@intranefr/superbackend 1.4.3

package/src/controllers/billing.controller.js

@@ -0,0 +1,223 @@
+const User = require("../models/User");
+const StripeWebhookEvent = require("../models/StripeWebhookEvent");
+const asyncHandler = require("../utils/asyncHandler");
+const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY);
+const stripeService = require("../services/stripe.service");
+
+// Create Stripe Checkout Session
+const createCheckoutSession = asyncHandler(async (req, res) => {
+  const { priceId, billingMode } = req.body;
+  const userId = req.user._id;
+
+  if (!priceId) {
+    return res.status(400).json({ error: "priceId is required" });
+  }
+
+  // Get or create Stripe customer
+  let customerId = req.user.stripeCustomerId;
+  if (!customerId) {
+    const customer = await stripe.customers.create({
+      email: req.user.email,
+      metadata: { userId: userId.toString() },
+    });
+    customerId = customer.id;
+    req.user.stripeCustomerId = customerId;
+    await req.user.save();
+  }
+
+  const mode = billingMode === "payment" ? "payment" : "subscription";
+
+  const session = await stripe.checkout.sessions.create({
+    customer: customerId,
+    mode,
+    line_items: [{ price: priceId, quantity: 1 }],
+    success_url: `${process.env.PUBLIC_URL || "http://localhost:3000"}/?checkout=success`,
+    cancel_url: `${process.env.PUBLIC_URL || "http://localhost:3000"}/?checkout=cancelled`,
+    metadata: {
+      userId: userId.toString(),
+      billingMode: mode,
+    },
+  });
+
+  res.json({ sessionId: session.id, url: session.url });
+});
+
+// Create Stripe Customer Portal Session
+const createPortalSession = asyncHandler(async (req, res) => {
+  const customerId = req.user.stripeCustomerId;
+
+  if (!customerId) {
+    return res.status(400).json({ error: "No Stripe customer found" });
+  }
+
+  const session = await stripe.billingPortal.sessions.create({
+    customer: customerId,
+    return_url: `${process.env.PUBLIC_URL || "http://localhost:3000"}${process.env.BILLING_RETURN_URL_RELATIVE || "/settings/billing"}`,
+  });
+
+  res.json({ url: session.url });
+});
+
+// Stripe Webhook Handler
+const handleWebhook = async (req, res) => {
+  const sig = req.headers["stripe-signature"];
+  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
+
+  let event;
+  try {
+    event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
+  } catch (err) {
+    console.error("Webhook signature verification failed:", err.message);
+    return res.status(400).send(`Webhook Error: ${err.message}`);
+  }
+
+  let webhookEventDoc;
+  try {
+    // Check if webhook event already exists
+    const existingEvent = await StripeWebhookEvent.findOne({ stripeEventId: event.id });
+    if (existingEvent) {
+      console.log(`Webhook event ${event.id} already processed with status: ${existingEvent.status}`);
+      return res.json({ received: true, status: 'duplicate' });
+    }
+
+    // Persist webhook event to database
+    webhookEventDoc = new StripeWebhookEvent({
+      stripeEventId: event.id,
+      eventType: event.type,
+      data: event.data.object,
+      previousAttributes: event.data.previous_attributes,
+      api_version: event.api_version,
+      request: event.request,
+      status: "received",
+    });
+    await webhookEventDoc.save();
+  } catch (err) {
+    console.error("Error saving webhook event:", err);
+    // If it's a duplicate key error, the event was already processed
+    if (err.code === 11000) {
+      return res.json({ received: true, status: 'duplicate' });
+    }
+    // Continue processing for other errors
+  }
+
+  try {
+    switch (event.type) {
+      case "checkout.session.completed":
+        await stripeService.handleCheckoutSessionCompleted(event.data.object);
+        break;
+      
+      case "customer.subscription.created":
+        await stripeService.handleSubscriptionCreated(event.data.object);
+        break;
+      
+      case "customer.subscription.updated":
+        await stripeService.handleSubscriptionUpdated(
+          event.data.object,
+          event.data.previous_attributes
+        );
+        break;
+      
+      case "customer.subscription.deleted":
+        await stripeService.handleSubscriptionDeleted(event.data.object);
+        break;
+      
+      case "invoice.payment_succeeded":
+        await stripeService.handleInvoicePaymentSucceeded(event.data.object);
+        break;
+      
+      case "invoice.payment_failed":
+        await stripeService.handleInvoicePaymentFailed(event.data.object);
+        break;
+      
+      default:
+        console.log(`Unhandled event type: ${event.type}`);
+    }
+
+    // Update webhook event status to processed
+    if (webhookEventDoc) {
+      webhookEventDoc.status = "processed";
+      webhookEventDoc.processedAt = new Date();
+      await webhookEventDoc.save();
+    }
+  } catch (err) {
+    console.error("Error processing webhook:", err);
+
+    // Update webhook event status to failed
+    if (webhookEventDoc) {
+      webhookEventDoc.status = "failed";
+      webhookEventDoc.retryCount = (webhookEventDoc.retryCount || 0) + 1;
+      webhookEventDoc.processingErrors.push({
+        message: err.message,
+        timestamp: new Date()
+      });
+      await webhookEventDoc.save();
+    }
+
+    return res.status(500).json({ error: "Webhook processing failed" });
+  }
+
+  res.json({ received: true });
+};
+
+// Reconcile subscription for user
+const reconcileSubscription = asyncHandler(async (req, res) => {
+  const user = req.user;
+
+  if (!user.stripeCustomerId) {
+    return res.json({ status: "success", message: "No Stripe customer found" });
+  }
+
+  // Fetch latest subscription from Stripe
+  const subscriptions = await stripe.subscriptions.list({
+    customer: user.stripeCustomerId,
+    limit: 1,
+  });
+
+  if (subscriptions.data.length > 0) {
+    const subscription = subscriptions.data[0];
+    user.stripeSubscriptionId = subscription.id;
+    // Map Stripe subscription status to our schema
+    const statusMapping = {
+      'active': 'active',
+      'past_due': 'past_due',
+      'unpaid': 'unpaid',
+      'canceled': 'cancelled',
+      'incomplete': 'incomplete',
+      'incomplete_expired': 'incomplete_expired',
+      'trialing': 'trialing'
+    };
+    user.subscriptionStatus = statusMapping[subscription.status] || subscription.status;
+    await user.save();
+  } else {
+    // No active subscription found. Check for successful one-off (payment) checkouts
+    const sessions = await stripe.checkout.sessions.list({
+      customer: user.stripeCustomerId,
+      limit: 10,
+    });
+
+    const lifetimeSession = sessions.data.find((session) => {
+      const mode = session.metadata?.billingMode || session.mode;
+      return (
+        mode === "payment" &&
+        session.payment_status === "paid"
+      );
+    });
+
+    if (lifetimeSession) {
+      user.subscriptionStatus = "active";
+    } else {
+      user.subscriptionStatus = "none";
+    }
+
+    await user.save();
+  }
+
+  res.json({ status: "success", subscriptionStatus: user.subscriptionStatus });
+});
+
+module.exports = {
+  createCheckoutSession,
+  createPortalSession,
+  handleWebhook,
+  reconcileSubscription,
+};

package/src/controllers/featureFlags.controller.js

@@ -0,0 +1,35 @@
+const {
+  evaluateAllForRequest,
+  flagsArrayToMap,
+} = require('../services/featureFlags.service');
+
+exports.getEvaluatedFlags = async (req, res) => {
+  try {
+    const userId = req.user?._id;
+    const orgId = req.query.orgId || req.headers['x-org-id'] || null;
+    const anonId = req.query.anonId || req.headers['x-anon-id'] || null;
+
+    const flagsArray = await evaluateAllForRequest({ userId, orgId, anonId });
+    const flags = flagsArrayToMap(flagsArray);
+
+    res.json({ flags });
+  } catch (error) {
+    console.error('Error evaluating feature flags:', error);
+    res.status(500).json({ error: 'Failed to evaluate feature flags' });
+  }
+};
+
+exports.getPublicFlags = async (req, res) => {
+  try {
+    const orgId = req.query.orgId || req.headers['x-org-id'] || null;
+    const anonId = req.query.anonId || req.headers['x-anon-id'] || null;
+
+    const flagsArray = await evaluateAllForRequest({ userId: null, orgId, anonId });
+    const flags = flagsArrayToMap(flagsArray);
+
+    res.json({ flags });
+  } catch (error) {
+    console.error('Error evaluating public feature flags:', error);
+    res.status(500).json({ error: 'Failed to evaluate feature flags' });
+  }
+};

package/src/controllers/forms.controller.js

@@ -0,0 +1,217 @@
+const crypto = require('crypto');
+const { verifyAccessToken } = require('../utils/jwt');
+const User = require('../models/User');
+const FormSubmission = require('../models/FormSubmission');
+const formsService = require('../services/forms.service');
+
+// --- Form Definition Management (Admin) ---
+
+exports.getForms = async (req, res) => {
+  try {
+    const forms = await formsService.getForms();
+    res.json(forms);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+};
+
+exports.saveForm = async (req, res) => {
+  try {
+    console.log('[FormsController] Saving form definition:', req.body);
+    const saved = await formsService.saveForm(req.body);
+    res.json(saved);
+  } catch (error) {
+    console.error('[FormsController] Error saving form:', error);
+    res.status(500).json({ error: error.message, stack: process.env.NODE_ENV === 'development' ? error.stack : undefined });
+  }
+};
+
+exports.deleteForm = async (req, res) => {
+  try {
+    await formsService.deleteForm(req.params.id);
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+};
+
+// --- Submission Management (Admin) ---
+
+exports.adminList = async (req, res) => {
+  try {
+    const { formId, formKey, limit = 50, offset = 0 } = req.query;
+    // Support both formId and formKey (legacy)
+    const filterId = formId || formKey;
+    
+    const result = await formsService.getSubmissions(
+      { formId: filterId },
+      { 
+        limit: parseInt(limit, 10) || 50, 
+        offset: parseInt(offset, 10) || 0 
+      }
+    );
+    
+    // Maintain legacy response format for compatibility
+    res.json({ 
+      submissions: result.entries, 
+      pagination: result.pagination 
+    });
+  } catch (error) {
+    console.error('Form admin list error:', error);
+    return res.status(500).json({ error: 'Failed to list submissions' });
+  }
+};
+
+exports.deleteSubmission = async (req, res) => {
+  try {
+    await formsService.deleteSubmission(req.params.id);
+    res.json({ success: true });
+  } catch (error) {
+    console.error('[FormsController] Error deleting submission:', error);
+    res.status(500).json({ error: 'Failed to delete submission' });
+  }
+};
+
+// --- Public Submission ---
+
+function parseCookieHeader(cookieHeader) {
+  const out = {};
+  if (!cookieHeader) return out;
+  const parts = cookieHeader.split(';');
+  for (const p of parts) {
+    const idx = p.indexOf('=');
+    if (idx === -1) continue;
+    const k = p.slice(0, idx).trim();
+    const v = p.slice(idx + 1).trim();
+    if (!k) continue;
+    out[k] = decodeURIComponent(v);
+  }
+  return out;
+}
+
+async function tryAttachUser(req) {
+  if (req.user?._id) return;
+  const authHeader = req.headers.authorization;
+  if (!authHeader || !authHeader.startsWith('Bearer ')) return;
+
+  try {
+    const token = authHeader.substring(7);
+    const decoded = verifyAccessToken(token);
+    const user = await User.findById(decoded.userId);
+    if (user) req.user = user;
+  } catch (e) {
+  }
+}
+
+function getAnonId(req) {
+  const headerAnon = req.get('x-anon-id');
+  if (headerAnon) return String(headerAnon).trim();
+
+  const cookies = parseCookieHeader(req.headers.cookie);
+  if (cookies.enbauges_anon_id) return String(cookies.enbauges_anon_id).trim();
+
+  const bodyAnon = req.body?.anonId;
+  if (bodyAnon) return String(bodyAnon).trim();
+
+  return null;
+}
+
+function normalizeEmail(email) {
+  return String(email || '').trim().toLowerCase();
+}
+
+function isValidEmail(email) {
+  if (!email) return false;
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+exports.submit = async (req, res) => {
+  try {
+    await tryAttachUser(req);
+
+    const formKey = String(req.params.formId || req.body?.formKey || '').trim();
+    const fields = req.body; // In POST forms, fields are the body itself or nested in fields
+
+    if (!formKey) {
+      return res.status(400).json({ error: 'formKey is required' });
+    }
+    if (!fields || typeof fields !== 'object') {
+      return res.status(400).json({ error: 'fields is required' });
+    }
+
+    if (formKey === 'contact') {
+      const email = normalizeEmail(fields.email);
+      const message = String(fields.message || '').trim();
+      if (!isValidEmail(email)) {
+        return res.status(400).json({ error: 'Email invalide', field: 'email' });
+      }
+      if (!message || message.length < 5) {
+        return res.status(400).json({ error: 'Message trop court', field: 'message' });
+      }
+    }
+
+    let actorType = 'anonymous';
+    let actorId = getAnonId(req);
+    let userId = null;
+
+    if (req.user?._id) {
+      actorType = 'user';
+      actorId = String(req.user._id);
+      userId = req.user._id;
+    }
+
+    if (!actorId) {
+      actorId = crypto.randomUUID();
+      res.cookie('enbauges_anon_id', actorId, {
+        httpOnly: false,
+        sameSite: 'lax',
+        maxAge: 1000 * 60 * 60 * 24 * 365,
+        path: '/',
+      });
+    }
+
+    const meta = {
+      ip: req.headers['x-forwarded-for'] || req.socket?.remoteAddress || null,
+      userAgent: req.get('user-agent') || null,
+      referer: req.get('referer') || null,
+    };
+
+    const doc = await formsService.submitForm(formKey, fields, {
+      ...meta,
+      actorType,
+      actorId,
+      userId
+    });
+
+    const formConfig = await formsService.getFormById(formKey);
+    if (formConfig?.successUrl) {
+      return res.redirect(formConfig.successUrl);
+    }
+
+    return res.status(201).json({ ok: true, id: String(doc._id) });
+  } catch (error) {
+    console.error('Form submit error:', error);
+    return res.status(500).json({ error: 'Failed to submit' });
+  }
+};
+
+exports.adminList = async (req, res) => {
+  try {
+    const { formKey, limit = 50, offset = 0 } = req.query;
+    const query = {};
+    if (formKey) query.formKey = formKey;
+
+    const submissions = await FormSubmission.find(query)
+      .sort({ createdAt: -1 })
+      .limit(parseInt(limit))
+      .skip(parseInt(offset))
+      .lean();
+
+    const total = await FormSubmission.countDocuments(query);
+
+    return res.json({ submissions, pagination: { total, limit: parseInt(limit), offset: parseInt(offset) } });
+  } catch (error) {
+    console.error('Form admin list error:', error);
+    return res.status(500).json({ error: 'Failed to list submissions' });
+  }
+};