@kernhq/module-billing 0.2.0

package/dist/server/services/usage.js

@@ -0,0 +1,98 @@
+import { eq, sql } from 'drizzle-orm';
+import { workspaceUsage } from '../schema.js';
+/** Ensure a usage row exists, so the counters below can be plain arithmetic. */
+async function ensureRow(kernel, workspaceId) {
+    await kernel.database.db
+        .insert(workspaceUsage)
+        .values({ workspaceId, seats: 0, storageBytes: 0 })
+        .onConflictDoNothing();
+}
+/**
+ * Move a counter by a delta.
+ *
+ * Arithmetic in SQL rather than read-modify-write in JavaScript: two members joining at once is the
+ * normal case, not a rare one, and the read-modify-write version loses one of them.
+ * `greatest(0, …)` because a counter that has drifted negative is a bug that must not also start
+ * refusing uploads — the nightly reconcile is what corrects it.
+ */
+export async function bump(kernel, workspaceId, delta) {
+    await ensureRow(kernel, workspaceId);
+    await kernel.database.db
+        .update(workspaceUsage)
+        .set({
+        ...(delta.seats !== undefined
+            ? { seats: sql `greatest(0, ${workspaceUsage.seats} + ${delta.seats})` }
+            : {}),
+        ...(delta.storageBytes !== undefined
+            ? { storageBytes: sql `greatest(0, ${workspaceUsage.storageBytes} + ${delta.storageBytes})` }
+            : {}),
+        updatedAt: new Date(),
+    })
+        .where(eq(workspaceUsage.workspaceId, workspaceId));
+}
+/**
+ * Recount seats for one workspace and write the answer down.
+ *
+ * Seats are recounted rather than moved by a delta, because the events do not carry enough to do the
+ * arithmetic safely: `core.member.removed` does not say what role the person had, and
+ * `core.member.updated` does not say what role they had *before* — so a guest being promoted, or a
+ * member leaving, would each be counted wrongly. A count over one workspace's memberships is cheap;
+ * being wrong about what a customer is charged is not.
+ */
+export async function recountSeats(kernel, workspaceId) {
+    const { seats } = await kernel.call('core.workspaces.seats', { workspaceId });
+    await ensureRow(kernel, workspaceId);
+    await kernel.database.db
+        .update(workspaceUsage)
+        .set({ seats, updatedAt: new Date() })
+        .where(eq(workspaceUsage.workspaceId, workspaceId));
+    return seats;
+}
+export async function read(kernel, workspaceId) {
+    const [row] = await kernel.database.db
+        .select()
+        .from(workspaceUsage)
+        .where(eq(workspaceUsage.workspaceId, workspaceId))
+        .limit(1);
+    return {
+        seats: row?.seats ?? 0,
+        storageBytes: row?.storageBytes ?? 0,
+        updatedAt: row?.updatedAt ?? new Date(0),
+    };
+}
+/**
+ * Recount one workspace from core's own tables and write the answer down.
+ *
+ * Returns the drift it found. The caller logs it rather than swallowing it: a counter that keeps
+ * needing correction means an event is being missed somewhere, and silently fixing the number every
+ * night is how that goes unnoticed for a year.
+ */
+export async function reconcile(kernel, workspaceId) {
+    const counted = await kernel.call('core.workspaces.usage', { workspaceId });
+    const before = await read(kernel, workspaceId);
+    await kernel.database.db
+        .insert(workspaceUsage)
+        .values({
+        workspaceId,
+        seats: counted.seats,
+        storageBytes: counted.storageBytes,
+        reconciledAt: new Date(),
+    })
+        .onConflictDoUpdate({
+        target: workspaceUsage.workspaceId,
+        set: {
+            seats: counted.seats,
+            storageBytes: counted.storageBytes,
+            reconciledAt: new Date(),
+            updatedAt: new Date(),
+        },
+    });
+    return {
+        counted,
+        drift: {
+            seats: counted.seats - before.seats,
+            storageBytes: counted.storageBytes - before.storageBytes,
+        },
+    };
+}
+//# sourceMappingURL=usage.js.map

package/dist/server/services/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../../../src/server/services/usage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAQ7C,gFAAgF;AAChF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,WAAmB;IAC1D,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACrB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;SAClD,mBAAmB,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,WAAmB,EAAE,KAA4B;IAC1F,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACrB,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAA,eAAe,cAAc,CAAC,KAAK,MAAM,KAAK,CAAC,KAAK,GAAG,EAAE;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAA,eAAe,cAAc,CAAC,YAAY,MAAM,KAAK,CAAC,YAAY,GAAG,EAAE;YAC5F,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAmB;IACpE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoB,uBAAuB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;IAChG,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACrB,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;IACrD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,WAAmB;IAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACnC,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC;QACtB,YAAY,EAAE,GAAG,EAAE,YAAY,IAAI,CAAC;QACpC,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;KACzC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAe,uBAAuB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;IACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE;SACrB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,WAAW;QACX,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,IAAI,IAAI,EAAE;KACzB,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,cAAc,CAAC,WAAW;QAClC,GAAG,EAAE;YACH,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,YAAY,EAAE,IAAI,IAAI,EAAE;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB;KACF,CAAC,CAAA;IACJ,OAAO;QACL,OAAO;QACP,KAAK,EAAE;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK;YACnC,YAAY,EAAE,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY;SACzD;KACF,CAAA;AACH,CAAC"}

package/migrations/0000_init.sql

@@ -0,0 +1,82 @@
+CREATE SCHEMA IF NOT EXISTS "mod_billing";
+--> statement-breakpoint
+CREATE TABLE "mod_billing"."invoices" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"stripe_invoice_id" text,
+	"number" text,
+	"status" text NOT NULL,
+	"total_minor" integer DEFAULT 0 NOT NULL,
+	"currency" text DEFAULT 'usd' NOT NULL,
+	"period_start" timestamp with time zone,
+	"period_end" timestamp with time zone,
+	"hosted_url" text,
+	"pdf_url" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_billing"."overrides" (
+	"workspace_id" uuid PRIMARY KEY NOT NULL,
+	"limits" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"note" text DEFAULT '' NOT NULL,
+	"created_by" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_billing"."plans" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"slug" text NOT NULL,
+	"name" text NOT NULL,
+	"description" text DEFAULT '' NOT NULL,
+	"price_minor" integer DEFAULT 0 NOT NULL,
+	"currency" text DEFAULT 'usd' NOT NULL,
+	"interval" text DEFAULT 'month' NOT NULL,
+	"per_seat" boolean DEFAULT true NOT NULL,
+	"trial_days" integer DEFAULT 0 NOT NULL,
+	"limits" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"stripe_price_id" text,
+	"highlights" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"published" boolean DEFAULT false NOT NULL,
+	"order" integer DEFAULT 100 NOT NULL,
+	"archived_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_billing"."subscriptions" (
+	"workspace_id" uuid PRIMARY KEY NOT NULL,
+	"plan_id" uuid,
+	"status" text DEFAULT 'trialing' NOT NULL,
+	"seats_purchased" integer DEFAULT 0 NOT NULL,
+	"trial_ends_at" timestamp with time zone,
+	"current_period_end" timestamp with time zone,
+	"cancel_at_period_end" boolean DEFAULT false NOT NULL,
+	"stripe_customer_id" text,
+	"stripe_subscription_id" text,
+	"grace_ends_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_billing"."webhook_events" (
+	"id" text PRIMARY KEY NOT NULL,
+	"type" text NOT NULL,
+	"received_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_billing"."workspace_usage" (
+	"workspace_id" uuid PRIMARY KEY NOT NULL,
+	"seats" integer DEFAULT 0 NOT NULL,
+	"storage_bytes" bigint DEFAULT 0 NOT NULL,
+	"reconciled_at" timestamp with time zone,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "invoices_ws_idx" ON "mod_billing"."invoices" USING btree ("workspace_id","created_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "invoices_stripe_idx" ON "mod_billing"."invoices" USING btree ("stripe_invoice_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "plans_slug_idx" ON "mod_billing"."plans" USING btree ("slug");--> statement-breakpoint
+CREATE INDEX "plans_published_idx" ON "mod_billing"."plans" USING btree ("published","order");--> statement-breakpoint
+CREATE INDEX "subscriptions_status_idx" ON "mod_billing"."subscriptions" USING btree ("status");--> statement-breakpoint
+CREATE UNIQUE INDEX "subscriptions_stripe_sub_idx" ON "mod_billing"."subscriptions" USING btree ("stripe_subscription_id");--> statement-breakpoint
+CREATE INDEX "webhook_events_received_idx" ON "mod_billing"."webhook_events" USING btree ("received_at");

package/migrations/0001_rls.sql

@@ -0,0 +1,18 @@
+-- Row level security for this module's tenant tables.
+--
+-- Only `invoices` is one. An invoice is the customer's own record, read on their own billing screen
+-- in their own workspace context, so it is isolated the way every other module's data is.
+--
+-- The rest of `mod_billing` — plans, subscriptions, workspace_usage, overrides, webhook_events — is
+-- deliberately *not* row-level secured, and the reason is written where it will be read, at the top
+-- of src/server/schema.ts: those rows are the instance operator's record *about* a workspace rather
+-- than the workspace's own data, and the console that lists every workspace on the instance and the
+-- jobs that enumerate them cannot work under a policy that returns nothing when `app.workspace_id`
+-- is unset. Their isolation is enforced in the procedure layer instead.
+alter table "mod_billing"."invoices" enable row level security;
+--> statement-breakpoint
+alter table "mod_billing"."invoices" force row level security;
+--> statement-breakpoint
+create policy "invoices_ws_isolation" on "mod_billing"."invoices"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));