@mdguggenbichler/slugbase-core 0.0.1

package/backend/dist/utils/env-validation.js

@@ -0,0 +1,51 @@
+/**
+ * Environment variable validation
+ * Ensures all required security-related environment variables are set
+ */
+export function validateEnvironmentVariables() {
+    const errors = [];
+    const warnings = [];
+    // Critical security variables - must be set
+    if (!process.env.JWT_SECRET) {
+        errors.push('JWT_SECRET is required but not set. Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+    }
+    else if (process.env.JWT_SECRET === 'slugbase-jwt-secret-change-in-production' || process.env.JWT_SECRET.length < 32) {
+        errors.push('JWT_SECRET must be at least 32 characters and not use the default value');
+    }
+    if (!process.env.ENCRYPTION_KEY) {
+        errors.push('ENCRYPTION_KEY is required but not set. Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+    }
+    else if (process.env.ENCRYPTION_KEY.length < 32) {
+        errors.push('ENCRYPTION_KEY must be at least 32 characters');
+    }
+    // Session secret: required in production (M3/L4) so we don't fall back to JWT_SECRET or default
+    if (process.env.NODE_ENV === 'production') {
+        if (!process.env.SESSION_SECRET || process.env.SESSION_SECRET.length < 32) {
+            errors.push('SESSION_SECRET is required in production and must be at least 32 characters');
+        }
+    }
+    else if (!process.env.SESSION_SECRET) {
+        warnings.push('SESSION_SECRET is not set (may be used as fallback)');
+    }
+    if (process.env.NODE_ENV === 'production') {
+        if (!process.env.FRONTEND_URL) {
+            warnings.push('FRONTEND_URL should be set in production');
+        }
+        if (!process.env.BASE_URL) {
+            warnings.push('BASE_URL should be set in production');
+        }
+    }
+    // Display warnings
+    if (warnings.length > 0) {
+        console.warn('Environment variable warnings:');
+        warnings.forEach(warning => console.warn(`  - ${warning}`));
+    }
+    // Fail on errors
+    if (errors.length > 0) {
+        console.error('Environment variable validation failed:');
+        errors.forEach(error => console.error(`  ❌ ${error}`));
+        console.error('\nPlease set the required environment variables before starting the server.');
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=env-validation.js.map

package/backend/dist/utils/env-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-validation.js","sourceRoot":"","sources":["../../src/utils/env-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,qIAAqI,CAAC,CAAC;IACrJ,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,0CAA0C,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvH,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,yIAAyI,CAAC,CAAC;IACzJ,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IAED,gGAAgG;IAChG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/backend/dist/utils/jwt.d.ts

@@ -0,0 +1,20 @@
+export interface JWTPayload {
+    id: string;
+    email: string;
+    name: string;
+    user_key: string;
+    is_admin: boolean;
+}
+/**
+ * Generate a JWT token for a user (SELFHOSTED: long-lived; or generic with default 7d).
+ */
+export declare function generateToken(user: JWTPayload): string;
+/**
+ * Verify and decode a JWT token
+ */
+export declare function verifyToken(token: string): JWTPayload | null;
+/**
+ * Extract JWT token from request (cookie or Authorization header)
+ */
+export declare function extractTokenFromRequest(req: any): string | null;
+//# sourceMappingURL=jwt.d.ts.map

package/backend/dist/utils/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAYtD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAO5D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAa/D"}

package/backend/dist/utils/jwt.js

@@ -0,0 +1,48 @@
+import jwt from 'jsonwebtoken';
+// JWT_SECRET is validated at startup via validateEnvironmentVariables()
+// This will throw if not set, preventing insecure defaults
+const JWT_SECRET = process.env.JWT_SECRET;
+if (!JWT_SECRET) {
+    throw new Error('JWT_SECRET environment variable is required. Please set it before starting the server.');
+}
+const JWT_EXPIRES_IN = (process.env.JWT_EXPIRES_IN || '7d');
+/**
+ * Generate a JWT token for a user (SELFHOSTED: long-lived; or generic with default 7d).
+ */
+export function generateToken(user) {
+    return jwt.sign({
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        user_key: user.user_key,
+        is_admin: user.is_admin,
+    }, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN });
+}
+/**
+ * Verify and decode a JWT token
+ */
+export function verifyToken(token) {
+    try {
+        const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] });
+        return decoded;
+    }
+    catch (error) {
+        return null;
+    }
+}
+/**
+ * Extract JWT token from request (cookie or Authorization header)
+ */
+export function extractTokenFromRequest(req) {
+    // Try cookie first (httpOnly cookie)
+    if (req.cookies && req.cookies.token) {
+        return req.cookies.token;
+    }
+    // Try Authorization header as fallback
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        return authHeader.substring(7);
+    }
+    return null;
+}
+//# sourceMappingURL=jwt.js.map

package/backend/dist/utils/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAoB,MAAM,cAAc,CAAC;AAEhD,wEAAwE;AACxE,2DAA2D;AAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAoB,CAAC;AACpD,IAAI,CAAC,UAAU,EAAE,CAAC;IAChB,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAW,CAAC;AAUtE;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,OAAO,GAAG,CAAC,IAAI,CACb;QACE,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,EACD,UAAU,EACV,EAAE,SAAS,EAAE,cAAc,EAAiB,CAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAe,CAAC;QACvF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAQ;IAC9C,qCAAqC;IACrC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,uCAAuC;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/backend/dist/utils/org-cleanup.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Scheduled orphan organization cleanup (Cloud mode only).
+ * Finds orgs with 0 members and deletes them. Runs daily as a safety net.
+ */
+export declare function startOrgCleanupJob(): void;
+//# sourceMappingURL=org-cleanup.d.ts.map

package/backend/dist/utils/org-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-cleanup.d.ts","sourceRoot":"","sources":["../../src/utils/org-cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,wBAAgB,kBAAkB,IAAI,IAAI,CA6BzC"}

package/backend/dist/utils/org-cleanup.js

@@ -0,0 +1,37 @@
+/**
+ * Scheduled orphan organization cleanup (Cloud mode only).
+ * Finds orgs with 0 members and deletes them. Runs daily as a safety net.
+ */
+import cron from 'node-cron';
+import { query } from '../db/index.js';
+import { deleteOrganization } from './organizations.js';
+import { isCloud } from '../config/mode.js';
+export function startOrgCleanupJob() {
+    if (!isCloud)
+        return;
+    const tz = process.env.ORG_CLEANUP_CRON_TZ || undefined;
+    cron.schedule('0 2 * * *', async () => {
+        try {
+            const orphans = await query(`SELECT id FROM organizations o
+         WHERE NOT EXISTS (SELECT 1 FROM org_members om WHERE om.org_id = o.id)`, []);
+            const list = Array.isArray(orphans) ? orphans : orphans ? [orphans] : [];
+            for (const row of list) {
+                const orgId = row.id;
+                if (orgId) {
+                    try {
+                        await deleteOrganization(orgId);
+                        console.log(`Org cleanup: deleted orphan org ${orgId}`);
+                    }
+                    catch (err) {
+                        console.warn(`Org cleanup: failed to delete org ${orgId}:`, err?.message);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.warn('Org cleanup job error:', error?.message);
+        }
+    }, tz ? { timezone: tz } : {});
+    console.log('Org cleanup job scheduled (daily at 2:00 AM)' + (tz ? ` [${tz}]` : ''));
+}
+//# sourceMappingURL=org-cleanup.js.map

package/backend/dist/utils/org-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-cleanup.js","sourceRoot":"","sources":["../../src/utils/org-cleanup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,SAAS,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB;gFACwE,EACxE,EAAE,CACH,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAI,GAAW,CAAC,EAAE,CAAC;gBAC9B,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC;wBACH,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;wBAChC,OAAO,CAAC,GAAG,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;oBAC1D,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,OAAO,CAAC,IAAI,CAAC,qCAAqC,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE/B,OAAO,CAAC,GAAG,CAAC,8CAA8C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC"}

package/backend/dist/utils/organizations.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Self-hosted compatibility helpers.
+ * Cloud organization and plan logic has been removed.
+ */
+export declare const FREE_BOOKMARK_LIMIT = 0;
+export declare function getCurrentOrgId(_userId: string): Promise<string | null>;
+export declare function getUserPlan(_userId: string): Promise<'free' | 'personal' | 'team' | 'early_supporter'>;
+export declare function canCreateBookmarkFreePlan(_userId: string, _bookmarkCount?: number): Promise<boolean>;
+export declare function clearFreePlanGrace(_userId: string): Promise<void>;
+export declare function setCurrentOrg(_userId: string, _orgId: string): Promise<boolean>;
+export declare function deleteOrganization(_orgId: string): Promise<void>;
+//# sourceMappingURL=organizations.d.ts.map

package/backend/dist/utils/organizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/utils/organizations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE7E;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,iBAAiB,CAAC,CAE5G;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1G;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE"}

package/backend/dist/utils/organizations.js

@@ -0,0 +1,24 @@
+/**
+ * Self-hosted compatibility helpers.
+ * Cloud organization and plan logic has been removed.
+ */
+export const FREE_BOOKMARK_LIMIT = 0;
+export async function getCurrentOrgId(_userId) {
+    return null;
+}
+export async function getUserPlan(_userId) {
+    return 'team';
+}
+export async function canCreateBookmarkFreePlan(_userId, _bookmarkCount) {
+    return true;
+}
+export async function clearFreePlanGrace(_userId) {
+    // no-op in self-hosted mode
+}
+export async function setCurrentOrg(_userId, _orgId) {
+    return true;
+}
+export async function deleteOrganization(_orgId) {
+    // no-op in self-hosted mode
+}
+//# sourceMappingURL=organizations.js.map

package/backend/dist/utils/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/utils/organizations.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,cAAuB;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACtD,4BAA4B;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,4BAA4B;AAC9B,CAAC"}

package/backend/dist/utils/plan-errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Plan restriction error codes and messages for Cloud mode.
+ */
+export declare const PLAN_ERRORS: {
+    readonly BOOKMARK_LIMIT: {
+        readonly code: "PLAN_LIMIT_BOOKMARKS";
+        readonly message: string;
+    };
+    readonly SHARE_TO_TEAM: {
+        readonly code: "PLAN_SHARE_TO_TEAM";
+        readonly message: "Sharing to teams is available on the Team plan.";
+    };
+    readonly FOLDER_SHARING: {
+        readonly code: "PLAN_FOLDER_SHARING";
+        readonly message: "Folder sharing is available on the Team plan.";
+    };
+};
+//# sourceMappingURL=plan-errors.d.ts.map

package/backend/dist/utils/plan-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-errors.d.ts","sourceRoot":"","sources":["../../src/utils/plan-errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,eAAO,MAAM,WAAW;;;;;;;;;;;;;CAed,CAAC"}

package/backend/dist/utils/plan-errors.js

@@ -0,0 +1,21 @@
+/**
+ * Plan restriction error codes and messages for Cloud mode.
+ */
+import { FREE_BOOKMARK_LIMIT } from './organizations.js';
+export const PLAN_ERRORS = {
+    BOOKMARK_LIMIT: {
+        code: 'PLAN_LIMIT_BOOKMARKS',
+        get message() {
+            return `You've reached the Free plan limit (${FREE_BOOKMARK_LIMIT} bookmarks). Upgrade to add more.`;
+        },
+    },
+    SHARE_TO_TEAM: {
+        code: 'PLAN_SHARE_TO_TEAM',
+        message: 'Sharing to teams is available on the Team plan.',
+    },
+    FOLDER_SHARING: {
+        code: 'PLAN_FOLDER_SHARING',
+        message: 'Folder sharing is available on the Team plan.',
+    },
+};
+//# sourceMappingURL=plan-errors.js.map

package/backend/dist/utils/plan-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-errors.js","sourceRoot":"","sources":["../../src/utils/plan-errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc,EAAE;QACd,IAAI,EAAE,sBAAsB;QAC5B,IAAI,OAAO;YACT,OAAO,uCAAuC,mBAAmB,mCAAmC,CAAC;QACvG,CAAC;KACF;IACD,aAAa,EAAE;QACb,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iDAAiD;KAC3D;IACD,cAAc,EAAE;QACd,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,+CAA+C;KACzD;CACO,CAAC"}

package/backend/dist/utils/refresh-token.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Refresh token helpers for CLOUD mode: create, rotate, revoke.
+ * Store only SHA-256 hash in DB; rotation on use; revoke on logout.
+ */
+export interface CreateRefreshTokenResult {
+    token: string;
+    expiresAt: Date;
+}
+/** Create a new refresh token for user; store hash in DB. Caller sets cookie. */
+export declare function createRefreshToken(userId: string): Promise<CreateRefreshTokenResult>;
+export interface RotateRefreshTokenResult {
+    token: string;
+    expiresAt: Date;
+    user: {
+        id: string;
+        email: string;
+        name: string;
+        user_key: string;
+        is_admin: boolean;
+    };
+}
+/**
+ * Validate refresh token from cookie, delete old record, create new token (rotation), return new token + user.
+ * Returns null if invalid or expired.
+ */
+export declare function rotateRefreshToken(currentToken: string): Promise<RotateRefreshTokenResult | null>;
+/** Revoke all refresh tokens for a user (e.g. on logout). */
+export declare function revokeRefreshTokensForUser(userId: string): Promise<void>;
+/** Get user id for a valid refresh token (for logout revoke). Returns null if invalid or expired. */
+export declare function findUserIdByRefreshToken(token: string): Promise<string | null>;
+//# sourceMappingURL=refresh-token.d.ts.map

package/backend/dist/utils/refresh-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../src/utils/refresh-token.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,iFAAiF;AACjF,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAW1F;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CACxF;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgBvG;AAED,6DAA6D;AAC7D,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED,qGAAqG;AACrG,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQpF"}

package/backend/dist/utils/refresh-token.js

@@ -0,0 +1,63 @@
+/**
+ * Refresh token helpers for CLOUD mode: create, rotate, revoke.
+ * Store only SHA-256 hash in DB; rotation on use; revoke on logout.
+ */
+import crypto from 'crypto';
+import { v4 as uuidv4 } from 'uuid';
+import { queryOne, execute } from '../db/index.js';
+const DB_TYPE = process.env.DB_TYPE || 'sqlite';
+const JWT_REFRESH_EXPIRES_DAYS = parseInt(process.env.JWT_REFRESH_EXPIRES_DAYS || '7', 10);
+function hashToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+/** Convert ? placeholders to $1, $2 for PostgreSQL */
+function toPg(sql) {
+    let n = 0;
+    return sql.replace(/\?/g, () => `$${++n}`);
+}
+function sql(sql, params) {
+    return DB_TYPE === 'postgresql' ? [toPg(sql), params] : [sql, params];
+}
+/** Create a new refresh token for user; store hash in DB. Caller sets cookie. */
+export async function createRefreshToken(userId) {
+    const token = crypto.randomBytes(32).toString('hex');
+    const tokenHash = hashToken(token);
+    const id = uuidv4();
+    const expiresAt = new Date(Date.now() + JWT_REFRESH_EXPIRES_DAYS * 24 * 60 * 60 * 1000);
+    const [q, p] = sql('INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at, revoked) VALUES (?, ?, ?, ?, ?)', [id, userId, tokenHash, expiresAt.toISOString(), false]);
+    await execute(q, p);
+    return { token, expiresAt };
+}
+/**
+ * Validate refresh token from cookie, delete old record, create new token (rotation), return new token + user.
+ * Returns null if invalid or expired.
+ */
+export async function rotateRefreshToken(currentToken) {
+    const tokenHash = hashToken(currentToken);
+    const [qSel, pSel] = sql('SELECT id, user_id FROM refresh_tokens WHERE token_hash = ? AND revoked = ? AND expires_at > ?', [tokenHash, false, new Date().toISOString()]);
+    const row = await queryOne(qSel, pSel);
+    if (!row)
+        return null;
+    const r = row;
+    const userRow = await queryOne('SELECT id, email, name, user_key, is_admin FROM users WHERE id = ?', [r.user_id]);
+    if (!userRow)
+        return null;
+    const user = userRow;
+    const [qDel, pDel] = sql('DELETE FROM refresh_tokens WHERE id = ?', [r.id]);
+    await execute(qDel, pDel);
+    const { token, expiresAt } = await createRefreshToken(user.id);
+    return { token, expiresAt, user };
+}
+/** Revoke all refresh tokens for a user (e.g. on logout). */
+export async function revokeRefreshTokensForUser(userId) {
+    const [q, p] = sql('DELETE FROM refresh_tokens WHERE user_id = ?', [userId]);
+    await execute(q, p);
+}
+/** Get user id for a valid refresh token (for logout revoke). Returns null if invalid or expired. */
+export async function findUserIdByRefreshToken(token) {
+    const tokenHash = hashToken(token);
+    const [q, p] = sql('SELECT user_id FROM refresh_tokens WHERE token_hash = ? AND revoked = ? AND expires_at > ?', [tokenHash, false, new Date().toISOString()]);
+    const row = await queryOne(q, p);
+    return row ? row.user_id : null;
+}
+//# sourceMappingURL=refresh-token.js.map

package/backend/dist/utils/refresh-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.js","sourceRoot":"","sources":["../../src/utils/refresh-token.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC;AAChD,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;AAE3F,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,sDAAsD;AACtD,SAAS,IAAI,CAAC,GAAW;IACvB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,MAAa;IACrC,OAAO,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAOD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAChB,kGAAkG,EAClG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CACxD,CAAC;IACF,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,CACtB,gGAAgG,EAChG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,GAAsC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oEAAoE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,IAAI,GAAG,OAA2F,CAAC;IACzG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAc;IAC7D,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,8CAA8C,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAa;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAChB,4FAA4F,EAC5F,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAE,GAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC"}

package/backend/dist/utils/session-store.d.ts

@@ -0,0 +1,46 @@
+import { Store } from 'express-session';
+/**
+ * Custom database-backed session store for express-session
+ * Works with both SQLite and PostgreSQL
+ */
+export declare class DatabaseSessionStore extends Store {
+    private DB_TYPE;
+    constructor();
+    /**
+     * Start periodic cleanup of expired sessions
+     */
+    private startCleanupInterval;
+    /**
+     * Initialize the sessions table if it doesn't exist
+     */
+    private initializeTable;
+    /**
+     * Get session data
+     */
+    get(sid: string, callback: (err?: any, session?: any) => void): Promise<void>;
+    /**
+     * Set session data
+     */
+    set(sid: string, session: any, callback?: (err?: any) => void): Promise<void>;
+    /**
+     * Destroy session
+     */
+    destroy(sid: string, callback?: (err?: any) => void): Promise<void>;
+    /**
+     * Clear all sessions
+     */
+    clear(callback?: (err?: any) => void): Promise<void>;
+    /**
+     * Get number of sessions
+     */
+    length(callback: (err?: any, length?: number) => void): Promise<void>;
+    /**
+     * Get all session IDs
+     */
+    all(callback: (err?: any, sessions?: any[]) => void): Promise<void>;
+    /**
+     * Touch session (update expiration)
+     */
+    touch(sid: string, session: any, callback?: (err?: any) => void): Promise<void>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/backend/dist/utils/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/utils/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAiBxC;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,OAAO,CAAC,OAAO,CAAS;;IAUxB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;YACW,eAAe;IAiC7B;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,KAAK,IAAI;IAqBnE;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,IAAI;IA0BnE;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,IAAI;IAazD;;OAEG;IACG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,IAAI;IAS1C;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI;IAc3D;;OAEG;IACG,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,IAAI;IAiBzD;;OAEG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,IAAI;CAatE"}