@goscribe/server 1.3.3 → 1.5.0

package/src/services/billing/payment.service.ts

@@ -0,0 +1,436 @@
+import type { PrismaClient } from '@prisma/client';
+import type { ArtifactType } from '@prisma/client';
+import { TRPCError } from '@trpc/server';
+import { Stripe } from 'stripe';
+import { BaseService } from '../base.service.js';
+import { stripe } from '../../lib/stripe.js';
+import { env } from '../../lib/env.js';
+import { getUserUsage, getUserPlanLimits } from './usage.service.js';
+import {
+  notifyPaymentSucceeded,
+  notifySubscriptionActivated,
+  notifySubscriptionPaymentSucceeded,
+} from '../notifications/notification.service.js';
+import { upsertSubscriptionFromStripe } from './subscription.service.js';
+
+/** Stripe Checkout URLs contain the session id (cs_…); we only store the URL in DB. */
+const CHECKOUT_SESSION_ID_IN_URL = /cs_[a-zA-Z0-9]+/;
+
+async function reuseCheckoutUrlIfSessionStillOpen(
+  stripeClient: Stripe,
+  db: PrismaClient,
+  existing: { id: string; stripeSessionId: string | null },
+  lockKey: string,
+): Promise<string | null> {
+  const url = existing.stripeSessionId;
+  if (!url) return null;
+
+  const idMatch = url.match(CHECKOUT_SESSION_ID_IN_URL);
+  if (!idMatch) {
+    await db.idempotencyRecord.updateMany({
+      where: { id: existing.id, activeLockKey: lockKey },
+      data: { activeLockKey: null, status: 'expired' },
+    });
+    return null;
+  }
+
+  try {
+    const session = await stripeClient.checkout.sessions.retrieve(idMatch[0]);
+    if (session.status === 'open') {
+      return url;
+    }
+    await db.idempotencyRecord.updateMany({
+      where: { id: existing.id, activeLockKey: lockKey },
+      data: {
+        activeLockKey: null,
+        status: session.status === 'complete' ? 'completed' : 'expired',
+      },
+    });
+    return null;
+  } catch {
+    await db.idempotencyRecord.updateMany({
+      where: { id: existing.id, activeLockKey: lockKey },
+      data: { activeLockKey: null, status: 'expired' },
+    });
+    return null;
+  }
+}
+
+export class PaymentService extends BaseService {
+  constructor(db: PrismaClient) {
+    super(db);
+  }
+
+  async getPlans(userId?: string) {
+    const plans = await this.db.plan.findMany({
+      where: { active: true },
+      include: { limit: true },
+      orderBy: { price: 'asc' },
+    });
+
+    // Anonymous callers (pricing page) don't get per-user `isActive`.
+    if (!userId) {
+      return plans.map((plan: any) => ({ ...plan, isActive: false }));
+    }
+
+    const activeSubscriptions = await this.db.subscription.findMany({
+      where: { userId, status: 'active' },
+    });
+
+    return plans.map((plan: any) => ({
+      ...plan,
+      isActive: activeSubscriptions.some((sub: any) => sub.planId === plan.id),
+    }));
+  }
+
+  async createCheckoutSession(userId: string, input: { planId: string }) {
+    if (!stripe) {
+      throw new TRPCError({
+        code: 'INTERNAL_SERVER_ERROR',
+        message: 'Stripe not configured',
+      });
+    }
+
+    const user = await this.db.user.findUnique({ where: { id: userId } });
+    if (!user) throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+
+    const lockKey = `pending_${userId}_${input.planId}`;
+    let attempt = null;
+    let retryCount = 0;
+
+    while (retryCount < 3) {
+      try {
+        attempt = await this.db.idempotencyRecord.create({
+          data: {
+            userId,
+            planId: input.planId,
+            activeLockKey: lockKey,
+            status: 'pending',
+          },
+        });
+        break;
+      } catch (err: any) {
+        if (err.code === 'P2002') {
+          const existing = await this.db.idempotencyRecord.findUnique({
+            where: { activeLockKey: lockKey },
+          });
+          if (!existing) {
+            retryCount++;
+            continue;
+          }
+
+          const isStale = Date.now() - existing.updatedAt.getTime() > 24 * 60 * 60 * 1000;
+          if (isStale) {
+            const result = await this.db.idempotencyRecord.updateMany({
+              where: { id: existing.id, activeLockKey: lockKey },
+              data: { activeLockKey: null, status: 'expired' },
+            });
+            if (result.count > 0) {
+              retryCount++;
+              continue;
+            }
+          }
+
+          if (existing.stripeSessionId && stripe) {
+            const reusable = await reuseCheckoutUrlIfSessionStillOpen(
+              stripe,
+              this.db,
+              existing,
+              lockKey,
+            );
+            if (reusable) return { url: reusable };
+            retryCount++;
+            continue;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 800));
+          retryCount++;
+          continue;
+        }
+        throw err;
+      }
+    }
+
+    if (!attempt) {
+      throw new TRPCError({ code: 'CONFLICT', message: 'Concurrent request' });
+    }
+
+    const plan = await this.db.plan.findUnique({ where: { id: input.planId } });
+    if (!plan) throw new TRPCError({ code: 'NOT_FOUND', message: 'Plan not found' });
+
+    try {
+      const successUrl = env.STRIPE_SUCCESS_URL.includes('session_id=')
+        ? env.STRIPE_SUCCESS_URL
+        : `${env.STRIPE_SUCCESS_URL}${env.STRIPE_SUCCESS_URL.includes('?') ? '&' : '?'}session_id={CHECKOUT_SESSION_ID}`;
+
+      const session = await stripe.checkout.sessions.create(
+        {
+          customer: user.stripe_customer_id || undefined,
+          customer_email: user.stripe_customer_id ? undefined : user.email || undefined,
+          line_items: [{ price: plan.stripePriceId, quantity: 1 }],
+          mode: plan.interval ? 'subscription' : 'payment',
+          subscription_data: plan.interval
+            ? {
+                metadata: {
+                  userId,
+                  planId: plan.id,
+                  attemptId: attempt.id,
+                },
+              }
+            : undefined,
+          success_url: successUrl,
+          cancel_url: env.STRIPE_CANCEL_URL,
+          metadata: {
+            userId,
+            planId: plan.id,
+            attemptId: attempt.id,
+          },
+        },
+        {
+          idempotencyKey: attempt.id,
+        },
+      );
+
+      await this.db.idempotencyRecord.update({
+        where: { id: attempt.id },
+        data: { stripeSessionId: session.url },
+      });
+
+      return { url: session.url };
+    } catch (error: any) {
+      await this.db.idempotencyRecord.update({
+        where: { id: attempt.id },
+        data: { status: 'failed', activeLockKey: null },
+      });
+      throw new TRPCError({
+        code: 'INTERNAL_SERVER_ERROR',
+        message: error.message,
+      });
+    }
+  }
+
+  async confirmCheckoutSuccess(userId: string, input: { sessionId: string }) {
+    if (!stripe) {
+      throw new TRPCError({
+        code: 'INTERNAL_SERVER_ERROR',
+        message: 'Stripe not configured',
+      });
+    }
+
+    const session = await stripe.checkout.sessions.retrieve(input.sessionId, {
+      expand: ['line_items', 'subscription'],
+    });
+
+    const metadata = session.metadata || {};
+    if (metadata.userId !== userId) {
+      throw new TRPCError({
+        code: 'FORBIDDEN',
+        message: 'This checkout session does not belong to the current user',
+      });
+    }
+
+    if (session.status !== 'complete') {
+      return { confirmed: false, reason: 'checkout_not_complete' };
+    }
+
+    const plan = metadata.planId
+      ? await this.db.plan.findUnique({ where: { id: metadata.planId } })
+      : null;
+
+    if (session.mode === 'payment' && session.payment_status === 'paid') {
+      await notifyPaymentSucceeded(this.db, {
+        userId,
+        planId: metadata.planId,
+        planName: plan?.name || metadata.planType,
+        stripeSessionId: session.id,
+        amountPaid: session.amount_total ?? undefined,
+      });
+      return { confirmed: true, kind: 'payment' as const };
+    }
+
+    if (session.mode === 'subscription') {
+      const stripeSubscriptionId =
+        typeof session.subscription === 'string'
+          ? session.subscription
+          : session.subscription?.id;
+
+      if (stripeSubscriptionId) {
+        await upsertSubscriptionFromStripe(stripeSubscriptionId);
+        await notifySubscriptionActivated(this.db, {
+          userId,
+          planId: metadata.planId,
+          planName: plan?.name || metadata.planType,
+          stripeSubscriptionId,
+        });
+
+        if (session.payment_status === 'paid') {
+          await notifySubscriptionPaymentSucceeded(this.db, {
+            userId,
+            planId: metadata.planId,
+            planName: plan?.name || metadata.planType,
+            stripeInvoiceId: `checkout_${session.id}`,
+            amountPaid: session.amount_total ?? undefined,
+          });
+        }
+      }
+      return { confirmed: true, kind: 'subscription' as const };
+    }
+
+    return { confirmed: false, reason: 'unsupported_mode' };
+  }
+
+  async createResourcePurchaseSession(
+    userId: string,
+    input: { resourceType: ArtifactType; quantity: number },
+  ) {
+    if (!stripe) {
+      throw new TRPCError({
+        code: 'INTERNAL_SERVER_ERROR',
+        message: 'Stripe is not configured on the server',
+      });
+    }
+
+    const user = await this.db.user.findUnique({ where: { id: userId } });
+    if (!user) {
+      throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+    }
+
+    const resourcePrice = await this.db.resourcePrice.findUnique({
+      where: { resourceType: input.resourceType },
+    });
+
+    if (!resourcePrice) {
+      throw new TRPCError({
+        code: 'PRECONDITION_FAILED',
+        message: 'Price not set',
+      });
+    }
+
+    const lockKey = `topup_${userId}_${input.resourceType}`;
+    let attempt = null;
+    let retryCount = 0;
+
+    while (retryCount < 3) {
+      try {
+        attempt = await this.db.idempotencyRecord.create({
+          data: {
+            userId,
+            resourceType: input.resourceType,
+            activeLockKey: lockKey,
+            status: 'pending',
+          },
+        });
+        break;
+      } catch (err: any) {
+        if (err.code === 'P2002') {
+          const existing = await this.db.idempotencyRecord.findUnique({
+            where: { activeLockKey: lockKey },
+          });
+          if (!existing) {
+            retryCount++;
+            continue;
+          }
+
+          const isStale = Date.now() - existing.updatedAt.getTime() > 24 * 60 * 60 * 1000;
+          if (isStale) {
+            const result = await this.db.idempotencyRecord.updateMany({
+              where: { id: existing.id, activeLockKey: lockKey },
+              data: { activeLockKey: null, status: 'expired' },
+            });
+            if (result.count > 0) {
+              retryCount++;
+              continue;
+            }
+          }
+
+          if (existing.stripeSessionId && stripe) {
+            const reusable = await reuseCheckoutUrlIfSessionStillOpen(
+              stripe,
+              this.db,
+              existing,
+              lockKey,
+            );
+            if (reusable) return { url: reusable };
+            retryCount++;
+            continue;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 800));
+          retryCount++;
+          continue;
+        }
+        throw err;
+      }
+    }
+
+    if (!attempt) {
+      throw new TRPCError({ code: 'CONFLICT', message: 'Concurrent request' });
+    }
+
+    try {
+      const resourceName = input.resourceType
+        .split('_')
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase())
+        .join(' ');
+
+      const session = await stripe.checkout.sessions.create(
+        {
+          customer: user.stripe_customer_id || undefined,
+          line_items: [
+            {
+              price_data: {
+                currency: 'usd',
+                product_data: {
+                  name: `Add-on: extra ${resourceName}s`,
+                  description: `Purchase of ${input.quantity} additional ${resourceName}(s)`,
+                },
+                unit_amount: resourcePrice.priceCents,
+              },
+              quantity: input.quantity,
+            },
+          ],
+          mode: 'payment',
+          success_url: `${env.STRIPE_SUCCESS_URL}?success=true`,
+          cancel_url: env.STRIPE_CANCEL_URL,
+          metadata: {
+            userId,
+            resourceType: input.resourceType,
+            quantity: input.quantity.toString(),
+            isPurchase: 'true',
+            attemptId: attempt.id,
+          },
+          invoice_creation: { enabled: true },
+        },
+        {
+          idempotencyKey: attempt.id,
+        },
+      );
+
+      await this.db.idempotencyRecord.update({
+        where: { id: attempt.id },
+        data: { stripeSessionId: session.url },
+      });
+
+      return { url: session.url };
+    } catch (error: any) {
+      await this.db.idempotencyRecord.update({
+        where: { id: attempt.id },
+        data: { status: 'failed', activeLockKey: null },
+      });
+      throw new TRPCError({
+        code: 'INTERNAL_SERVER_ERROR',
+        message: error.message,
+      });
+    }
+  }
+
+  async getUsageOverview(userId: string) {
+    const [usage, limits] = await Promise.all([
+      getUserUsage(userId),
+      getUserPlanLimits(userId),
+    ]);
+    return { usage, limits, hasActivePlan: !!limits };
+  }
+
+  getResourcePrices() {
+    return this.db.resourcePrice.findMany();
+  }
+}

package/src/{lib/subscription_service.ts → services/billing/subscription.service.ts}

@@ -1,6 +1,6 @@
-import { prisma } from './prisma.js';
-import { logger } from './logger.js';
-import { stripe } from './stripe.js';
+import { prisma } from '../../lib/prisma.js';
+import { logger } from '../../lib/logger.js';
+import { stripe } from '../../lib/stripe.js';
 import Stripe from 'stripe';
 import {
     notifyPaymentFailed,
@@ -8,9 +8,9 @@ import {
     notifySubscriptionActivated,
     notifySubscriptionCanceled,
     notifySubscriptionPaymentSucceeded,
-} from './notification-service.js';
+} from '../notifications/notification.service.js';
 import { ArtifactType } from '@prisma/client';
-import PusherService from './pusher.js';
+import PusherService from '../../lib/pusher.js';
 
 /**
  * Handle checkout.session.completed event

package/src/{lib/usage_service.ts → services/billing/usage.service.ts}

@@ -1,4 +1,4 @@
-import { prisma } from './prisma.js';
+import { prisma } from '../../lib/prisma.js';
 
 export interface UserUsage {
     flashcards: number;
@@ -8,6 +8,16 @@ export interface UserUsage {
     storageBytes: number;
 }
 
+const FALLBACK_PLAN_LIMITS = {
+    id: 'fallback-free',
+    planId: 'fallback-free',
+    maxStorageBytes: BigInt(1024 * 1024 * 1024), // 1GB
+    maxWorksheets: 3,
+    maxFlashcards: 20,
+    maxPodcasts: 0,
+    maxStudyGuides: 1,
+} as const;
+
 /**
  * Counts all resources consumed by a user across the platform.
  */
@@ -37,12 +47,21 @@ export async function getUserUsage(userId: string): Promise<UserUsage> {
  * PLUS any extra credits purchased.
  */
 export async function getUserPlanLimits(userId: string) {
-    const [activeSub, userCredits] = await Promise.all([
+    const [activeSub, freePlan, userCredits] = await Promise.all([
         prisma.subscription.findFirst({
             where: { userId, status: 'active' },
             include: { plan: { include: { limit: true } } },
             orderBy: { createdAt: 'desc' }
         }),
+        prisma.plan.findFirst({
+            where: {
+                active: true,
+                price: 0,
+                limit: { isNot: null }
+            },
+            include: { limit: true },
+            orderBy: { createdAt: 'asc' }
+        }),
         prisma.userCredit.groupBy({
             by: ['resourceType'],
             where: { userId },
@@ -50,10 +69,10 @@ export async function getUserPlanLimits(userId: string) {
         })
     ]);
 
-    const baseLimit = activeSub?.plan?.limit;
+    const baseLimit = activeSub?.plan?.limit ?? freePlan?.limit;
 
-    // If no active subscription and no credits, user has no active limits
-    if (!baseLimit && userCredits.length === 0) return null;
+    // Prefer subscription limits, then DB free-plan limits, then hardcoded safety fallback.
+    const base = baseLimit ?? FALLBACK_PLAN_LIMITS;
 
     // Fast lookup for credits
     const getCreditSum = (type: string) =>
@@ -61,14 +80,15 @@ export async function getUserPlanLimits(userId: string) {
 
     // Return the merged total limit
     return {
-        id: baseLimit?.id || 'credits-only',
-        planId: baseLimit?.planId || 'credits-only',
-        maxStorageBytes: BigInt(Number(baseLimit?.maxStorageBytes || 0) + (getCreditSum('STORAGE') * 1024 * 1024)),
-        maxWorksheets: (baseLimit?.maxWorksheets || 0) + getCreditSum('WORKSHEET'),
-        maxFlashcards: (baseLimit?.maxFlashcards || 0) + getCreditSum('FLASHCARD_SET'),
-        maxPodcasts: (baseLimit?.maxPodcasts || 0) + getCreditSum('PODCAST_EPISODE'),
-        maxStudyGuides: (baseLimit?.maxStudyGuides || 0) + getCreditSum('STUDY_GUIDE'),
+        id: base.id,
+        planId: base.planId,
+        maxStorageBytes: BigInt(Number(base.maxStorageBytes) + (getCreditSum('STORAGE') * 1024 * 1024)),
+        maxWorksheets: base.maxWorksheets + getCreditSum('WORKSHEET'),
+        maxFlashcards: base.maxFlashcards + getCreditSum('FLASHCARD_SET'),
+        maxPodcasts: base.maxPodcasts + getCreditSum('PODCAST_EPISODE'),
+        maxStudyGuides: base.maxStudyGuides + getCreditSum('STUDY_GUIDE'),
         createdAt: baseLimit?.createdAt || new Date(),
         updatedAt: baseLimit?.updatedAt || new Date(),
+        isFallbackPlan: !baseLimit,
     };
 }