@omega.js/backend 0.1.0

package/dist/manager/routes/user/data-request/delete.js

@@ -0,0 +1,84 @@
+/**
+ * DELETE /user/data-request - Cancel a pending data request
+ * Deletes the most recent pending data request for the authenticated user.
+ */
+module.exports = async ({ ctx, user, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  const uid = user.auth.uid;
+
+  // Get the most recent request
+  const mostRecentSnapshot = await admin.firestore()
+    .collection('data-requests')
+    .where('owner', '==', uid)
+    .orderBy('metadata.created.timestampUNIX', 'desc')
+    .limit(1)
+    .get();
+
+  if (mostRecentSnapshot.empty || mostRecentSnapshot.docs[0].data().status !== 'pending') {
+    return ctx.respond('No pending data request found.', { code: 404 });
+  }
+
+  const requestDoc = mostRecentSnapshot.docs[0];
+  const request = requestDoc.data();
+
+  // Delete the request document
+  await admin.firestore().doc(`data-requests/${requestDoc.id}`).delete();
+
+  ctx.log(`Data request cancelled: ${requestDoc.id} for user ${uid}`);
+
+  // Send cancellation email (fire-and-forget)
+  sendCancellationEmail(ctx, user, requestDoc.id);
+
+  return ctx.respond({
+    message: 'Your data request has been cancelled.',
+    request: { id: requestDoc.id, ...request },
+  });
+};
+
+/**
+ * Send data request cancellation email (fire-and-forget)
+ */
+function sendCancellationEmail(ctx, user, requestId) {
+  const Manager = ctx.Manager;
+  const mailer = Manager.Email(ctx);
+  const uid = user.auth.uid;
+  const firstName = user.personal?.name?.first;
+  const greeting = firstName ? `Hey ${firstName}, your` : 'Your';
+
+  mailer.send({
+    to: user,
+    sender: 'account',
+    categories: ['account/data-request-cancelled'],
+    subject: `Your data request has been cancelled #${requestId}`,
+    template: 'card',
+    copy: true,
+    data: {
+      email: {
+        preview: `Your data export request #${requestId} has been cancelled.`,
+      },
+      content: {
+        title: 'Data Request Cancelled',
+        message: `${greeting} data export request has been cancelled as requested.
+
+- **Request reference:** #${requestId}
+- **Account UID:** ${uid}
+
+You may submit a new data request at any time from your account page.
+
+If you did not cancel this request, please contact us immediately by replying to this email.`,
+      },
+    },
+  })
+    .then((result) => {
+      ctx.log(`sendCancellationEmail(): Success, status=${result.status}`);
+    })
+    .catch((e) => {
+      ctx.error(`sendCancellationEmail(): Failed: ${e.message}`);
+    });
+}

package/dist/manager/routes/user/data-request/get.js

@@ -0,0 +1,229 @@
+/**
+ * GET /user/data-request - Check data request status or download data
+ *
+ * action=status (default): Returns the most recent request with its stored status.
+ * action=download: Compiles user data live and returns it. Only works when status is 'completed'.
+ *
+ * Statuses:
+ *   pending   — request submitted, waiting to be processed (omega_cronDaily sets to 'completed' after 14 days)
+ *   completed — data is available for download (downloads counter tracks how many times downloaded)
+ */
+module.exports = async ({ ctx, Manager, user, settings, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  const uid = user.auth.uid;
+
+  // Get the most recent request
+  const requestsSnapshot = await admin.firestore()
+    .collection('data-requests')
+    .where('owner', '==', uid)
+    .orderBy('metadata.created.timestampUNIX', 'desc')
+    .limit(1)
+    .get();
+
+  if (requestsSnapshot.empty) {
+    return ctx.respond({ request: null });
+  }
+
+  const requestDoc = requestsSnapshot.docs[0];
+  const request = requestDoc.data();
+  const requestId = requestDoc.id;
+
+  const status = request.status;
+
+  // Status check — return the doc as-is
+  if (settings.action !== 'download') {
+    return ctx.respond({
+      request: { id: requestId, ...request },
+    });
+  }
+
+  // Download action — only allowed when status is 'completed'
+  if (status !== 'completed') {
+    return ctx.respond('Your data request is still being processed. Please check back later.', { code: 400 });
+  }
+
+  // Build query list: @omega.js/backend defaults + project-specific queries from config
+  const defaultQueries = [
+    { path: 'users/{uid}', redact: ['api.privateKey'] },
+    { collection: 'data-requests', where: [['owner', '==', '{uid}']] },
+    { collection: 'payments-intents', where: [['owner', '==', '{uid}']] },
+    { collection: 'payments-orders', where: [['owner', '==', '{uid}']] },
+  ];
+  const customQueries = Manager.config.dataRequest?.queries || [];
+  const allQueries = defaultQueries.concat(customQueries);
+
+  // Execute all queries in parallel (+ auth record)
+  const queryPromises = allQueries.map(q => {
+    if (q.path) {
+      // Single document fetch
+      const resolvedPath = q.path.replace('{uid}', uid);
+      return admin.firestore().doc(resolvedPath).get();
+    }
+
+    // Collection query
+    let ref = admin.firestore().collection(q.collection);
+
+    for (const [field, op, value] of q.where) {
+      ref = ref.where(field, op, value === '{uid}' ? uid : value);
+    }
+
+    return ref.get();
+  });
+
+  const results = await Promise.all([
+    ...queryPromises,
+    admin.auth().getUser(uid).catch(() => null),
+  ]);
+
+  // Compile data from results
+  const authRecordResult = results.pop();
+  const data = {
+    exportedAt: ctx.meta.startTime.timestamp,
+    authRecord: null,
+  };
+
+  // Process query results
+  allQueries.forEach((q, i) => {
+    const result = results[i];
+
+    if (q.path) {
+      // Single document
+      const key = q.path.split('/')[0];
+      if (!result.exists) {
+        data[key] = null;
+        return;
+      }
+
+      const docData = result.data();
+
+      // Redact sensitive fields
+      if (q.redact) {
+        for (const fieldPath of q.redact) {
+          const parts = fieldPath.split('.');
+          let obj = docData;
+
+          for (let j = 0; j < parts.length - 1; j++) {
+            obj = obj?.[parts[j]];
+          }
+
+          if (obj) {
+            delete obj[parts[parts.length - 1]];
+          }
+        }
+      }
+
+      data[key] = docData;
+      return;
+    }
+
+    // Collection query
+    const docs = [];
+
+    result.forEach(doc => {
+      docs.push({ id: doc.id, ...doc.data() });
+    });
+
+    data[q.collection] = docs;
+  });
+
+  // Auth record (always included)
+  if (authRecordResult) {
+    data.authRecord = {
+      uid: authRecordResult.uid,
+      email: authRecordResult.email,
+      emailVerified: authRecordResult.emailVerified,
+      displayName: authRecordResult.displayName,
+      photoURL: authRecordResult.photoURL,
+      phoneNumber: authRecordResult.phoneNumber,
+      disabled: authRecordResult.disabled,
+      creationTime: authRecordResult.metadata.creationTime,
+      lastSignInTime: authRecordResult.metadata.lastSignInTime,
+      providerData: (authRecordResult.providerData || []).map(p => ({
+        providerId: p.providerId,
+        uid: p.uid,
+        displayName: p.displayName,
+        email: p.email,
+        photoURL: p.photoURL,
+      })),
+    };
+  } else {
+    data.authRecord = { error: 'Unable to retrieve auth record' };
+  }
+
+  // Increment downloads counter + set completed timestamp on first download
+  const updateData = {
+    downloads: admin.firestore.FieldValue.increment(1),
+  };
+
+  if (!request.metadata.completed?.timestampUNIX) {
+    updateData['metadata.completed.timestamp'] = ctx.meta.startTime.timestamp;
+    updateData['metadata.completed.timestampUNIX'] = ctx.meta.startTime.timestampUNIX;
+  }
+
+  await admin.firestore()
+    .doc(`data-requests/${requestId}`)
+    .update(updateData);
+
+  const downloads = (request.downloads || 0) + 1;
+
+  ctx.log(`Data request ${requestId} downloaded by user ${uid} (download #${downloads})`);
+
+  // Send download confirmation email (fire-and-forget)
+  sendDownloadEmail(ctx, user, requestId, downloads);
+
+  return ctx.respond({
+    request: { id: requestId, ...request, downloads: downloads },
+    data: data,
+  });
+};
+
+/**
+ * Send data download confirmation email (fire-and-forget)
+ */
+function sendDownloadEmail(ctx, user, requestId, downloads) {
+  const Manager = ctx.Manager;
+  const mailer = Manager.Email(ctx);
+  const uid = user.auth.uid;
+  const firstName = user.personal?.name?.first;
+  const greeting = firstName ? `Hey ${firstName}, your` : 'Your';
+  const downloadDate = ctx.meta.startTime.timestamp;
+
+  mailer.send({
+    to: user,
+    sender: 'account',
+    categories: ['account/data-request-download'],
+    subject: `Your data has been downloaded #${requestId}`,
+    template: 'card',
+    copy: true,
+    data: {
+      email: {
+        preview: `Your personal data export was downloaded on ${downloadDate}.`,
+      },
+      content: {
+        title: 'Data Download Confirmation',
+        message: `${greeting} personal data export has been successfully downloaded.
+
+**Download details:**
+
+- **Date:** ${downloadDate}
+- **Download #:** ${downloads}
+- **Request reference:** #${requestId}
+- **Account UID:** ${uid}
+
+If you did not initiate this download, please secure your account immediately and contact us by replying to this email.`,
+      },
+    },
+  })
+    .then((result) => {
+      ctx.log(`sendDownloadEmail(): Success, status=${result.status}`);
+    })
+    .catch((e) => {
+      ctx.error(`sendDownloadEmail(): Failed: ${e.message}`);
+    });
+}

package/dist/manager/routes/user/data-request/post.js

@@ -0,0 +1,136 @@
+/**
+ * POST /user/data-request - Create a new GDPR data request
+ * Creates a pending data request record for the authenticated user.
+ */
+const uuidv4 = require('uuid').v4;
+
+module.exports = async ({ ctx, Manager, user, settings, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Require confirmation
+  if (!settings.confirmed) {
+    return ctx.respond('You must confirm the data request acknowledgments.', { code: 400 });
+  }
+
+  const uid = user.auth.uid;
+
+  // Sanitize reason — strip HTML tags and trim
+  const reason = (settings.reason || '').replace(/<[^>]*>/g, '').trim().substring(0, 500);
+
+  // Get the most recent request
+  const mostRecentSnapshot = await admin.firestore()
+    .collection('data-requests')
+    .where('owner', '==', uid)
+    .orderBy('metadata.created.timestampUNIX', 'desc')
+    .limit(1)
+    .get();
+
+  if (!mostRecentSnapshot.empty) {
+    const mostRecent = mostRecentSnapshot.docs[0].data();
+
+    // Reject if there's already a pending request
+    if (mostRecent.status === 'pending') {
+      return ctx.respond('You already have a pending data request. Please wait for it to be processed.', { code: 409 });
+    }
+
+    // Reject if last request was created within 30 days (cooldown)
+    const THIRTY_DAYS = 30 * 24 * 60 * 60;
+    const elapsedSeconds = Math.round(Date.now() / 1000) - mostRecent.metadata.created.timestampUNIX;
+
+    if (elapsedSeconds < THIRTY_DAYS) {
+      return ctx.respond('You have already received a data export within the last 30 days. Please try again later.', { code: 429 });
+    }
+  }
+
+  // Create the request document
+  const requestId = uuidv4();
+  const now = ctx.meta.startTime.timestamp;
+  const nowUNIX = ctx.meta.startTime.timestampUNIX;
+
+  const docData = {
+    status: 'pending',
+    reason: reason,
+    downloads: 0,
+    owner: uid,
+    metadata: {
+      ...Manager.Metadata().set({ tag: 'user/data-request' }),
+      created: {
+        timestamp: now,
+        timestampUNIX: nowUNIX,
+      },
+      completed: {
+        timestamp: null,
+        timestampUNIX: 0,
+      },
+    },
+  };
+
+  await admin.firestore()
+    .doc(`data-requests/${requestId}`)
+    .set(docData, { merge: true });
+
+  ctx.log(`Data request created: ${requestId} for user ${uid}`);
+
+  // Send confirmation email (fire-and-forget)
+  sendConfirmationEmail(ctx, user, requestId, reason);
+
+  return ctx.respond({
+    request: { id: requestId, ...docData },
+  });
+};
+
+/**
+ * Send data request confirmation email (fire-and-forget)
+ */
+function sendConfirmationEmail(ctx, user, requestId, reason) {
+  const Manager = ctx.Manager;
+  const mailer = Manager.Email(ctx);
+  const uid = user.auth.uid;
+  const firstName = user.personal?.name?.first;
+  const greeting = firstName ? `Hey ${firstName}, we've` : `We've`;
+  const reasonLine = reason
+    ? `\n\n**Reason provided:** ${reason}`
+    : '';
+
+  mailer.send({
+    to: user,
+    sender: 'account',
+    categories: ['account/data-request'],
+    subject: `Your data request has been received #${requestId}`,
+    template: 'card',
+    copy: true,
+    data: {
+      email: {
+        preview: `We've received your data export request. Your data will be available for download within 14 business days.`,
+      },
+      content: {
+        title: 'Data Request Received',
+        message: `${greeting} received your request for a copy of your personal data.${reasonLine}
+
+**What happens next:**
+
+- Your request is now being processed.
+- Processing takes up to **14 business days**.
+- Once ready, you must return to your **account page** to download your data. We will not send the data via email for security reasons.
+- Your data will be available as a JSON file download.
+- Only one request can be active at a time, and you may submit a new request once every 30 days.
+
+If you did not make this request, please contact us immediately by replying to this email.
+
+- **Reference:** #${requestId}
+- **Account UID:** ${uid}`,
+      },
+    },
+  })
+    .then((result) => {
+      ctx.log(`sendConfirmationEmail(): Success, status=${result.status}`);
+    })
+    .catch((e) => {
+      ctx.error(`sendConfirmationEmail(): Failed: ${e.message}`);
+    });
+}

package/dist/manager/routes/user/delete.js

@@ -0,0 +1,149 @@
+const fetch = require('wonderful-fetch');
+const env = require('../../libraries/env.js');
+
+/**
+ * DELETE /user - Delete user account
+ * Requires admin auth or self-deletion with admin override
+ */
+module.exports = async ({ ctx, Manager, user, settings, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Get target UID and reason
+  const uid = settings.uid;
+  const reason = (settings.reason || '').replace(/<[^>]*>/g, '').trim().substring(0, 500);
+
+  // Require admin to delete other users
+  if (uid !== user.auth.uid && !user.roles.admin) {
+    return ctx.respond('Admin required', { code: 403 });
+  }
+
+  // Fetch user to check subscription status
+  const userDoc = await admin.firestore().doc(`users/${uid}`).get();
+
+  if (!userDoc.exists) {
+    return ctx.respond('User not found', { code: 404 });
+  }
+
+  const userData = userDoc.data();
+
+  // Disallow deleting users with active or suspended paid subscriptions
+  const subStatus = userData?.subscription?.status;
+  const subId = userData?.subscription?.product?.id;
+  if (
+    (subStatus === 'active' || subStatus === 'suspended')
+    && subId !== 'basic'
+  ) {
+    return ctx.respond(
+      'This account cannot be deleted because it has a paid subscription attached to it. In order to delete the account, you must first cancel the paid subscription.',
+      { code: 400 }
+    );
+  }
+
+  // Sign out of all sessions first
+  ctx.log(`Signing out of all sessions for ${uid}...`);
+
+  await fetch(`${Manager.getApiUrl()}/omega/user/sessions`, {
+    method: 'delete',
+    timeout: 60000,
+    response: 'json',
+    tries: 2,
+    // NO `log: true`: wonderful-fetch prints its whole configuration, headers
+    // included, and this request's omega-admin-key header IS the live admin key
+    // ([#702](https://github.com/Omega-JS-Stack/omega/issues/702)).
+    headers: {
+      'omega-admin-key': env.get('OMEGA_ADMIN_KEY'),
+    },
+    body: {
+      uid,
+    },
+  })
+    .then((json) => {
+      ctx.log(`Sign out of all sessions success`, json);
+    })
+    .catch((e) => {
+      ctx.error(`Sign out of all sessions failed`, e);
+    });
+
+  // Get the user's email before deleting (for confirmation email)
+  const email = uid === user.auth.uid
+    ? user.auth.email
+    : await admin.auth().getUser(uid).then(r => r.email).catch(() => null);
+
+  // Delete the user
+  try {
+    await admin.auth().deleteUser(uid);
+  } catch (e) {
+    return ctx.respond(`Failed to delete user: ${e}`, { code: 500 });
+  }
+
+  ctx.log(`Account deleted: ${uid}${reason ? `, reason: ${reason}` : ''}`);
+
+  // Send confirmation email (fire-and-forget). No testing-mode gate — the mailer's
+  // own seam captures a testing send instead of delivering it
+  // ([#774](https://github.com/Omega-JS-Stack/omega/issues/774)).
+  if (email) {
+    sendConfirmationEmail(ctx, email, uid, reason, userData?.personal?.name?.first);
+  }
+
+  return ctx.respond({ success: true });
+};
+
+/**
+ * Send account deletion confirmation email (fire-and-forget)
+ */
+function sendConfirmationEmail(ctx, email, uid, reason, firstName) {
+  const Manager = ctx.Manager;
+  const brandName = Manager.config.brand.name;
+  const mailer = Manager.Email(ctx);
+  const greeting = firstName ? `Hey ${firstName}, your` : 'Your';
+  const reasonLine = reason
+    ? `\n\n**Reason provided:** ${reason}`
+    : '';
+  const deletionDate = new Date().toUTCString();
+
+  mailer.send({
+    to: email,
+    sender: 'account',
+    categories: ['account/delete'],
+    subject: `Your ${brandName} account has been deleted`,
+    template: 'card',
+    copy: true,
+    data: {
+      email: {
+        preview: `Your ${brandName} account has been permanently deleted. All associated data has been removed.`,
+      },
+      content: {
+        title: 'Account Deleted',
+        message: `${greeting} **${brandName}** account and all associated personal data have been permanently deleted from our systems. This action is irreversible.${reasonLine}
+
+**Deletion details:**
+
+- **Account email:** ${email}
+- **Account UID:** ${uid}
+- **Deletion date:** ${deletionDate}
+
+**What this means:**
+
+- Your account credentials and profile information have been removed.
+- Any pending data requests have been cancelled.
+- Subscription and billing records have been deleted.
+- You will no longer be able to sign in with this account.
+
+If you did not request this deletion, please contact us immediately by replying to this email.
+
+If you wish to use ${brandName} again in the future, you are welcome to create a new account at any time.`,
+      },
+    },
+  })
+    .then((result) => {
+      ctx.log(`sendConfirmationEmail(): Success, status=${result.status}`);
+    })
+    .catch((e) => {
+      ctx.error(`sendConfirmationEmail(): Failed: ${e.message}`);
+    });
+}

package/dist/manager/routes/user/feedback/post.js

@@ -0,0 +1,81 @@
+const pushid = require('pushid');
+const powertools = require('node-powertools');
+
+/**
+ * POST /user/feedback - Submit user feedback
+ * Saves feedback to Firestore and optionally prompts for review
+ */
+module.exports = async ({ ctx, Manager, user, settings, libraries }) => {
+  const { admin } = libraries;
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  const docId = pushid();
+
+  // Preprocess decision
+  const decision = {
+    promptReview: false,
+    reviewURL: null,
+  };
+
+  // Prompt for review if user gave positive rating (like/love) and wrote meaningful positive feedback (50+ chars)
+  const totalPositiveLength = (settings.positive?.length || 0) + (settings.comments?.length || 0);
+  if (
+    ['like', 'love'].includes(settings.rating)
+    && totalPositiveLength >= 50
+  ) {
+    decision.promptReview = true;
+  }
+
+  // Get review config from local config
+  const reviews = { ...(Manager.config.reviews || {}) };
+  reviews.enabled = typeof reviews.enabled === 'undefined' ? true : reviews.enabled;
+  reviews.sites = reviews.sites || [];
+
+  // If reviews are enabled and there are review sites, build the full review URL
+  if (decision.promptReview && reviews.enabled && reviews.sites.length > 0) {
+    const site = powertools.random(reviews.sites);
+    const brandDomain = new URL(Manager.config.brand.url).hostname;
+
+    decision.reviewURL = `https://www.${site}/review/${brandDomain}`;
+  } else {
+    decision.promptReview = false;
+  }
+
+  ctx.log('Feedback submitted', docId, { appReviewData: reviews, settings, decision });
+
+  // Save feedback to Firestore
+  const write = await admin.firestore().doc(`feedback/${docId}`)
+    .set({
+      feedback: {
+        rating: settings.rating,
+        positive: settings.positive,
+        negative: settings.negative,
+        comments: settings.comments,
+      },
+      decision: decision,
+      owner: user?.auth?.uid ?? null,
+      metadata: {
+        ...Manager.Metadata().set({ tag: 'user/feedback' }),
+        created: ctx.meta.startTime,
+      },
+    }, { merge: true })
+    .catch((e) => e);
+
+  if (write instanceof Error) {
+    return ctx.respond(`Failed to save feedback: ${write.message}`, { code: 500 });
+  }
+
+  return ctx.respond({
+    review: decision,
+    originalRequest: {
+      rating: settings.rating,
+      positive: settings.positive,
+      negative: settings.negative,
+      comments: settings.comments,
+    },
+  });
+};

package/dist/manager/routes/user/get.js

@@ -0,0 +1,14 @@
+/**
+ * GET /user - Resolve user account info
+ * Returns the full resolved user object for authenticated users
+ */
+module.exports = async ({ ctx, user }) => {
+
+  // Require authentication
+  if (!user.authenticated) {
+    return ctx.respond('Authentication required', { code: 401 });
+  }
+
+  // Return full resolved user object
+  return ctx.respond({ user });
+};