@omega.js/backend 0.1.0

package/dist/manager/routes/admin/repo/content/post.js

@@ -0,0 +1,106 @@
+/**
+ * POST /admin/repo/content - Write content to GitHub repo
+ * Admin/blogger endpoint to write files to GitHub
+ */
+const { Octokit } = require('@octokit/rest');
+const { brandRepoOwner, brandRepoName } = require('../../../../../vendor/config/index.js');
+const env = require('../../../../libraries/env.js');
+
+module.exports = async ({ ctx, Manager, user, settings, analytics }) => {
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Require admin or blogger
+  if (!user.roles.admin && !user.roles.blogger) {
+    return ctx.respond('Admin required.', { code: 403 });
+  }
+
+  // Check for GitHub configuration
+  if (!env.has('GH_TOKEN')) {
+    return ctx.respond('GitHub API key not configured.', { code: 500 });
+  }
+
+  if (!brandRepoOwner(Manager.config) || !brandRepoName(Manager.config)) {
+    return ctx.respond('GitHub repo not configured (set targets.backend.github.repo — "owner/name" or bare name — or repo.providers.github.org + brand.id).', { code: 500 });
+  }
+
+  ctx.log('main(): settings', settings);
+
+  const bemRepo = { user: brandRepoOwner(Manager.config), name: brandRepoName(Manager.config) };
+
+  // Setup Octokit
+  const octokit = new Octokit({
+    auth: env.get('GH_TOKEN'),
+  });
+
+  // Check for required values
+  if (!settings.path) {
+    return ctx.respond('Missing required parameter: path', { code: 400 });
+  }
+  if (!settings.content) {
+    return ctx.respond('Missing required parameter: content', { code: 400 });
+  }
+
+  // Fix other values
+  settings.type = settings.type;
+  // Always the brand's own repo — caller-supplied values would let a blogger-role
+  // user point the shared GH_TOKEN at any repo it can write
+  settings.githubUser = bemRepo.user;
+  settings.githubRepo = bemRepo.name;
+
+  ctx.log('main(): Creating file...', settings);
+
+  // Upload content
+  const uploadResult = await uploadContent(ctx, octokit, settings).catch(e => e);
+  if (uploadResult instanceof Error) {
+    return ctx.respond(uploadResult.message, { code: uploadResult.status || 500 });
+  }
+
+  ctx.log('main(): uploadContent', uploadResult);
+
+  // Track analytics
+  analytics.event('admin/repo/content', { action: 'write' });
+
+  return ctx.respond(settings);
+};
+
+// Helper: Upload content to GitHub
+async function uploadContent(ctx, octokit, settings) {
+  const owner = settings.githubUser;
+  const repo = settings.githubRepo;
+  const filename = settings.path;
+  const content = settings.content;
+
+  ctx.log('uploadContent(): filename', filename);
+
+  // Get existing file
+  const existing = await octokit.rest.repos.getContent({
+    owner: owner,
+    repo: repo,
+    path: filename,
+  }).catch(e => e);
+
+  ctx.log('uploadContent(): Existing', existing);
+
+  // Quit if error and it's DIFFERENT than 404
+  if (existing instanceof Error && existing?.status !== 404) {
+    throw existing;
+  }
+
+  // Upload content
+  const result = await octokit.rest.repos.createOrUpdateFileContents({
+    owner: owner,
+    repo: repo,
+    path: filename,
+    sha: existing?.data?.sha || undefined,
+    message: `📦 admin/repo/content ${filename}`,
+    content: Buffer.from(content).toString('base64'),
+  });
+
+  ctx.log('uploadContent(): Result', result);
+
+  return result;
+}

package/dist/manager/routes/admin/stats/get.js

@@ -0,0 +1,222 @@
+const _ = require('lodash');
+
+/**
+ * GET /admin/stats - Get application stats
+ * Admin-only endpoint to retrieve and optionally update app statistics
+ */
+module.exports = async ({ ctx, Manager, user, settings, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Require admin
+  if (!user.roles.admin) {
+    return ctx.respond('Admin required.', { code: 403 });
+  }
+
+  const stats = admin.firestore().doc('meta/stats');
+
+  // Get current stats
+  let doc = await stats.get().catch((e) => e);
+
+  if (doc instanceof Error) {
+    return ctx.respond(`Failed to get stats: ${doc.message}`, { code: 500 });
+  }
+
+  let data = doc.data() || {};
+
+  // Ensure document exists with initial values
+  if (!doc.exists) {
+    await stats.set({
+      users: { total: 0 },
+      brand: Manager.config?.brand?.id || null,
+    });
+    data = { users: { total: 0 } };
+  }
+
+  // Update stats if requested
+  if (settings.update) {
+    const error = await updateStats(ctx, data, settings.update);
+
+    if (error) {
+      return ctx.respond(error.message, { code: 500 });
+    }
+
+    // Retrieve stats again after updating
+    doc = await stats.get().catch((e) => e);
+
+    if (doc instanceof Error) {
+      return ctx.respond(`Failed to get stats: ${doc.message}`, { code: 500 });
+    }
+
+    data = doc.data() || {};
+  }
+
+  return ctx.respond(data);
+};
+
+async function updateStats(ctx, existingData, update) {
+  const Manager = ctx.Manager;
+  const { admin } = Manager.libraries;
+  const stats = admin.firestore().doc('meta/stats');
+  const newData = {
+    brand: Manager.config?.brand?.id || null,
+  };
+
+  ctx.log('updateStats(): Starting...');
+
+  let error = null;
+
+  // Update notification stats
+  if (update === true || update?.notifications) {
+    const count = await getAllNotifications(ctx).catch((e) => e);
+
+    if (count instanceof Error) {
+      error = new Error(`Failed getting notifications: ${count.message}`);
+    } else {
+      _.set(newData, 'notifications.total', count);
+    }
+  }
+
+  // Update subscription stats
+  if (!error && (update === true || update?.subscriptions)) {
+    const subscriptions = await getAllSubscriptions(ctx).catch((e) => e);
+
+    if (subscriptions instanceof Error) {
+      error = new Error(`Failed getting subscriptions: ${subscriptions.message}`);
+    } else {
+      _.set(newData, 'subscriptions', subscriptions);
+    }
+  }
+
+  // Update user stats
+  if (!error && (!existingData?.users?.total || update === true || update?.users)) {
+    const users = await getAllUsers(ctx).catch((e) => e);
+
+    if (users instanceof Error) {
+      error = new Error(`Failed getting users: ${users.message}`);
+    } else {
+      _.set(newData, 'users.total', users.length);
+    }
+  }
+
+  // Update online users
+  if (!error && (update === true || update?.online)) {
+    const online = await countOnlineUsers(ctx);
+
+    _.set(newData, 'users.online', online);
+  }
+
+  if (error) {
+    return error;
+  }
+
+  // Set metadata
+  newData.metadata = Manager.Metadata().set({ tag: 'admin/stats' });
+
+  ctx.log('updateStats(): newData', newData);
+
+  // Save stats
+  await stats.set(newData, { merge: true }).catch((e) => {
+    error = new Error(`Failed saving stats: ${e.message}`);
+  });
+
+  return error;
+}
+
+async function getAllUsers(ctx) {
+  const { admin } = ctx.Manager.libraries;
+
+  ctx.log('getAllUsers(): Starting...');
+
+  const users = [];
+  let nextPageToken;
+
+  do {
+    const result = await admin.auth().listUsers(1000, nextPageToken);
+    users.push(...result.users);
+    nextPageToken = result.pageToken;
+  } while (nextPageToken);
+
+  ctx.log(`getAllUsers(): Completed with ${users.length} users`);
+
+  return users;
+}
+
+async function getAllNotifications(ctx) {
+  const { admin } = ctx.Manager.libraries;
+
+  ctx.log('getAllNotifications(): Starting...');
+
+  const snap = await admin.firestore().collection('notifications').count().get();
+  const count = snap.data().count;
+
+  ctx.log(`getAllNotifications(): Completed with ${count} notifications`);
+
+  return count;
+}
+
+async function getAllSubscriptions(ctx) {
+  const { admin } = ctx.Manager.libraries;
+
+  ctx.log('getAllSubscriptions(): Starting...');
+
+  const snapshot = await admin.firestore().collection('users')
+    .where('subscription.expires.timestampUNIX', '>=', Date.now() / 1000)
+    .get();
+
+  const stats = {
+    totals: { total: 0, exempt: 0 },
+    plans: {},
+  };
+
+  snapshot.forEach((doc) => {
+    const data = doc.data();
+    const planId = data?.subscription?.product?.id || 'basic';
+    const frequency = data?.subscription?.payment?.frequency || 'unknown';
+    const isAdmin = data?.roles?.admin || false;
+    const isVip = data?.roles?.vip || false;
+
+    // Initialize plan
+    if (!stats.plans[planId]) {
+      stats.plans[planId] = { total: 0, monthly: 0, annually: 0, exempt: 0 };
+    }
+
+    // Count exempt users
+    if (isAdmin || isVip) {
+      stats.totals.exempt++;
+      stats.plans[planId].exempt++;
+      return;
+    }
+
+    // Count subscribers
+    stats.totals.total++;
+    stats.plans[planId].total++;
+    stats.plans[planId][frequency] = (stats.plans[planId][frequency] || 0) + 1;
+  });
+
+  ctx.log(`getAllSubscriptions(): Completed with ${stats.totals.total} subscriptions`, stats);
+
+  return stats;
+}
+
+async function countOnlineUsers(ctx) {
+  const { admin } = ctx.Manager.libraries;
+  let online = 0;
+
+  const paths = ['gatherings/online', 'sessions/app', 'sessions/online'];
+
+  for (const path of paths) {
+    const snap = await admin.database().ref(path).once('value').catch(() => null);
+
+    if (snap) {
+      const data = snap.val() || {};
+      online += Object.keys(data).length;
+    }
+  }
+
+  return online;
+}

package/dist/manager/routes/admin/users/disable/post.js

@@ -0,0 +1,50 @@
+/**
+ * POST /admin/users/disable - Disable or re-enable a user at the Firebase
+ * Auth level. Disabling blocks new sign-ins AND revokes refresh tokens so
+ * live sessions end at their next token refresh; `disabled: false` restores
+ * access. The flag is invisible to client SDKs — read it back through
+ * GET /admin/users/list (the auth join).
+ */
+module.exports = async ({ ctx, user, settings, analytics, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication (allow in dev)
+  if (!user.authenticated && ctx.isProduction()) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Require admin (allow in dev)
+  if (!user.roles.admin && ctx.isProduction()) {
+    return ctx.respond('Admin required.', { code: 403 });
+  }
+
+  const uid = String(settings.uid || '').trim();
+  const disabled = settings.disabled !== false;
+
+  if (!uid) {
+    return ctx.respond('uid is required', { code: 400 });
+  }
+
+  // An admin locking their own account out is never what anyone meant
+  if (disabled && uid === user.auth.uid) {
+    return ctx.respond('You cannot disable your own account.', { code: 400 });
+  }
+
+  const record = await admin.auth().updateUser(uid, { disabled }).catch((e) => e);
+
+  if (record instanceof Error) {
+    const code = record.code === 'auth/user-not-found' ? 404 : 500;
+    return ctx.respond(`Failed to update user: ${record.message}`, { code });
+  }
+
+  // Disabling alone lets existing sessions ride until token expiry — revoke
+  // refresh tokens so the account is actually out
+  if (disabled) {
+    await admin.auth().revokeRefreshTokens(uid).catch(() => null);
+  }
+
+  // Track analytics
+  analytics.event('admin/users/disable', { disabled });
+
+  return ctx.respond({ uid, disabled: record.disabled === true });
+};

package/dist/manager/routes/admin/users/list/get.js

@@ -0,0 +1,110 @@
+/**
+ * GET /admin/users/list - Paginated user directory with the AUTH-record join
+ * the client can never do itself (provider, disabled, email verification,
+ * last sign-in come from Firebase Auth, not Firestore). Powers the admin
+ * users table and the list_users MCP tool.
+ *
+ * Params (query):
+ *   limit      - page size (default 20, max 100)
+ *   search     - email/uid prefix filter (Firestore range scan on auth.email)
+ *   startAfter - uid cursor from the previous page's nextCursor
+ */
+module.exports = async ({ ctx, user, settings, analytics, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication (allow in dev)
+  if (!user.authenticated && ctx.isProduction()) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Require admin (allow in dev)
+  if (!user.roles.admin && ctx.isProduction()) {
+    return ctx.respond('Admin required.', { code: 403 });
+  }
+
+  const limit = Math.min(Math.max(parseInt(settings.limit, 10) || 20, 1), 100);
+  const search = String(settings.search || '').trim().toLowerCase();
+  const startAfter = String(settings.startAfter || '').trim();
+
+  // Build the Firestore page. Search is an email prefix range scan (the
+  // users schema stores auth.email lowercased); a bare uid search falls
+  // back to a direct doc read.
+  let query = admin.firestore().collection('users');
+
+  if (search) {
+    query = query
+      .orderBy('auth.email')
+      .startAt(search)
+      // upper bound carries the literal U+F8FF prefix-scan sentinel
+      .endAt(`${search}`);
+  } else {
+    query = query.orderBy('metadata.created.timestampUNIX', 'desc');
+  }
+
+  if (startAfter) {
+    const cursorDoc = await admin.firestore().doc(`users/${startAfter}`).get().catch(() => null);
+    if (cursorDoc && cursorDoc.exists) {
+      query = query.startAfter(cursorDoc);
+    }
+  }
+
+  const snapshot = await query.limit(limit).get().catch((e) => e);
+
+  if (snapshot instanceof Error) {
+    return ctx.respond(snapshot.message, { code: 500 });
+  }
+
+  let docs = snapshot.docs;
+
+  // A search that looks like a UID and matched nothing → try the direct doc
+  if (search && !docs.length && !search.includes('@')) {
+    const direct = await admin.firestore().doc(`users/${settings.search.trim()}`).get().catch(() => null);
+    if (direct && direct.exists) {
+      docs = [direct];
+    }
+  }
+
+  // Join the auth records in ONE batch call — this is the data the client
+  // SDK can't reach (disabled, providers, verification, last sign-in)
+  const identifiers = docs.map((doc) => ({ uid: doc.id }));
+  const authRecords = new Map();
+
+  if (identifiers.length) {
+    const authResult = await admin.auth().getUsers(identifiers).catch((e) => e);
+    if (!(authResult instanceof Error)) {
+      authResult.users.forEach((record) => authRecords.set(record.uid, record));
+    }
+  }
+
+  const users = docs.map((doc) => {
+    const data = doc.data() || {};
+    const auth = authRecords.get(doc.id) || null;
+
+    return {
+      uid: doc.id,
+      email: data.auth?.email || auth?.email || null,
+      created: data.metadata?.created?.timestamp || auth?.metadata?.creationTime || null,
+      plan: data.subscription?.product?.id || 'basic',
+      subscriptionStatus: data.subscription?.status || null,
+      roles: data.roles || {},
+      // The auth-record join
+      auth: auth
+        ? {
+          disabled: auth.disabled === true,
+          emailVerified: auth.emailVerified === true,
+          lastSignIn: auth.metadata?.lastSignInTime || null,
+          providers: (auth.providerData || []).map((p) => p.providerId),
+        }
+        : null,
+    };
+  });
+
+  // Track analytics
+  analytics.event('admin/users/list', { count: users.length, search: !!search });
+
+  return ctx.respond({
+    users,
+    count: users.length,
+    nextCursor: docs.length === limit ? docs[docs.length - 1].id : null,
+  });
+};

package/dist/manager/routes/admin/users/sync/post.js

@@ -0,0 +1,119 @@
+/**
+ * POST /admin/users/sync - Sync Firebase Auth users to Firestore
+ * Admin-only endpoint to synchronize user records
+ */
+const { merge } = require('lodash');
+
+module.exports = async ({ ctx, Manager, user, settings, analytics, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication (allow in dev)
+  if (!user.authenticated && ctx.isProduction()) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Require admin (allow in dev)
+  if (!user.roles.admin && ctx.isProduction()) {
+    return ctx.respond('Admin required.', { code: 403 });
+  }
+
+  // Get lastPageToken from meta/stats
+  const metaDoc = await admin.firestore().doc('meta/stats').get().catch(e => e);
+
+  if (metaDoc instanceof Error) {
+    return ctx.respond(metaDoc.message, { code: 500 });
+  }
+
+  const metaData = metaDoc.data() || {};
+  const lastPageToken = metaData?.syncUsers?.lastPageToken;
+  let processedUsers = 0;
+
+  ctx.log(`Running sync-users based on lastPageToken: ${lastPageToken}`);
+
+  // List firebase auth users
+  await Manager.Utilities().iterateUsers(
+    async (batch, index) => {
+      // Process user function
+      async function processUser(authUser, i) {
+        const account = authUser.toJSON();
+        const uid = account.uid;
+        const email = account.email;
+        const created = new Date(account.metadata.creationTime);
+        const activity = new Date(account.metadata.lastSignInTime);
+        const isAnonymous = account.providerData.length === 0;
+
+        // Skip anonymous users
+        if (isAnonymous) {
+          return;
+        }
+
+        // Get existing user data
+        const userDoc = await admin.firestore().doc(`users/${uid}`).get().catch(() => null);
+        const userData = userDoc?.data() || {};
+
+        // Build new user object
+        const newUser = Manager.User({
+          auth: {
+            uid: uid,
+            email: email,
+          },
+          metadata: {
+            created: {
+              timestamp: created.toISOString(),
+              timestampUNIX: Math.floor(created.getTime() / 1000),
+            },
+            updated: {
+              timestamp: activity.toISOString(),
+              timestampUNIX: Math.floor(activity.getTime() / 1000),
+            },
+          }
+        });
+
+        const finalData = merge(newUser.properties, userData);
+
+        // Set metadata
+        finalData.metadata = Manager.Metadata().set({ tag: 'admin/users/sync' });
+
+        // Save to database
+        await admin.firestore().doc(`users/${uid}`)
+          .set(finalData, { merge: true })
+          .then(() => {
+            ctx.log(`Synched user: ${uid}`);
+            processedUsers++;
+          })
+          .catch(e => {
+            ctx.error(`Failed to sync user: ${uid}`, e);
+          });
+      }
+
+      // Process each user in batch
+      for (let i = 0; i < batch.users.length; i++) {
+        await processUser(batch.users[i], i);
+      }
+
+      // Save pageToken for resume
+      if (batch.pageToken) {
+        await admin.firestore().doc('meta/stats')
+          .set({
+            syncUsers: {
+              lastPageToken: batch.pageToken,
+            }
+          }, { merge: true })
+          .then(() => {
+            ctx.log(`Saved lastPageToken: ${batch.pageToken}`);
+          })
+          .catch(e => {
+            ctx.error('Failed to update lastPageToken', e);
+          });
+      }
+    },
+    { batchSize: 10, log: true, pageToken: lastPageToken }
+  );
+
+  ctx.log(`Processed ${processedUsers} users.`);
+
+  // Track analytics
+  analytics.event('admin/users/sync', { processed: processedUsers });
+
+  return ctx.respond({ processed: processedUsers });
+};

package/dist/manager/routes/brand/get.js

@@ -0,0 +1,26 @@
+/**
+ * GET /brand - Public brand configuration
+ * Returns a safe subset of the project's config (no secrets)
+ */
+module.exports = async ({ ctx, Manager }) => {
+  const config = Manager.config;
+
+  return ctx.respond(buildPublicConfig(config));
+};
+
+/**
+ * Build a public-safe config object from Manager.config
+ * Excludes sensitive fields: monitoring, analytics, blog, etc.
+ */
+function buildPublicConfig(config) {
+  return {
+    brand: config.brand || {},
+    repo: config.repo || {},
+    connections: config.connections || {},
+    payment: config.payment || {},
+    cloud: config.cloud || {},
+    reviews: config.reviews || {},
+  };
+}
+
+module.exports.buildPublicConfig = buildPublicConfig;