@goscribe/server 1.3.3 → 1.5.0

package/dist/services/auth.service.js

@@ -0,0 +1,368 @@
+import { TRPCError } from '@trpc/server';
+import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
+import { BaseService } from './base.service.js';
+import { supabaseClient } from '../lib/storage.js';
+import { sendVerificationEmail, sendAccountDeletionScheduledEmail, sendAccountRestoredEmail, sendPasswordResetEmail, } from '../lib/email.js';
+import { createStripeCustomer } from '../lib/stripe.js';
+import { notifyAdminsAccountDeletionScheduled, notifyAdminsOnSignup, } from './notification.service.js';
+export function hashPasswordResetToken(rawToken) {
+    return crypto.createHash('sha256').update(rawToken, 'utf8').digest('hex');
+}
+export function createCustomAuthToken(userId) {
+    const secret = process.env.AUTH_SECRET;
+    if (!secret) {
+        throw new TRPCError({ code: 'INTERNAL_SERVER_ERROR', message: 'AUTH_SECRET is not set' });
+    }
+    const base64UserId = Buffer.from(userId, 'utf8').toString('base64url');
+    const hmac = crypto.createHmac('sha256', secret);
+    hmac.update(base64UserId);
+    const signature = hmac.digest('hex');
+    return `${base64UserId}.${signature}`;
+}
+function passwordResetDb(db) {
+    return db.passwordResetToken;
+}
+export class AuthService extends BaseService {
+    constructor(db) {
+        super(db);
+    }
+    async updateProfile(userId, input) {
+        await this.db.user.update({
+            where: { id: userId },
+            data: { name: input.name },
+        });
+        return { success: true, message: 'Profile updated successfully' };
+    }
+    async changePassword(userId, input) {
+        const user = await this.db.user.findUnique({
+            where: { id: userId },
+            select: { id: true, passwordHash: true },
+        });
+        if (!user) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        if (!user.passwordHash) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'Password change is unavailable for this account.',
+            });
+        }
+        const validCurrentPassword = await bcrypt.compare(input.currentPassword, user.passwordHash);
+        if (!validCurrentPassword) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Current password is incorrect' });
+        }
+        const isSamePassword = await bcrypt.compare(input.newPassword, user.passwordHash);
+        if (isSamePassword) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'New password must be different from current password',
+            });
+        }
+        const newHash = await bcrypt.hash(input.newPassword, 10);
+        await this.db.user.update({
+            where: { id: user.id },
+            data: { passwordHash: newHash },
+        });
+        return { success: true, message: 'Password changed successfully' };
+    }
+    async uploadProfilePicture(userId) {
+        this.logger.info(`Generating upload URL for user ${userId}`, 'AUTH');
+        const objectKey = `profile_picture_${userId}`;
+        const { data: signedUrlData, error: signedUrlError } = await supabaseClient.storage
+            .from('media')
+            .createSignedUploadUrl(objectKey, { upsert: true });
+        if (signedUrlError) {
+            this.logger.error(`Failed to generate upload URL: ${signedUrlError.message}`, 'AUTH');
+            throw new TRPCError({
+                code: 'INTERNAL_SERVER_ERROR',
+                message: `Failed to generate upload URL: ${signedUrlError.message}`,
+            });
+        }
+        const fileAsset = await this.db.fileAsset.create({
+            data: {
+                userId,
+                name: 'Profile Picture',
+                mimeType: 'image/jpeg',
+                size: 0,
+                bucket: 'media',
+                objectKey,
+            },
+        });
+        await this.db.user.update({
+            where: { id: userId },
+            data: { fileAssetId: fileAsset.id },
+        });
+        this.logger.info(`Profile picture asset created and linked for user ${userId}`, 'AUTH');
+        return {
+            success: true,
+            message: 'Profile picture uploaded successfully',
+            signedUrl: signedUrlData.signedUrl,
+        };
+    }
+    /**
+     * Signup creates a user + sends verification email + kicks off Stripe customer
+     * creation. The caller (router) does NOT need to set any cookies here.
+     */
+    async signup(input) {
+        const existing = await this.db.user.findUnique({
+            where: { email: input.email },
+        });
+        if (existing) {
+            throw new TRPCError({ code: 'CONFLICT', message: 'Email already registered' });
+        }
+        const hash = await bcrypt.hash(input.password, 10);
+        const userRole = await this.db.role.findUnique({
+            where: { name: 'User' },
+        });
+        const user = await this.db.user.create({
+            data: {
+                name: input.name,
+                email: input.email,
+                passwordHash: hash,
+                roleId: userRole?.id,
+            },
+        });
+        await notifyAdminsOnSignup(this.db, {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+        });
+        const token = crypto.randomUUID();
+        await this.db.verificationToken.create({
+            data: {
+                identifier: input.email,
+                token,
+                expires: new Date(Date.now() + 24 * 60 * 60 * 1000),
+            },
+        });
+        sendVerificationEmail(input.email, token, input.name).catch(() => { });
+        createStripeCustomer(input.email, input.name).then(async (stripeCustomerId) => {
+            if (stripeCustomerId) {
+                await this.db.user
+                    .update({
+                    where: { id: user.id },
+                    data: { stripe_customer_id: stripeCustomerId },
+                })
+                    .catch((err) => this.logger.error(`Failed to update user with stripe_customer_id: ${err.message}`, 'AUTH'));
+            }
+        });
+        return { id: user.id, email: user.email, name: user.name };
+    }
+    async verifyEmail(token) {
+        const record = await this.db.verificationToken.findUnique({
+            where: { token },
+        });
+        if (!record) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Invalid or expired verification link',
+            });
+        }
+        if (record.expires < new Date()) {
+            await this.db.verificationToken.deleteMany({ where: { token } });
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'Verification link has expired. Please request a new one.',
+            });
+        }
+        await this.db.user.update({
+            where: { email: record.identifier },
+            data: { emailVerified: new Date() },
+        });
+        await this.db.verificationToken.deleteMany({ where: { token } });
+        return { success: true, message: 'Email verified successfully' };
+    }
+    async resendVerification(sessionUserId) {
+        if (!sessionUserId) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Not logged in' });
+        }
+        const user = await this.db.user.findUnique({ where: { id: sessionUserId } });
+        if (!user || !user.email) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        if (user.emailVerified) {
+            return { success: true, message: 'Email is already verified' };
+        }
+        await this.db.verificationToken.deleteMany({
+            where: { identifier: user.email },
+        });
+        const token = crypto.randomUUID();
+        await this.db.verificationToken.create({
+            data: {
+                identifier: user.email,
+                token,
+                expires: new Date(Date.now() + 24 * 60 * 60 * 1000),
+            },
+        });
+        const sent = await sendVerificationEmail(user.email, token, user.name);
+        if (!sent) {
+            throw new TRPCError({
+                code: 'INTERNAL_SERVER_ERROR',
+                message: 'Failed to send email. Please try again.',
+            });
+        }
+        return { success: true, message: 'Verification email sent' };
+    }
+    /**
+     * Verifies credentials and returns the user + an auth token. The router
+     * is responsible for setting the cookie (Express `res` is not available
+     * here — we keep services HTTP-free).
+     */
+    async login(input) {
+        const user = await this.db.user.findUnique({ where: { email: input.email } });
+        if (!user) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Invalid credentials' });
+        }
+        if (user.deletedAt) {
+            throw new TRPCError({
+                code: 'UNAUTHORIZED',
+                message: 'Account scheduled for deletion. Please check your email for a restore link.',
+            });
+        }
+        const valid = await bcrypt.compare(input.password, user.passwordHash);
+        if (!valid) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Invalid credentials' });
+        }
+        const authToken = createCustomAuthToken(user.id);
+        return {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            token: authToken,
+        };
+    }
+    async requestPasswordReset(input) {
+        const email = input.email.trim().toLowerCase();
+        const generic = {
+            success: true,
+            message: 'If an account exists for this email, we sent password reset instructions.',
+        };
+        const user = await this.db.user.findUnique({
+            where: { email },
+            select: {
+                id: true,
+                email: true,
+                name: true,
+                passwordHash: true,
+                deletedAt: true,
+            },
+        });
+        if (!user?.passwordHash || user.deletedAt || !user.email) {
+            return generic;
+        }
+        await passwordResetDb(this.db).deleteMany({
+            where: { userId: user.id, usedAt: null },
+        });
+        const rawToken = crypto.randomBytes(32).toString('hex');
+        const tokenHash = hashPasswordResetToken(rawToken);
+        const expiresAt = new Date(Date.now() + 60 * 60 * 1000);
+        await passwordResetDb(this.db).create({
+            data: { userId: user.id, tokenHash, expiresAt },
+        });
+        sendPasswordResetEmail(user.email, rawToken, user.name).catch(() => { });
+        return generic;
+    }
+    async resetPassword(input) {
+        const tokenHash = hashPasswordResetToken(input.token);
+        const record = await passwordResetDb(this.db).findUnique({
+            where: { tokenHash },
+        });
+        if (!record || record.usedAt || record.expiresAt < new Date()) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'Invalid or expired reset link. Please request a new one.',
+            });
+        }
+        const newHash = await bcrypt.hash(input.newPassword, 10);
+        await this.db.user.update({
+            where: { id: record.userId },
+            data: { passwordHash: newHash },
+        });
+        await passwordResetDb(this.db).update({
+            where: { id: record.id },
+            data: { usedAt: new Date() },
+        });
+        await passwordResetDb(this.db).deleteMany({
+            where: { userId: record.userId, id: { not: record.id } },
+        });
+        return { success: true, message: 'Password updated. You can sign in now.' };
+    }
+    async getSession(sessionUserId) {
+        if (!sessionUserId) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'No session found' });
+        }
+        const user = await this.db.user.findUnique({
+            where: { id: sessionUserId },
+            include: { profilePicture: true, role: true },
+        });
+        if (!user) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        const profilePictureUrl = user.profilePicture?.objectKey
+            ? `/profile-picture/${user.profilePicture.objectKey}?t=${new Date(user.updatedAt).getTime()}`
+            : null;
+        this.logger.info(`Session fetched for user ${sessionUserId}, profilePicture: ${profilePictureUrl}`, 'AUTH');
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                name: user.name,
+                emailVerified: !!user.emailVerified,
+                profilePicture: profilePictureUrl,
+                role: user.role,
+            },
+        };
+    }
+    async requestAccountDeletion(userId) {
+        const user = await this.db.user.findUnique({ where: { id: userId } });
+        if (!user) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        await this.db.user.update({
+            where: { id: user.id },
+            data: { deletedAt: new Date() },
+        });
+        await notifyAdminsAccountDeletionScheduled(this.db, {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+        }).catch(() => { });
+        await this.db.verificationToken.deleteMany({
+            where: { identifier: `restore-${user.email}` },
+        });
+        const token = crypto.randomUUID();
+        await this.db.verificationToken.create({
+            data: {
+                identifier: `restore-${user.email}`,
+                token,
+                expires: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+            },
+        });
+        if (user.email) {
+            sendAccountDeletionScheduledEmail(user.email, token).catch(() => { });
+        }
+        return { success: true, message: 'Account scheduled for deletion' };
+    }
+    async restoreAccount(token) {
+        const record = await this.db.verificationToken.findUnique({ where: { token } });
+        if (!record || !record.identifier.startsWith('restore-')) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Invalid or expired restore link',
+            });
+        }
+        if (record.expires < new Date()) {
+            await this.db.verificationToken.deleteMany({ where: { token } });
+            throw new TRPCError({ code: 'BAD_REQUEST', message: 'Restore link has expired.' });
+        }
+        const email = record.identifier.replace('restore-', '');
+        await this.db.user.update({
+            where: { email },
+            data: { deletedAt: null },
+        });
+        await this.db.verificationToken.deleteMany({ where: { token } });
+        sendAccountRestoredEmail(email).catch(() => { });
+        return { success: true, message: 'Account restored successfully' };
+    }
+}

package/dist/services/base.service.d.ts

@@ -0,0 +1,14 @@
+import type { PrismaClient } from '@prisma/client';
+import { logger } from '../lib/logger.js';
+/**
+ * Shared base class for domain services.
+ *
+ * Services own business logic and orchestration. They receive a Prisma client
+ * via the constructor, never reach into globals, and are instantiated per
+ * request in the tRPC router layer (e.g. `new FooService(ctx.db)`).
+ */
+export declare abstract class BaseService {
+    protected readonly db: PrismaClient;
+    protected readonly logger: typeof logger;
+    constructor(db: PrismaClient);
+}

package/dist/services/base.service.js

@@ -0,0 +1,14 @@
+import { logger } from '../lib/logger.js';
+/**
+ * Shared base class for domain services.
+ *
+ * Services own business logic and orchestration. They receive a Prisma client
+ * via the constructor, never reach into globals, and are instantiated per
+ * request in the tRPC router layer (e.g. `new FooService(ctx.db)`).
+ */
+export class BaseService {
+    constructor(db) {
+        this.db = db;
+        this.logger = logger;
+    }
+}

package/dist/services/billing/payment.service.d.ts

@@ -0,0 +1,55 @@
+import type { PrismaClient } from '@prisma/client';
+import type { ArtifactType } from '@prisma/client';
+import { BaseService } from '../base.service.js';
+export declare class PaymentService extends BaseService {
+    constructor(db: PrismaClient);
+    getPlans(userId?: string): Promise<any[]>;
+    createCheckoutSession(userId: string, input: {
+        planId: string;
+    }): Promise<{
+        url: string | null;
+    }>;
+    confirmCheckoutSuccess(userId: string, input: {
+        sessionId: string;
+    }): Promise<{
+        confirmed: boolean;
+        reason: string;
+        kind?: undefined;
+    } | {
+        confirmed: boolean;
+        kind: "payment";
+        reason?: undefined;
+    } | {
+        confirmed: boolean;
+        kind: "subscription";
+        reason?: undefined;
+    }>;
+    createResourcePurchaseSession(userId: string, input: {
+        resourceType: ArtifactType;
+        quantity: number;
+    }): Promise<{
+        url: string | null;
+    }>;
+    getUsageOverview(userId: string): Promise<{
+        usage: import("./usage.service.js").UserUsage;
+        limits: {
+            id: string;
+            planId: string;
+            maxStorageBytes: bigint;
+            maxWorksheets: number;
+            maxFlashcards: number;
+            maxPodcasts: number;
+            maxStudyGuides: number;
+            createdAt: Date;
+            updatedAt: Date;
+            isFallbackPlan: boolean;
+        };
+        hasActivePlan: boolean;
+    }>;
+    getResourcePrices(): import("@prisma/client").Prisma.PrismaPromise<{
+        id: string;
+        updatedAt: Date;
+        resourceType: import("@prisma/client").$Enums.ArtifactType;
+        priceCents: number;
+    }[]>;
+}