
+          const before = url.searchParams.has("before")
+            ? Number(url.searchParams.get("before"))
+            : undefined;
+          if (
+            before !== undefined &&
+            (!Number.isSafeInteger(before) || before < 0)
+          )
+            throw new BillingError("Invalid usage cursor", 400);
+          return Response.json(
+            {
+              ...(await account(userId).readBilling({
+                userId,
+                ...(before === undefined ? {} : { before }),
+              })),
+              // A table that cannot be read just now lists no rates; the
+              // balance and history are still the account's to see.
+              modelRates: customerModelRatesV1(
+                await modelRates().catch(() => undefined),
+              ),
+              computerRate: {
+                activeUsdPerHour: COMPUTER_TARIFF.activeUsdPerHour,
+                storageIncludedGb: COMPUTER_TARIFF.storageIncludedGb,
+                viewerOpenSeconds: COMPUTER_TARIFF.viewerOpenSeconds,
+                viewerRenewSeconds: COMPUTER_TARIFF.viewerRenewSeconds,
+              },
+              launchBlockers: BILLING_LAUNCH_BLOCKERS,
+              // Whether this deployment meters at all. Off, and credit is
+              // meaningless: nothing is charged and nothing is refused.
+              metered: hostedBillingEnabledV1(env),
+              paymentsAvailable:
+                BILLING_LAUNCH_BLOCKERS.length === 0 &&
+                !!(
+                  env.STRIPE_SECRET_KEY &&
+                  env.STRIPE_WEBHOOK_SECRET &&
+                  env.STRIPE_MONTHLY_PRICE_ID
+                ),
+            },
+            { headers },
+          );
+        }
+        if (
+          request.method === "GET" &&
+          url.pathname === "/api/billing/spending"
+        )
+          return Response.json(
+            await account(userId).readSpending({
+              userId,
+              ...decodeSpendingQueryV1(url),
+            }),
+            { headers },
+          );
+        if (request.method !== "POST")
+          return new Response(null, { status: 405 });
+        const origin = request.headers.get("origin");
+        if (
+          origin &&
+          origin !== new URL(env.BETTER_AUTH_URL ?? request.url).origin
+        )
+          throw new BillingError("Invalid request origin", 403);
+        if (
+          !request.headers.get("content-type")?.startsWith("application/json")
+        )
+          throw new BillingError("Expected JSON", 415);
+        const body = object(JSON.parse(await boundedText(request, 4096)));
+        if (url.pathname === "/api/billing/reconcile") {
+          if (!context.isAdmin)
+            throw new BillingError("Administrator access required", 403);
+          if (
+            typeof body.userId !== "string" ||
+            !/^[a-zA-Z0-9_-]{1,128}$/.test(body.userId)
+          )
+            throw new BillingError("Invalid account", 400);
+          const command = object(body.command);
+          if (
+            typeof command.id !== "string" ||
+            typeof command.reason !== "string"
+          )
+            throw new BillingError("Invalid reconciliation", 400);
+          await account(body.userId).reconcileBilling({
+            userId: body.userId,
+            command: {
+              ...command,
+              actorId: context.userId,
+            } as unknown as Parameters<BillingLedger["reconcile"]>[0],
+          });
+          return Response.json({ ok: true }, { headers });
+        }
+        if (url.pathname === "/api/billing/limits") {
+          if (
+            typeof body.scope !== "string" ||
+            (body.dailyMicros !== null && typeof body.dailyMicros !== "number")
+          )
+            throw new BillingError("Invalid daily limit", 400);
+          await account(userId).setSpendingLimit({
+            userId,
+            scope: body.scope,
+            dailyMicros: body.dailyMicros as number | null,
+          });
+          return Response.json({ ok: true }, { headers });
+        }
+        if (url.pathname === "/api/billing/checkout") {
+          if (BILLING_LAUNCH_BLOCKERS.length)
+            throw new BillingError(
+              "Payments are not open yet. Launch qualification is still in progress.",
+              503,
+            );
+          if (
+            typeof body.id !== "string" ||
+            !["subscription", "topup"].includes(String(body.kind)) ||
+            (body.cents !== undefined && typeof body.cents !== "number")
+          )
+            throw new BillingError("Invalid checkout", 400);
+          return Response.json(
+            await account(userId).billingCheckout({
+              userId,
+              command: {
+                id: body.id,
+                kind: body.kind as "subscription" | "topup",
+                ...(body.cents === undefined
+                  ? {}
+                  : { cents: body.cents as number }),
+              },
+            }),
+            { headers },
+          );
+        }
+        if (
+          url.pathname === "/api/billing/portal" &&
+          typeof body.id === "string"
+        )
+          return Response.json(
+            await account(userId).billingPortal({ userId, commandId: body.id }),
+            { headers },
+          );
+        return new Response(null, { status: 404 });
+      } catch (error) {
+        return failure(error);
+      }
+    },
+  };
+}