@panguard-ai/panguard-auth 0.1.0

package/dist/routes/billing.js

@@ -0,0 +1,176 @@
+/**
+ * Billing (Lemon Squeezy) route handlers:
+ * handleBillingWebhook, handleBillingCheckout, handleBillingPortal, handleBillingStatus.
+ * @module @panguard-ai/panguard-auth/routes/billing
+ */
+import { authenticateRequest } from '../middleware.js';
+import { verifyWebhookSignature, handleWebhookEvent, createCheckoutUrl, getCustomerPortalUrl, } from '../lemonsqueezy.js';
+import { readBody, readRawBody, json } from './shared.js';
+export function createBillingRoutes(ctx) {
+    const { db, config } = ctx;
+    /**
+     * POST /api/billing/webhook
+     * Receives Lemon Squeezy webhook events. Verifies HMAC signature.
+     */
+    async function handleBillingWebhook(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        if (!config.lemonsqueezy) {
+            json(res, 501, { ok: false, error: 'Billing not configured' });
+            return;
+        }
+        const rawResult = await readRawBody(req);
+        if (!rawResult.ok) {
+            json(res, rawResult.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        // Verify HMAC signature
+        const signature = req.headers['x-signature'];
+        if (!signature ||
+            !verifyWebhookSignature(rawResult.raw, signature, config.lemonsqueezy.webhookSecret)) {
+            json(res, 401, { ok: false, error: 'Invalid webhook signature' });
+            return;
+        }
+        let payload;
+        try {
+            payload = JSON.parse(rawResult.raw);
+        }
+        catch {
+            json(res, 400, { ok: false, error: 'Invalid JSON' });
+            return;
+        }
+        const result = handleWebhookEvent(payload, config.lemonsqueezy, db);
+        // Always return 200 to prevent Lemon Squeezy from retrying
+        json(res, 200, { ok: true, data: result });
+    }
+    /**
+     * POST /api/billing/checkout
+     * Creates a checkout URL for the authenticated user.
+     * Body: { variantId: string } or { tier: string }
+     * When `tier` is provided, the server resolves it to a variant ID via variantTierMap.
+     */
+    async function handleBillingCheckout(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        if (!config.lemonsqueezy) {
+            json(res, 501, { ok: false, error: 'Billing not configured' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const body = await readBody(req);
+        if (!body.ok) {
+            json(res, body.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        let resolvedVariantId;
+        // Accept variantId directly
+        if (typeof body.data['variantId'] === 'string' &&
+            body.data['variantId'].length > 0) {
+            resolvedVariantId = body.data['variantId'];
+        }
+        // Or resolve from tier name
+        else if (typeof body.data['tier'] === 'string' && body.data['tier'].length > 0) {
+            const tierMap = config.lemonsqueezy.variantTierMap;
+            // Reverse lookup: find variant ID for this tier
+            const entry = Object.entries(tierMap).find(([, t]) => t === body.data['tier']);
+            if (!entry) {
+                json(res, 400, {
+                    ok: false,
+                    error: `No variant configured for tier: ${body.data['tier']}`,
+                });
+                return;
+            }
+            resolvedVariantId = entry[0];
+        }
+        if (!resolvedVariantId) {
+            json(res, 400, { ok: false, error: 'variantId or tier is required' });
+            return;
+        }
+        const checkoutUrl = await createCheckoutUrl(config.lemonsqueezy, resolvedVariantId, {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+        });
+        if (!checkoutUrl) {
+            json(res, 502, { ok: false, error: 'Failed to create checkout session' });
+            return;
+        }
+        json(res, 200, { ok: true, data: { url: checkoutUrl } });
+    }
+    /**
+     * GET /api/billing/portal
+     * Returns the customer portal URL for the authenticated user.
+     */
+    async function handleBillingPortal(req, res) {
+        if (req.method !== 'GET') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        if (!config.lemonsqueezy) {
+            json(res, 501, { ok: false, error: 'Billing not configured' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const subscription = db.getActiveSubscription(user.id);
+        if (!subscription?.lsSubscriptionId) {
+            json(res, 404, { ok: false, error: 'No active subscription found' });
+            return;
+        }
+        const portalUrl = await getCustomerPortalUrl(config.lemonsqueezy, subscription.lsSubscriptionId);
+        if (!portalUrl) {
+            json(res, 502, { ok: false, error: 'Failed to get portal URL' });
+            return;
+        }
+        json(res, 200, { ok: true, data: { url: portalUrl } });
+    }
+    /**
+     * GET /api/billing/status
+     * Returns the current subscription status for the authenticated user.
+     */
+    function handleBillingStatus(req, res) {
+        if (req.method !== 'GET') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const subscription = db.getActiveSubscription(user.id);
+        json(res, 200, {
+            ok: true,
+            data: {
+                tier: user.tier,
+                planExpiresAt: user.planExpiresAt,
+                subscription: subscription
+                    ? {
+                        status: subscription.status,
+                        tier: subscription.tier,
+                        renewsAt: subscription.renewsAt,
+                        endsAt: subscription.endsAt,
+                    }
+                    : null,
+            },
+        });
+    }
+    return {
+        handleBillingWebhook,
+        handleBillingCheckout,
+        handleBillingPortal,
+        handleBillingStatus,
+    };
+}
+//# sourceMappingURL=billing.js.map

package/dist/routes/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/routes/billing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,GAAiB;IACnD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAE3B;;;OAGG;IACH,KAAK,UAAU,oBAAoB,CAAC,GAAoB,EAAE,GAAmB;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAuB,CAAC;QACnE,IACE,CAAC,SAAS;YACV,CAAC,sBAAsB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,EACpF,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,OAGH,CAAC;QACF,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAEpE,2DAA2D;QAC3D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,qBAAqB,CAAC,GAAoB,EAAE,GAAmB;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,iBAAqC,CAAC;QAE1C,4BAA4B;QAC5B,IACE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ;YACzC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAY,CAAC,MAAM,GAAG,CAAC,EAC7C,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC;QACvD,CAAC;QACD,4BAA4B;aACvB,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC;YACnD,gDAAgD;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,mCAAmC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;iBAC9D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE;YAClF,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,mBAAmB,CAAC,GAAoB,EAAE,GAAmB;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,MAAM,CAAC,YAAY,EACnB,YAAY,CAAC,gBAAgB,CAC9B,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAAC,GAAoB,EAAE,GAAmB;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,YAAY,EAAE,YAAY;oBACxB,CAAC,CAAC;wBACE,MAAM,EAAE,YAAY,CAAC,MAAM;wBAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;wBACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,MAAM,EAAE,YAAY,CAAC,MAAM;qBAC5B;oBACH,CAAC,CAAC,IAAI;aACT;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,qBAAqB;QACrB,mBAAmB;QACnB,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/routes/index.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Auth route handler factory.
+ * Creates all route handlers bound to a shared context (db, config, rate limiters, flow maps).
+ * @module @panguard-ai/panguard-auth/routes
+ */
+import type { AuthRouteConfig } from './shared.js';
+export type { AuthRouteConfig } from './shared.js';
+/**
+ * Create all auth route handlers bound to a database instance.
+ */
+export declare function createAuthHandlers(config: AuthRouteConfig): {
+    handleWaitlistJoin: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleWaitlistVerify: (req: import("http").IncomingMessage, res: import("http").ServerResponse, token: string) => void;
+    handleWaitlistStats: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleWaitlistList: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleRegister: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleLogin: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleLogout: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleMe: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleForgotPassword: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleResetPassword: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleGoogleAuth: (_req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleGoogleCallback: (req: import("http").IncomingMessage, res: import("http").ServerResponse, code: string, state: string | null) => Promise<void>;
+    handleOAuthExchange: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleCliAuth: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleCliExchange: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleAdminUsers: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminUpdateTier: (req: import("http").IncomingMessage, res: import("http").ServerResponse, userId: string) => Promise<void>;
+    handleAdminUpdateRole: (req: import("http").IncomingMessage, res: import("http").ServerResponse, userId: string) => Promise<void>;
+    handleAdminStats: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminWaitlistApprove: (req: import("http").IncomingMessage, res: import("http").ServerResponse, entryId: string) => Promise<void>;
+    handleAdminWaitlistReject: (req: import("http").IncomingMessage, res: import("http").ServerResponse, entryId: string) => Promise<void>;
+    handleAdminDashboard: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminUsersSearch: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminSessions: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminSessionRevoke: (req: import("http").IncomingMessage, res: import("http").ServerResponse, sessionId: string) => void;
+    handleAdminActivity: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminAuditLog: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminAuditActions: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminUsageOverview: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleAdminUsageUser: (req: import("http").IncomingMessage, res: import("http").ServerResponse, userId: string) => void;
+    handleAdminUserDetail: (req: import("http").IncomingMessage, res: import("http").ServerResponse, userId: string) => void;
+    handleAdminUserSuspend: (req: import("http").IncomingMessage, res: import("http").ServerResponse, userId: string) => Promise<void>;
+    handleAdminBulkAction: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleDeleteAccount: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleExportData: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleTotpSetup: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleTotpVerify: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleTotpDisable: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleTotpStatus: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleBillingWebhook: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleBillingCheckout: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleBillingPortal: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleBillingStatus: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleUsageSummary: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleUsageLimits: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => void;
+    handleUsageCheck: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+    handleUsageRecord: (req: import("http").IncomingMessage, res: import("http").ServerResponse) => Promise<void>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,aAAa,CAAC;AASjE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2HzD"}

package/dist/routes/index.js

@@ -0,0 +1,133 @@
+/**
+ * Auth route handler factory.
+ * Creates all route handlers bound to a shared context (db, config, rate limiters, flow maps).
+ * @module @panguard-ai/panguard-auth/routes
+ */
+import { ensureSheetHeaders } from '../google-sheets.js';
+import { RateLimiter } from '../rate-limiter.js';
+import { createAuthRoutes } from './auth.js';
+import { createOAuthRoutes } from './oauth.js';
+import { createTotpRoutes } from './totp.js';
+import { createBillingRoutes } from './billing.js';
+import { createAdminRoutes } from './admin.js';
+import { createWaitlistRoutes } from './waitlist.js';
+import { createUsageRoutes } from './usage.js';
+/**
+ * Create all auth route handlers bound to a database instance.
+ */
+export function createAuthHandlers(config) {
+    const { db } = config;
+    // Rate limiters
+    const loginLimiter = new RateLimiter({ windowMs: 15 * 60 * 1000, maxRequests: 10 });
+    const registerLimiter = new RateLimiter({ windowMs: 60 * 60 * 1000, maxRequests: 5 });
+    const resetLimiter = new RateLimiter({ windowMs: 15 * 60 * 1000, maxRequests: 5 });
+    const waitlistLimiter = new RateLimiter({ windowMs: 60 * 60 * 1000, maxRequests: 5 });
+    // Pending OAuth flows: state -> { codeVerifier, createdAt }
+    const pendingOAuthFlows = new Map();
+    // Pending CLI auth flows: state -> { callbackUrl, createdAt }
+    const pendingCliFlows = new Map();
+    // One-time OAuth exchange codes: code -> { sessionToken, expiresAt, createdAt }
+    const oauthExchangeCodes = new Map();
+    // Cleanup stale flows every 5 minutes
+    const oauthCleanupTimer = setInterval(() => {
+        const cutoff = Date.now() - 10 * 60 * 1000; // 10 min TTL
+        for (const [state, flow] of pendingOAuthFlows) {
+            if (flow.createdAt < cutoff)
+                pendingOAuthFlows.delete(state);
+        }
+        for (const [state, flow] of pendingCliFlows) {
+            if (flow.createdAt < cutoff)
+                pendingCliFlows.delete(state);
+        }
+        const codeCutoff = Date.now() - 5 * 60 * 1000; // 5 min TTL for exchange codes
+        for (const [code, data] of oauthExchangeCodes) {
+            if (data.createdAt < codeCutoff)
+                oauthExchangeCodes.delete(code);
+        }
+    }, 5 * 60 * 1000);
+    if (oauthCleanupTimer.unref)
+        oauthCleanupTimer.unref();
+    const ctx = {
+        db,
+        config,
+        loginLimiter,
+        registerLimiter,
+        resetLimiter,
+        waitlistLimiter,
+        pendingOAuthFlows,
+        pendingCliFlows,
+        oauthExchangeCodes,
+    };
+    // Init Google Sheets headers (best-effort, non-blocking)
+    if (config.sheets) {
+        ensureSheetHeaders(config.sheets).catch(() => {
+            // Best-effort header initialization
+        });
+    }
+    // Compose all handlers from sub-modules
+    const authHandlers = createAuthRoutes(ctx);
+    const oauthHandlers = createOAuthRoutes(ctx);
+    const totpHandlers = createTotpRoutes(ctx);
+    const billingHandlers = createBillingRoutes(ctx);
+    const adminHandlers = createAdminRoutes(ctx);
+    const waitlistHandlers = createWaitlistRoutes(ctx);
+    const usageHandlers = createUsageRoutes(ctx);
+    return {
+        // Waitlist
+        handleWaitlistJoin: waitlistHandlers.handleWaitlistJoin,
+        handleWaitlistVerify: waitlistHandlers.handleWaitlistVerify,
+        handleWaitlistStats: waitlistHandlers.handleWaitlistStats,
+        handleWaitlistList: waitlistHandlers.handleWaitlistList,
+        // Auth
+        handleRegister: authHandlers.handleRegister,
+        handleLogin: authHandlers.handleLogin,
+        handleLogout: authHandlers.handleLogout,
+        handleMe: authHandlers.handleMe,
+        handleForgotPassword: authHandlers.handleForgotPassword,
+        handleResetPassword: authHandlers.handleResetPassword,
+        // OAuth / CLI
+        handleGoogleAuth: oauthHandlers.handleGoogleAuth,
+        handleGoogleCallback: oauthHandlers.handleGoogleCallback,
+        handleOAuthExchange: oauthHandlers.handleOAuthExchange,
+        handleCliAuth: oauthHandlers.handleCliAuth,
+        handleCliExchange: oauthHandlers.handleCliExchange,
+        // Admin
+        handleAdminUsers: adminHandlers.handleAdminUsers,
+        handleAdminUpdateTier: adminHandlers.handleAdminUpdateTier,
+        handleAdminUpdateRole: adminHandlers.handleAdminUpdateRole,
+        handleAdminStats: adminHandlers.handleAdminStats,
+        handleAdminWaitlistApprove: waitlistHandlers.handleAdminWaitlistApprove,
+        handleAdminWaitlistReject: waitlistHandlers.handleAdminWaitlistReject,
+        handleAdminDashboard: adminHandlers.handleAdminDashboard,
+        handleAdminUsersSearch: adminHandlers.handleAdminUsersSearch,
+        handleAdminSessions: adminHandlers.handleAdminSessions,
+        handleAdminSessionRevoke: adminHandlers.handleAdminSessionRevoke,
+        handleAdminActivity: adminHandlers.handleAdminActivity,
+        handleAdminAuditLog: adminHandlers.handleAdminAuditLog,
+        handleAdminAuditActions: adminHandlers.handleAdminAuditActions,
+        handleAdminUsageOverview: adminHandlers.handleAdminUsageOverview,
+        handleAdminUsageUser: adminHandlers.handleAdminUsageUser,
+        handleAdminUserDetail: adminHandlers.handleAdminUserDetail,
+        handleAdminUserSuspend: adminHandlers.handleAdminUserSuspend,
+        handleAdminBulkAction: adminHandlers.handleAdminBulkAction,
+        // GDPR
+        handleDeleteAccount: authHandlers.handleDeleteAccount,
+        handleExportData: authHandlers.handleExportData,
+        // TOTP (2FA)
+        handleTotpSetup: totpHandlers.handleTotpSetup,
+        handleTotpVerify: totpHandlers.handleTotpVerify,
+        handleTotpDisable: totpHandlers.handleTotpDisable,
+        handleTotpStatus: totpHandlers.handleTotpStatus,
+        // Billing (Lemon Squeezy)
+        handleBillingWebhook: billingHandlers.handleBillingWebhook,
+        handleBillingCheckout: billingHandlers.handleBillingCheckout,
+        handleBillingPortal: billingHandlers.handleBillingPortal,
+        handleBillingStatus: billingHandlers.handleBillingStatus,
+        // Usage / Quota
+        handleUsageSummary: usageHandlers.handleUsageSummary,
+        handleUsageLimits: usageHandlers.handleUsageLimits,
+        handleUsageCheck: usageHandlers.handleUsageCheck,
+        handleUsageRecord: usageHandlers.handleUsageRecord,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/routes/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI/C;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;IAEtB,gBAAgB;IAChB,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,eAAe,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,MAAM,eAAe,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IAEtF,4DAA4D;IAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuD,CAAC;IACzF,8DAA8D;IAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsD,CAAC;IACtF,gFAAgF;IAChF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAC;IAEJ,sCAAsC;IACtC,MAAM,iBAAiB,GAAG,WAAW,CACnC,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;QACzD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM;gBAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM;gBAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,+BAA+B;QAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,SAAS,GAAG,UAAU;gBAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,EACD,CAAC,GAAG,EAAE,GAAG,IAAI,CACd,CAAC;IACF,IAAI,iBAAiB,CAAC,KAAK;QAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAEvD,MAAM,GAAG,GAAiB;QACxB,EAAE;QACF,MAAM;QACN,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,eAAe;QACf,iBAAiB;QACjB,eAAe;QACf,kBAAkB;KACnB,CAAC;IAEF,yDAAyD;IACzD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,oCAAoC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE7C,OAAO;QACL,WAAW;QACX,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,oBAAoB,EAAE,gBAAgB,CAAC,oBAAoB;QAC3D,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB;QACzD,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,OAAO;QACP,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,oBAAoB,EAAE,YAAY,CAAC,oBAAoB;QACvD,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,cAAc;QACd,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;QAChD,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;QACxD,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,QAAQ;QACR,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;QAChD,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;QAChD,0BAA0B,EAAE,gBAAgB,CAAC,0BAA0B;QACvE,yBAAyB,EAAE,gBAAgB,CAAC,yBAAyB;QACrE,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;QACxD,sBAAsB,EAAE,aAAa,CAAC,sBAAsB;QAC5D,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;QAChE,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,uBAAuB,EAAE,aAAa,CAAC,uBAAuB;QAC9D,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;QAChE,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;QACxD,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,sBAAsB,EAAE,aAAa,CAAC,sBAAsB;QAC5D,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,OAAO;QACP,mBAAmB,EAAE,YAAY,CAAC,mBAAmB;QACrD,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,aAAa;QACb,eAAe,EAAE,YAAY,CAAC,eAAe;QAC7C,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;QACjD,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,0BAA0B;QAC1B,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;QAC1D,qBAAqB,EAAE,eAAe,CAAC,qBAAqB;QAC5D,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;QACxD,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;QACxD,gBAAgB;QAChB,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;QACpD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;QAChD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC"}

package/dist/routes/oauth.d.ts

@@ -0,0 +1,15 @@
+/**
+ * OAuth and CLI authentication route handlers:
+ * handleGoogleAuth, handleGoogleCallback, handleOAuthExchange, handleCliAuth, handleCliExchange.
+ * @module @panguard-ai/panguard-auth/routes/oauth
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RouteContext } from './shared.js';
+export declare function createOAuthRoutes(ctx: RouteContext): {
+    handleGoogleAuth: (_req: IncomingMessage, res: ServerResponse) => void;
+    handleGoogleCallback: (req: IncomingMessage, res: ServerResponse, code: string, state: string | null) => Promise<void>;
+    handleOAuthExchange: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleCliAuth: (req: IncomingMessage, res: ServerResponse) => void;
+    handleCliExchange: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/routes/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAWjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY;6BAGjB,eAAe,OAAO,cAAc,KAAG,IAAI;gCAepE,eAAe,OACf,cAAc,QACb,MAAM,SACL,MAAM,GAAG,IAAI,KACnB,OAAO,CAAC,IAAI,CAAC;+BAsLwB,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;yBAlGhE,eAAe,OAAO,cAAc,KAAG,IAAI;6BAoCjC,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;EAsG3F"}

package/dist/routes/oauth.js

@@ -0,0 +1,215 @@
+/**
+ * OAuth and CLI authentication route handlers:
+ * handleGoogleAuth, handleGoogleCallback, handleOAuthExchange, handleCliAuth, handleCliExchange.
+ * @module @panguard-ai/panguard-auth/routes/oauth
+ */
+import { hashPassword, generateSessionToken, generateVerifyToken, sessionExpiry } from '../auth.js';
+import { authenticateRequest } from '../middleware.js';
+import { getGoogleAuthUrl, exchangeCodeForTokens, getGoogleUserInfo, generateCodeVerifier, generateCodeChallenge, generateOAuthState, } from '../google-oauth.js';
+import { readBody, json } from './shared.js';
+export function createOAuthRoutes(ctx) {
+    const { db, config, pendingOAuthFlows, pendingCliFlows, oauthExchangeCodes } = ctx;
+    function handleGoogleAuth(_req, res) {
+        if (!config.google) {
+            json(res, 501, { ok: false, error: 'Google OAuth not configured' });
+            return;
+        }
+        const state = generateOAuthState();
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+        pendingOAuthFlows.set(state, { codeVerifier, createdAt: Date.now() });
+        const url = getGoogleAuthUrl(config.google, state, codeChallenge);
+        res.writeHead(302, { Location: url });
+        res.end();
+    }
+    async function handleGoogleCallback(req, res, code, state) {
+        if (!config.google) {
+            json(res, 501, { ok: false, error: 'Google OAuth not configured' });
+            return;
+        }
+        // Validate state parameter (CSRF protection)
+        if (!state) {
+            json(res, 400, { ok: false, error: 'Missing state parameter' });
+            return;
+        }
+        const flow = pendingOAuthFlows.get(state);
+        if (!flow) {
+            json(res, 403, { ok: false, error: 'Invalid or expired OAuth state' });
+            return;
+        }
+        pendingOAuthFlows.delete(state);
+        try {
+            const tokens = await exchangeCodeForTokens(config.google, code, flow.codeVerifier);
+            const googleUser = await getGoogleUserInfo(tokens.access_token);
+            if (!googleUser.email) {
+                json(res, 400, { ok: false, error: 'No email from Google account' });
+                return;
+            }
+            if (!googleUser.email_verified) {
+                json(res, 403, { ok: false, error: 'Email not verified with Google' });
+                return;
+            }
+            // Find or create user
+            let user = db.getUserByEmail(googleUser.email);
+            if (!user) {
+                // Auto-create user from Google profile (random password since they use OAuth)
+                const randomPw = generateSessionToken(); // Not used for login, just to fill the field
+                const pwHash = await hashPassword(randomPw);
+                user = db.createUser({
+                    email: googleUser.email,
+                    name: googleUser.name || googleUser.email,
+                    password: randomPw,
+                }, pwHash);
+                // Activate 14-day Solo trial for new OAuth users
+                const trialExpiry = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000)
+                    .toISOString()
+                    .replace('T', ' ')
+                    .split('.')[0];
+                db.updateUserTier(user.id, 'solo', trialExpiry);
+                user = db.getUserById(user.id);
+            }
+            db.updateLastLogin(user.id);
+            const sessionToken = generateSessionToken();
+            const session = db.createSession(user.id, sessionToken, sessionExpiry());
+            // Use one-time exchange code instead of putting token in URL
+            const exchangeCode = generateVerifyToken(); // UUID v4
+            oauthExchangeCodes.set(exchangeCode, {
+                sessionToken,
+                expiresAt: session.expiresAt,
+                createdAt: Date.now(),
+            });
+            const baseUrl = config.baseUrl ?? '';
+            const redirectUrl = `${baseUrl}/login?code=${exchangeCode}`;
+            res.writeHead(302, { Location: redirectUrl });
+            res.end();
+        }
+        catch {
+            json(res, 500, {
+                ok: false,
+                error: 'Google OAuth failed',
+            });
+        }
+    }
+    /**
+     * GET /api/auth/cli
+     * Initiates CLI auth flow: validates callback URL and redirects to web login.
+     */
+    function handleCliAuth(req, res) {
+        const urlObj = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const callbackUrl = urlObj.searchParams.get('callback');
+        const state = urlObj.searchParams.get('state');
+        if (!callbackUrl || !state) {
+            json(res, 400, { ok: false, error: 'Missing callback or state parameter' });
+            return;
+        }
+        // Security: callback must be localhost
+        try {
+            const callbackParsed = new URL(callbackUrl);
+            if (!['localhost', '127.0.0.1', '[::1]'].includes(callbackParsed.hostname)) {
+                json(res, 400, { ok: false, error: 'Callback must be localhost' });
+                return;
+            }
+        }
+        catch {
+            json(res, 400, { ok: false, error: 'Invalid callback URL' });
+            return;
+        }
+        pendingCliFlows.set(state, { callbackUrl, createdAt: Date.now() });
+        // Redirect to web login page with cli_state
+        const baseUrl = config.baseUrl ?? '';
+        const loginUrl = `${baseUrl}/login?cli_state=${encodeURIComponent(state)}`;
+        res.writeHead(302, { Location: loginUrl });
+        res.end();
+    }
+    /**
+     * POST /api/auth/cli/exchange
+     * Exchanges a web session token for a long-lived CLI session.
+     * Returns the CLI callback redirect URL.
+     */
+    async function handleCliExchange(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const result = await readBody(req);
+        if (!result.ok) {
+            json(res, result.status, {
+                ok: false,
+                error: result.status === 413 ? 'Payload too large' : 'Invalid JSON body',
+            });
+            return;
+        }
+        const body = result.data;
+        const { token, state } = body;
+        if (typeof token !== 'string' || typeof state !== 'string') {
+            json(res, 400, { ok: false, error: 'Token and state are required' });
+            return;
+        }
+        // Validate web session
+        const user = authenticateRequest({ headers: { authorization: `Bearer ${token}` } }, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Invalid session token' });
+            return;
+        }
+        // Look up pending CLI flow
+        const flow = pendingCliFlows.get(state);
+        if (!flow) {
+            json(res, 403, { ok: false, error: 'Invalid or expired CLI state' });
+            return;
+        }
+        pendingCliFlows.delete(state);
+        // Create long-lived CLI session (30 days)
+        const cliToken = generateSessionToken();
+        const cliSession = db.createSession(user.id, cliToken, sessionExpiry(24 * 30));
+        // Build redirect URL back to CLI callback
+        const params = new URLSearchParams({
+            token: cliSession.token,
+            expires: cliSession.expiresAt,
+            email: user.email,
+            name: user.name,
+            tier: user.tier,
+            state,
+        });
+        const redirectUrl = `${flow.callbackUrl}?${params.toString()}`;
+        json(res, 200, { ok: true, data: { redirectUrl } });
+    }
+    /**
+     * POST /api/auth/oauth/exchange
+     * Exchange a one-time code for a session token (keeps tokens out of URLs).
+     */
+    async function handleOAuthExchange(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const body = await readBody(req);
+        if (!body.ok) {
+            json(res, body.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        const code = body.data['code'];
+        if (typeof code !== 'string' || !code) {
+            json(res, 400, { ok: false, error: 'code is required' });
+            return;
+        }
+        const data = oauthExchangeCodes.get(code);
+        if (!data) {
+            json(res, 400, { ok: false, error: 'Invalid or expired code' });
+            return;
+        }
+        // One-time use — delete immediately
+        oauthExchangeCodes.delete(code);
+        json(res, 200, {
+            ok: true,
+            data: { token: data.sessionToken, expiresAt: data.expiresAt },
+        });
+    }
+    return {
+        handleGoogleAuth,
+        handleGoogleCallback,
+        handleOAuthExchange,
+        handleCliAuth,
+        handleCliExchange,
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/routes/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,GAAiB;IACjD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,GAAG,CAAC;IAEnF,SAAS,gBAAgB,CAAC,IAAqB,EAAE,GAAmB;QAClE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAAY,EACZ,KAAoB;QAEpB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAEhE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YAED,sBAAsB;YACtB,IAAI,IAAI,GAAG,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,8EAA8E;gBAC9E,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC,CAAC,6CAA6C;gBACtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,GAAG,EAAE,CAAC,UAAU,CAClB;oBACE,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,EACD,MAAM,CACP,CAAC;gBAEF,iDAAiD;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;qBAChE,WAAW,EAAE;qBACb,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;qBACjB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBAClB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gBAChD,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC;YAClC,CAAC;YAED,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;YAEzE,6DAA6D;YAC7D,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC,CAAC,UAAU;YACtD,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;gBACnC,YAAY;gBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,GAAG,OAAO,eAAe,YAAY,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,qBAAqB;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/C,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEnE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,OAAO,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,GAAmB;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE;gBACvB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB;aACzE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAqB,EACpE,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE9B,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE/E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,SAAS;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;SACN,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAE/D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,mBAAmB,CAAC,GAAoB,EAAE,GAAmB;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB;QACnB,aAAa;QACb,iBAAiB;KAClB,CAAC;AACJ,CAAC"}