@payez/next-mvp 3.0.0

package/src/api-handlers/admin/sessions.ts

@@ -0,0 +1,320 @@
+/**
+ * Admin Sessions API Handler
+ *
+ * Provides admin-level access to login sessions using service account credentials.
+ * Used by SessionsTab component.
+ *
+ * @version 1.0
+ * @requires Admin role (vibe_app_admin or payez_admin)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { getStartupIDPConfig } from '../../lib/startup-init';
+import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+
+interface VibeRequestOptions {
+  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  body?: unknown;
+}
+
+/**
+ * Check if the current user has admin role
+ */
+async function checkAdminRole(getAuthOptions: () => Promise<any>): Promise<{ isAdmin: boolean; userId?: number; error?: NextResponse }> {
+  const authOptions = await getAuthOptions();
+  const session = await getServerSession(authOptions) as any;
+
+  if (!session?.user) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: 'Please sign in' },
+        { status: 401 }
+      ),
+    };
+  }
+
+  const userRoles = (session.user?.roles as string[]) || [];
+  const hasAdminRole = ADMIN_ROLES.some(role => userRoles.includes(role));
+
+  if (!hasAdminRole) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: 'Admin access required' },
+        { status: 403 }
+      ),
+    };
+  }
+
+  return { isAdmin: true, userId: session.user?.id };
+}
+
+/**
+ * Make a service account request to Vibe (admin mode)
+ */
+async function vibeServiceRequest<T = unknown>(
+  endpoint: string,
+  options: VibeRequestOptions
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+  const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
+  const clientId = process.env.VIBE_CLIENT_ID;
+  const signingKey = process.env.VIBE_HMAC_KEY;
+
+  if (!idpUrl || !clientId || !signingKey) {
+    return { ok: false, status: 500, data: null, error: 'Vibe not configured' };
+  }
+
+  const timestamp = Math.floor(Date.now() / 1000);
+  const stringToSign = `${timestamp}|${options.method}|${endpoint}`;
+
+  const crypto = await import('crypto');
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(signingKey, 'base64'))
+    .update(stringToSign)
+    .digest('base64');
+
+  const proxyUrl = `${idpUrl}/api/vibe/proxy`;
+
+  // Get the numeric client ID from startup config for multi-client admin support
+  const idpConfig = getStartupIDPConfig();
+  const numericClientId = idpConfig?.clientId;
+
+  try {
+    const res = await fetch(proxyUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Vibe-Client-Id': clientId,
+        'X-Vibe-Timestamp': String(timestamp),
+        'X-Vibe-Signature': signature,
+        ...(numericClientId && { 'X-Client-Id': String(numericClientId) }),
+      },
+      body: JSON.stringify({
+        endpoint,
+        method: options.method,
+        data: options.body ?? null,
+      }),
+      cache: 'no-store',
+    });
+
+    if (res.status === 204) {
+      return { ok: true, status: 204, data: null };
+    }
+
+    if (!res.ok) {
+      const errorText = await res.text();
+      return { ok: false, status: res.status, data: null, error: errorText };
+    }
+
+    const body = await res.json();
+    return { ok: true, status: res.status, data: body };
+  } catch (error) {
+    return { ok: false, status: 0, data: null, error: String(error) };
+  }
+}
+
+// Country code to flag emoji mapping
+function getCountryFlag(countryCode: string): string {
+  if (!countryCode || countryCode.length !== 2) return '';
+  const codePoints = countryCode
+    .toUpperCase()
+    .split('')
+    .map(char => 127397 + char.charCodeAt(0));
+  return String.fromCodePoint(...codePoints);
+}
+
+export interface AdminSessionsHandlerConfig {
+  getAuthOptions: () => Promise<any>;
+}
+
+/**
+ * GET /api/admin/sessions - List sessions
+ * POST /api/admin/sessions - Stats, revoke actions
+ */
+export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
+  return {
+    async GET(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const { searchParams } = new URL(request.url);
+      const status = searchParams.get('status');
+      const email = searchParams.get('email');
+
+      // Build query for login_sessions table
+      const queryBody: any = {
+        page: 1,
+        pageSize: 100,
+        orderBy: 'created_at',
+        orderDirection: 'desc',
+      };
+
+      // Build filter conditions
+      const conditions: any[] = [];
+      if (status && status !== 'all') {
+        conditions.push({ field: 'status', operator: 'eq', value: status });
+      }
+      if (email) {
+        conditions.push({ field: 'email', operator: 'like', value: `%${email}%` });
+      }
+
+      if (conditions.length === 1) {
+        queryBody.filter = conditions[0];
+      } else if (conditions.length > 1) {
+        queryBody.filter = { operator: 'and', conditions };
+      }
+
+      const result = await vibeServiceRequest<any>(
+        '/v1/collections/vibe_app/tables/login_sessions/query',
+        { method: 'POST', body: queryBody }
+      );
+
+      if (!result.ok) {
+        return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+      }
+
+      // Extract sessions from response
+      const rawSessions = result.data?.data || result.data?.documents || [];
+      const sessions = rawSessions.map((s: any) => ({
+        id: s.id || s.document_id,
+        idp_user_id: s.idp_user_id || s.user_id,
+        email: s.email || '',
+        name: s.name || s.display_name || '',
+        status: s.status || 'active',
+        ip_address: s.ip_address || s.ip,
+        city: s.city,
+        region: s.region,
+        country_code: s.country_code || s.country,
+        device_type: s.device_type || s.device,
+        browser: s.browser,
+        os: s.os,
+        created_at: s.created_at,
+        last_activity: s.last_activity || s.updated_at,
+        revoked_at: s.revoked_at,
+        revoked_by: s.revoked_by,
+        country_flag: getCountryFlag(s.country_code || s.country || ''),
+      }));
+
+      return NextResponse.json({ sessions });
+    },
+
+    async POST(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const body = await request.json();
+      const { action, sessionId, userId } = body;
+
+      if (action === 'stats') {
+        // Get all sessions for stats calculation
+        const result = await vibeServiceRequest<any>(
+          '/v1/collections/vibe_app/tables/login_sessions/query',
+          { method: 'POST', body: { page: 1, pageSize: 1000 } }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        }
+
+        const sessions = result.data?.data || result.data?.documents || [];
+
+        // Calculate stats
+        const now = new Date();
+        const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000);
+
+        const stats = {
+          totalActive: sessions.filter((s: any) => s.status === 'active').length,
+          totalRevoked: sessions.filter((s: any) => s.status === 'revoked').length,
+          uniqueUsers: new Set(sessions.map((s: any) => s.idp_user_id || s.user_id)).size,
+          recentLogins: sessions.filter((s: any) => new Date(s.created_at) > oneDayAgo).length,
+          byCountryWithFlags: {} as Record<string, { count: number; flag: string }>,
+          byDevice: {} as Record<string, number>,
+        };
+
+        // Count by country
+        sessions.forEach((s: any) => {
+          const country = s.country_code || s.country || 'Unknown';
+          if (!stats.byCountryWithFlags[country]) {
+            stats.byCountryWithFlags[country] = { count: 0, flag: getCountryFlag(country) };
+          }
+          stats.byCountryWithFlags[country].count++;
+
+          const device = s.device_type || s.device || 'Unknown';
+          stats.byDevice[device] = (stats.byDevice[device] || 0) + 1;
+        });
+
+        return NextResponse.json({ stats });
+      }
+
+      if (action === 'revoke' && sessionId) {
+        // Revoke single session
+        const result = await vibeServiceRequest<any>(
+          `/v1/collections/vibe_app/tables/login_sessions/${sessionId}`,
+          {
+            method: 'PUT',
+            body: {
+              status: 'revoked',
+              revoked_at: new Date().toISOString(),
+              revoked_by: `admin:${adminCheck.userId}`,
+            },
+          }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        }
+
+        return NextResponse.json({ success: true });
+      }
+
+      if (action === 'revoke_all' && userId) {
+        // Get all active sessions for user
+        const queryResult = await vibeServiceRequest<any>(
+          '/v1/collections/vibe_app/tables/login_sessions/query',
+          {
+            method: 'POST',
+            body: {
+              filter: {
+                operator: 'and',
+                conditions: [
+                  { field: 'idp_user_id', operator: 'eq', value: userId },
+                  { field: 'status', operator: 'eq', value: 'active' },
+                ],
+              },
+            },
+          }
+        );
+
+        if (!queryResult.ok) {
+          return NextResponse.json({ error: queryResult.error }, { status: queryResult.status || 500 });
+        }
+
+        const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+        let revokedCount = 0;
+
+        // Revoke each session
+        for (const session of sessions) {
+          const id = session.id || session.document_id;
+          const result = await vibeServiceRequest<any>(
+            `/v1/collections/vibe_app/tables/login_sessions/${id}`,
+            {
+              method: 'PUT',
+              body: {
+                status: 'revoked',
+                revoked_at: new Date().toISOString(),
+                revoked_by: `admin:${adminCheck.userId}`,
+              },
+            }
+          );
+          if (result.ok) revokedCount++;
+        }
+
+        return NextResponse.json({ success: true, revokedCount });
+      }
+
+      return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+    },
+  };
+}

package/src/api-handlers/admin/site-logs.ts

@@ -0,0 +1,367 @@
+/**
+ * Admin Site Logs API Handlers
+ *
+ * Provides admin-level access to site activity logs.
+ * - GET /site-logs - Query logs from Vibe
+ * - POST /site-logs - Create test log entries via Redis queue
+ * - GET /site-logs/stats - Aggregated stats { total, unique_users, by_level, by_category }
+ * - POST /site-logs/drain - Manual drain trigger
+ * - GET /site-logs/queue - Redis queue status
+ *
+ * @version 1.0
+ * @requires Admin role (vibe_app_admin or payez_admin)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { getRedis } from '../../lib/redis';
+import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+const REDIS_SITE_LOG_KEY = 'vibe:site-logs:pending';
+const REDIS_LOG_TTL = 7 * 24 * 60 * 60; // 1 week
+
+export interface SiteLogsHandlerConfig {
+  getAuthOptions: () => Promise<any>;
+  vibeApiUrl?: string;
+  appSlug?: string;
+  vibeClientId?: string;
+}
+
+/**
+ * Check if the current user has admin role
+ */
+async function checkAdminRole(getAuthOptions: () => Promise<any>): Promise<{ isAdmin: boolean; userId?: number; accessToken?: string; clientId?: string; error?: NextResponse }> {
+  const authOptions = await getAuthOptions();
+  const session = await getServerSession(authOptions) as any;
+
+  if (!session?.user) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: 'Please sign in' },
+        { status: 401 }
+      ),
+    };
+  }
+
+  const userRoles = (session.user?.roles as string[]) || [];
+  const hasAdminRole = ADMIN_ROLES.some(role => userRoles.includes(role));
+
+  if (!hasAdminRole) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: 'Admin access required' },
+        { status: 403 }
+      ),
+    };
+  }
+
+  return {
+    isAdmin: true,
+    userId: session.user?.id,
+    accessToken: session.accessToken,
+    clientId: session.clientId,
+  };
+}
+
+function getVibeApiUrl(config: SiteLogsHandlerConfig): string {
+  if (config.vibeApiUrl) return config.vibeApiUrl;
+  const url = process.env.VIBE_API_URL;
+  if (url) return url;
+  if (process.env.NODE_ENV !== 'production') return 'http://localhost:37933';
+  throw new Error('VIBE_API_URL is required in production');
+}
+
+/**
+ * Create main site-logs handler (GET query, POST create test entries)
+ */
+export function createSiteLogsHandler(config: SiteLogsHandlerConfig) {
+  return {
+    async GET(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const { searchParams } = new URL(request.url);
+      const vibeUrl = getVibeApiUrl(config);
+
+      // Forward query params
+      const params = new URLSearchParams();
+      if (searchParams.get('level')) params.set('level', searchParams.get('level')!);
+      if (searchParams.get('category')) params.set('category', searchParams.get('category')!);
+      if (searchParams.get('search')) params.set('search', searchParams.get('search')!);
+      if (searchParams.get('from')) params.set('from', searchParams.get('from')!);
+      if (searchParams.get('to')) params.set('to', searchParams.get('to')!);
+      if (searchParams.get('user_id')) params.set('user_id', searchParams.get('user_id')!);
+      if (searchParams.get('limit')) params.set('limit', searchParams.get('limit')!);
+      if (searchParams.get('offset')) params.set('offset', searchParams.get('offset')!);
+
+      const headers: Record<string, string> = {
+        'Authorization': `Bearer ${adminCheck.accessToken}`,
+        'Content-Type': 'application/json',
+      };
+      if (adminCheck.clientId) {
+        headers['X-Client-Id'] = adminCheck.clientId;
+      }
+
+      try {
+        const response = await fetch(`${vibeUrl}/v1/admin/site-logs?${params}`, { headers });
+
+        if (!response.ok) {
+          const errorText = await response.text();
+          console.error('[admin/site-logs] Vibe error:', response.status, errorText);
+          return NextResponse.json(
+            { error: 'Failed to fetch site logs', details: errorText },
+            { status: response.status }
+          );
+        }
+
+        const data = await response.json();
+        return NextResponse.json(data);
+      } catch (error: any) {
+        console.error('[admin/site-logs] Error:', error);
+        return NextResponse.json(
+          { error: error.message || 'Internal error' },
+          { status: 500 }
+        );
+      }
+    },
+
+    async POST(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      try {
+        const body = await request.json();
+        const redis = getRedis();
+
+        const userAgent = request.headers.get('user-agent') || null;
+        const ipAddress = request.headers.get('x-forwarded-for')?.split(',')[0] || null;
+        const baseRecord = {
+          user_agent: userAgent,
+          ip_address: ipAddress,
+          created_at: new Date().toISOString(),
+          app_slug: config.appSlug || process.env.APP_SLUG || process.env.CLIENT_ID || 'unknown',
+          vibe_client_id: config.vibeClientId || process.env.VIBE_CLIENT_ID || '',
+        };
+
+        // If generateAll=true, create one of each event type
+        if (body.generate_all) {
+          const testEvents = [
+            { log_level: 'debug', category: 'api', message: 'Test: API request traced', context: { endpoint: '/api/test', method: 'GET' }, url: '/api/test' },
+            { log_level: 'info', category: 'auth', message: 'Test: User logged in', context: { method: 'password' }, user_id: 1, url: '/api/auth/callback' },
+            { log_level: 'info', category: 'page_view', message: 'Test: Page viewed', context: { referrer: '/dashboard' }, user_id: 1, url: '/admin/activity' },
+            { log_level: 'info', category: 'user_action', message: 'Test: Button clicked', context: { target: 'submit-btn' }, user_id: 1, url: '/admin/activity' },
+            { log_level: 'warn', category: 'auth', message: 'Test: Login failed', context: { reason: 'invalid_password' }, url: '/api/auth/login' },
+            { log_level: 'error', category: 'error', message: 'Test: Application error', context: { error: 'TestError', stack: 'at test()' }, url: '/api/test' },
+          ];
+
+          for (const event of testEvents) {
+            const logRecord = JSON.stringify({ ...baseRecord, ...event, session_id: null });
+            await redis.lpush(REDIS_SITE_LOG_KEY, logRecord);
+          }
+          await redis.expire(REDIS_SITE_LOG_KEY, REDIS_LOG_TTL);
+          const queueLen = await redis.llen(REDIS_SITE_LOG_KEY);
+
+          return NextResponse.json({
+            success: true,
+            message: `Created ${testEvents.length} test events`,
+            queue_length: queueLen,
+            events: testEvents.map(e => ({ level: e.log_level, category: e.category, message: e.message })),
+            note: 'Events will appear after drain service processes them',
+          }, { status: 201 });
+        }
+
+        // Single event creation
+        const logRecord = JSON.stringify({
+          ...baseRecord,
+          log_level: body.level || 'info',
+          category: body.category || 'user_action',
+          message: body.message || 'Test log entry',
+          context: body.context || { source: 'admin-test' },
+          user_id: body.user_id || null,
+          session_id: null,
+          url: body.url || '/admin/activity',
+        });
+
+        await redis.lpush(REDIS_SITE_LOG_KEY, logRecord);
+        await redis.expire(REDIS_SITE_LOG_KEY, REDIS_LOG_TTL);
+        const queueLen = await redis.llen(REDIS_SITE_LOG_KEY);
+
+        return NextResponse.json({
+          success: true,
+          message: 'Test log created',
+          queue_length: queueLen,
+          note: 'Log will appear after drain service processes it (every 5 seconds)',
+        }, { status: 201 });
+      } catch (error: any) {
+        console.error('[admin/site-logs] POST Error:', error);
+        return NextResponse.json(
+          { error: error.message || 'Internal error' },
+          { status: 500 }
+        );
+      }
+    },
+  };
+}
+
+/**
+ * Create site-logs stats handler
+ * Returns: { total, unique_users, by_level, by_category }
+ */
+export function createSiteLogsStatsHandler(config: SiteLogsHandlerConfig) {
+  return {
+    async GET(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const { searchParams } = new URL(request.url);
+      const vibeUrl = getVibeApiUrl(config);
+
+      const params = new URLSearchParams();
+      if (searchParams.get('from')) params.set('from', searchParams.get('from')!);
+      if (searchParams.get('to')) params.set('to', searchParams.get('to')!);
+
+      const headers: Record<string, string> = {
+        'Authorization': `Bearer ${adminCheck.accessToken}`,
+        'Content-Type': 'application/json',
+      };
+      if (adminCheck.clientId) {
+        headers['X-Client-Id'] = adminCheck.clientId;
+      }
+
+      try {
+        const response = await fetch(`${vibeUrl}/v1/admin/site-logs/stats?${params}`, { headers });
+
+        if (!response.ok) {
+          const errorText = await response.text();
+          console.error('[admin/site-logs/stats] Vibe error:', response.status, errorText);
+          return NextResponse.json(
+            { error: 'Failed to fetch stats', details: errorText },
+            { status: response.status }
+          );
+        }
+
+        const data = await response.json();
+        // Ensure response matches expected format: { total, unique_users, by_level, by_category }
+        return NextResponse.json(data);
+      } catch (error: any) {
+        console.error('[admin/site-logs/stats] Error:', error);
+        return NextResponse.json(
+          { error: error.message || 'Internal error' },
+          { status: 500 }
+        );
+      }
+    },
+  };
+}
+
+/**
+ * Create site-logs drain handler (manual trigger)
+ */
+export function createSiteLogsDrainHandler(config: SiteLogsHandlerConfig) {
+  return {
+    async POST(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const { searchParams } = new URL(request.url);
+      const maxEntries = searchParams.get('max_entries') || '100';
+      const vibeUrl = getVibeApiUrl(config);
+
+      const headers: Record<string, string> = {
+        'Authorization': `Bearer ${adminCheck.accessToken}`,
+        'Content-Type': 'application/json',
+      };
+      if (adminCheck.clientId) {
+        headers['X-Client-Id'] = adminCheck.clientId;
+      }
+
+      try {
+        const response = await fetch(`${vibeUrl}/v1/admin/site-logs/drain?maxEntries=${maxEntries}`, {
+          method: 'POST',
+          headers,
+        });
+
+        if (!response.ok) {
+          const errorText = await response.text();
+          console.error('[admin/site-logs/drain] Vibe error:', response.status, errorText);
+          return NextResponse.json(
+            { error: 'Failed to drain site logs', details: errorText },
+            { status: response.status }
+          );
+        }
+
+        const data = await response.json();
+        return NextResponse.json(data);
+      } catch (error: any) {
+        console.error('[admin/site-logs/drain] Error:', error);
+        return NextResponse.json(
+          { error: error.message || 'Internal error' },
+          { status: 500 }
+        );
+      }
+    },
+  };
+}
+
+/**
+ * Create site-logs queue status handler
+ */
+export function createSiteLogsQueueHandler(config: SiteLogsHandlerConfig) {
+  return {
+    async GET(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      try {
+        const redis = getRedis();
+        const queueLength = await redis.llen(REDIS_SITE_LOG_KEY);
+
+        // Peek at the oldest and newest entries
+        let oldest_entry = null;
+        let newest_entry = null;
+
+        if (queueLength > 0) {
+          const oldest = await redis.lindex(REDIS_SITE_LOG_KEY, -1); // RPOP side (oldest)
+          const newest = await redis.lindex(REDIS_SITE_LOG_KEY, 0);  // LPUSH side (newest)
+
+          if (oldest) {
+            try {
+              const parsed = JSON.parse(oldest);
+              oldest_entry = {
+                message: parsed.message,
+                level: parsed.log_level,
+                timestamp: parsed.created_at || parsed.queued_at,
+              };
+            } catch {}
+          }
+
+          if (newest) {
+            try {
+              const parsed = JSON.parse(newest);
+              newest_entry = {
+                message: parsed.message,
+                level: parsed.log_level,
+                timestamp: parsed.created_at || parsed.queued_at,
+              };
+            } catch {}
+          }
+        }
+
+        return NextResponse.json({
+          queue_length: queueLength,
+          redis_key: REDIS_SITE_LOG_KEY,
+          oldest_entry,
+          newest_entry,
+          status: queueLength === 0 ? 'empty' : 'pending',
+        });
+      } catch (error: any) {
+        console.error('[admin/site-logs/queue] Error:', error);
+        return NextResponse.json(
+          { error: error.message || 'Internal error' },
+          { status: 500 }
+        );
+      }
+    },
+  };
+}