@payez/next-mvp 3.0.0

package/src/api-handlers/admin/users.ts

@@ -0,0 +1,244 @@
+/**
+ * Admin Users API Handler
+ *
+ * Provides admin-level access to users using service account credentials.
+ *
+ * @version 1.0
+ * @requires Admin role (vibe_app_admin or payez_admin)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { getStartupIDPConfig } from '../../lib/startup-init';
+import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+
+interface VibeRequestOptions {
+  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  body?: unknown;
+}
+
+async function checkAdminRole(getAuthOptions: () => Promise<any>): Promise<{ isAdmin: boolean; error?: NextResponse }> {
+  const authOptions = await getAuthOptions();
+  const session = await getServerSession(authOptions) as any;
+
+  if (!session?.user) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json({ success: false, error: 'Please sign in' }, { status: 401 }),
+    };
+  }
+
+  const userRoles = (session.user?.roles as string[]) || [];
+  const hasAdminRole = ADMIN_ROLES.some(role => userRoles.includes(role));
+
+  if (!hasAdminRole) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json({ success: false, error: 'Admin access required' }, { status: 403 }),
+    };
+  }
+
+  return { isAdmin: true };
+}
+
+async function vibeServiceRequest<T = unknown>(
+  endpoint: string,
+  options: VibeRequestOptions
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+  const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
+  const clientId = process.env.VIBE_CLIENT_ID;
+  const signingKey = process.env.VIBE_HMAC_KEY;
+
+  if (!idpUrl || !clientId || !signingKey) {
+    return { ok: false, status: 500, data: null, error: 'Vibe not configured' };
+  }
+
+  const timestamp = Math.floor(Date.now() / 1000);
+  const stringToSign = `${timestamp}|${options.method}|${endpoint}`;
+
+  const crypto = await import('crypto');
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(signingKey, 'base64'))
+    .update(stringToSign)
+    .digest('base64');
+
+  const proxyUrl = `${idpUrl}/api/vibe/proxy`;
+
+  // Get the numeric client ID from startup config for multi-client admin support
+  const idpConfig = getStartupIDPConfig();
+  const numericClientId = idpConfig?.clientId;
+
+  try {
+    const res = await fetch(proxyUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Vibe-Client-Id': clientId,
+        'X-Vibe-Timestamp': String(timestamp),
+        'X-Vibe-Signature': signature,
+        ...(numericClientId && { 'X-Client-Id': String(numericClientId) }),
+      },
+      body: JSON.stringify({
+        endpoint,
+        method: options.method,
+        data: options.body ?? null,
+      }),
+      cache: 'no-store',
+    });
+
+    if (res.status === 204) return { ok: true, status: 204, data: null };
+    if (!res.ok) {
+      const errorText = await res.text();
+      return { ok: false, status: res.status, data: null, error: errorText };
+    }
+
+    const body = await res.json();
+    return { ok: true, status: res.status, data: body };
+  } catch (error) {
+    return { ok: false, status: 0, data: null, error: String(error) };
+  }
+}
+
+export interface AdminUsersHandlerConfig {
+  getAuthOptions: () => Promise<any>;
+}
+
+/**
+ * GET /api/admin/users - List users
+ * POST /api/admin/users - Stats, search, update tier
+ */
+export function createUsersHandler(config: AdminUsersHandlerConfig) {
+  return {
+    async GET(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const { searchParams } = new URL(request.url);
+      const search = searchParams.get('search');
+      const tier = searchParams.get('tier');
+      const page = parseInt(searchParams.get('page') || '1');
+      const pageSize = parseInt(searchParams.get('pageSize') || '50');
+
+      const queryBody: any = {
+        page,
+        pageSize,
+        orderBy: 'created_at',
+        orderDirection: 'desc',
+      };
+
+      const conditions: any[] = [];
+      if (search) {
+        conditions.push({
+          operator: 'or',
+          conditions: [
+            { field: 'email', operator: 'like', value: `%${search}%` },
+            { field: 'display_name', operator: 'like', value: `%${search}%` },
+          ],
+        });
+      }
+      if (tier) {
+        conditions.push({ field: 'tier', operator: 'eq', value: tier });
+      }
+
+      if (conditions.length === 1) {
+        queryBody.filter = conditions[0];
+      } else if (conditions.length > 1) {
+        queryBody.filter = { operator: 'and', conditions };
+      }
+
+      const result = await vibeServiceRequest<any>(
+        '/v1/collections/vibe_app/tables/users/query',
+        { method: 'POST', body: queryBody }
+      );
+
+      if (!result.ok) {
+        return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+      }
+
+      const rawUsers = result.data?.data || result.data?.documents || [];
+      const users = rawUsers.map((u: any) => ({
+        id: u.id || u.document_id,
+        idp_user_id: u.idp_user_id,
+        email: u.email,
+        display_name: u.display_name || u.name,
+        tier: u.tier || 'free',
+        credits: u.credits || 0,
+        status: u.status || 'active',
+        created_at: u.created_at,
+        last_login: u.last_login || u.updated_at,
+      }));
+
+      return NextResponse.json({
+        users,
+        meta: result.data?.meta || { total: users.length, page, pageSize },
+      });
+    },
+
+    async POST(request: NextRequest) {
+      const adminCheck = await checkAdminRole(config.getAuthOptions);
+      if (adminCheck.error) return adminCheck.error;
+
+      const body = await request.json();
+      const { action, userId, tier, credits } = body;
+
+      if (action === 'stats') {
+        const result = await vibeServiceRequest<any>(
+          '/v1/collections/vibe_app/tables/users/query',
+          { method: 'POST', body: { page: 1, pageSize: 10000 } }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        }
+
+        const users = result.data?.data || result.data?.documents || [];
+        const now = new Date();
+        const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000);
+        const oneWeekAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000);
+
+        const stats = {
+          total: users.length,
+          active: users.filter((u: any) => u.status === 'active').length,
+          newToday: users.filter((u: any) => new Date(u.created_at) > oneDayAgo).length,
+          newThisWeek: users.filter((u: any) => new Date(u.created_at) > oneWeekAgo).length,
+          byTier: {} as Record<string, number>,
+        };
+
+        users.forEach((u: any) => {
+          const t = u.tier || 'free';
+          stats.byTier[t] = (stats.byTier[t] || 0) + 1;
+        });
+
+        return NextResponse.json({ stats });
+      }
+
+      if (action === 'update_tier' && userId && tier) {
+        const result = await vibeServiceRequest<any>(
+          `/v1/collections/vibe_app/tables/users/${userId}`,
+          { method: 'PUT', body: { tier } }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        }
+
+        return NextResponse.json({ success: true });
+      }
+
+      if (action === 'update_credits' && userId && credits !== undefined) {
+        const result = await vibeServiceRequest<any>(
+          `/v1/collections/vibe_app/tables/users/${userId}`,
+          { method: 'PUT', body: { credits } }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error }, { status: result.status || 500 });
+        }
+
+        return NextResponse.json({ success: true });
+      }
+
+      return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+    },
+  };
+}

package/src/api-handlers/admin/vibe-data.ts

@@ -0,0 +1,326 @@
+/**
+ * Admin Vibe Data API Handler
+ *
+ * Provides admin-level access to Vibe data using service account credentials.
+ * Bypasses user-level filtering to allow admins to view all records.
+ *
+ * @version 1.0
+ * @requires Admin role (vibe_app_admin or payez_admin)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { getStartupIDPConfig } from '../../lib/startup-init';
+import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+
+interface VibeRequestOptions {
+  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  body?: unknown;
+}
+
+/**
+ * Check if the current user has admin role
+ */
+async function checkAdminRole(getAuthOptions: () => Promise<any>): Promise<{ isAdmin: boolean; error?: NextResponse }> {
+  const authOptions = await getAuthOptions();
+  const session = await getServerSession(authOptions) as any;
+
+  if (!session?.user) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: { code: 'UNAUTHORIZED', message: 'Please sign in' } },
+        { status: 401 }
+      ),
+    };
+  }
+
+  const userRoles = (session.user?.roles as string[]) || [];
+  const hasAdminRole = ADMIN_ROLES.some(role => userRoles.includes(role));
+
+  if (!hasAdminRole) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: { code: 'FORBIDDEN', message: 'Admin access required' } },
+        { status: 403 }
+      ),
+    };
+  }
+
+  return { isAdmin: true };
+}
+
+/**
+ * Make a service account request to Vibe (admin mode - no user filtering)
+ */
+async function vibeServiceRequest<T = unknown>(
+  endpoint: string,
+  options: VibeRequestOptions
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string }> {
+  const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
+  const clientId = process.env.VIBE_CLIENT_ID;
+  const signingKey = process.env.VIBE_HMAC_KEY;
+
+  if (!idpUrl || !clientId || !signingKey) {
+    console.error('[Admin Vibe] Missing config:', { idpUrl: !!idpUrl, clientId: !!clientId, signingKey: !!signingKey });
+    return { ok: false, status: 500, data: null, error: 'Vibe not configured' };
+  }
+
+  const timestamp = Math.floor(Date.now() / 1000);
+  const stringToSign = `${timestamp}|${options.method}|${endpoint}`;
+
+  // Generate HMAC signature
+  const crypto = await import('crypto');
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(signingKey, 'base64'))
+    .update(stringToSign)
+    .digest('base64');
+
+  const proxyUrl = `${idpUrl}/api/vibe/proxy`;
+
+  // Get the numeric client ID from startup config for multi-client admin support
+  const idpConfig = getStartupIDPConfig();
+  const numericClientId = idpConfig?.clientId;
+
+  try {
+    const res = await fetch(proxyUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Vibe-Client-Id': clientId,
+        'X-Vibe-Timestamp': String(timestamp),
+        'X-Vibe-Signature': signature,
+        // For multi-client admins: specify which client context to use
+        ...(numericClientId && { 'X-Client-Id': String(numericClientId) }),
+      },
+      body: JSON.stringify({
+        endpoint,
+        method: options.method,
+        data: options.body ?? null,
+      }),
+      cache: 'no-store',
+    });
+
+    if (res.status === 204) {
+      return { ok: true, status: 204, data: null };
+    }
+
+    if (!res.ok) {
+      const errorText = await res.text();
+      console.error(`[Admin Vibe] Request failed: ${options.method} ${endpoint} - ${res.status}`, errorText);
+      return { ok: false, status: res.status, data: null, error: errorText };
+    }
+
+    const body = await res.json();
+    return { ok: true, status: res.status, data: body };
+  } catch (error) {
+    console.error(`[Admin Vibe] Request exception: ${options.method} ${endpoint}`, error);
+    return { ok: false, status: 0, data: null, error: String(error) };
+  }
+}
+
+// =============================================================================
+// EXPORTED HANDLERS
+// =============================================================================
+
+export interface AdminVibeHandlerConfig {
+  getAuthOptions: () => Promise<any>;
+}
+
+/**
+ * GET /api/admin/vibe/collections
+ * List all Vibe collections
+ */
+export function createGetCollectionsHandler(config: AdminVibeHandlerConfig) {
+  return async function GET(request: NextRequest) {
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const result = await vibeServiceRequest<any>('/v1/collections', { method: 'GET' });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        { success: false, error: { code: 'FETCH_ERROR', message: result.error } },
+        { status: result.status || 500 }
+      );
+    }
+
+    return NextResponse.json(result.data);
+  };
+}
+
+/**
+ * GET /api/admin/vibe/collections/[collection]/tables
+ * List tables in a collection
+ */
+export function createGetTablesHandler(config: AdminVibeHandlerConfig) {
+  return async function GET(
+    request: NextRequest,
+    { params }: { params: Promise<{ collection: string }> }
+  ) {
+    const { collection } = await params;
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const result = await vibeServiceRequest<any>(`/v1/collections/${collection}/tables`, { method: 'GET' });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        { success: false, error: { code: 'FETCH_ERROR', message: result.error } },
+        { status: result.status || 500 }
+      );
+    }
+
+    return NextResponse.json(result.data);
+  };
+}
+
+/**
+ * GET /api/admin/vibe/data/[collection]/[table]
+ * Fetch all records from a table (admin - no user filtering)
+ */
+export function createGetTableDataHandler(config: AdminVibeHandlerConfig) {
+  return async function GET(
+    request: NextRequest,
+    { params }: { params: Promise<{ collection: string; table: string }> }
+  ) {
+    const { collection, table } = await params;
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const searchParams = request.nextUrl.searchParams.toString();
+    const queryString = searchParams ? `?${searchParams}` : '';
+    const endpoint = `/v1/collections/${collection}/tables/${table}${queryString}`;
+
+    const result = await vibeServiceRequest<any>(endpoint, { method: 'GET' });
+
+    if (result.status === 204) {
+      return NextResponse.json({ data: [], meta: { total: 0, limit: 50, offset: 0 } });
+    }
+
+    if (!result.ok) {
+      return NextResponse.json(
+        { success: false, error: { code: 'FETCH_ERROR', message: result.error } },
+        { status: result.status || 500 }
+      );
+    }
+
+    return NextResponse.json(result.data);
+  };
+}
+
+/**
+ * GET /api/admin/vibe/data/[collection]/[table]/[id]
+ * Fetch single record (admin access)
+ */
+export function createGetRecordHandler(config: AdminVibeHandlerConfig) {
+  return async function GET(
+    request: NextRequest,
+    { params }: { params: Promise<{ collection: string; table: string; id: string }> }
+  ) {
+    const { collection, table, id } = await params;
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const endpoint = `/v1/collections/${collection}/tables/${table}/${id}`;
+    const result = await vibeServiceRequest<any>(endpoint, { method: 'GET' });
+
+    if (!result.ok) {
+      const status = result.status === 404 ? 404 : result.status || 500;
+      return NextResponse.json(
+        { success: false, error: { code: result.status === 404 ? 'NOT_FOUND' : 'FETCH_ERROR', message: result.error } },
+        { status }
+      );
+    }
+
+    return NextResponse.json(result.data);
+  };
+}
+
+/**
+ * PUT /api/admin/vibe/data/[collection]/[table]/[id]
+ * Update record (admin access)
+ */
+export function createUpdateRecordHandler(config: AdminVibeHandlerConfig) {
+  return async function PUT(
+    request: NextRequest,
+    { params }: { params: Promise<{ collection: string; table: string; id: string }> }
+  ) {
+    const { collection, table, id } = await params;
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const body = await request.json();
+    const endpoint = `/v1/collections/${collection}/tables/${table}/${id}`;
+    const result = await vibeServiceRequest<any>(endpoint, { method: 'PUT', body });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        { success: false, error: { code: 'UPDATE_ERROR', message: result.error } },
+        { status: result.status || 500 }
+      );
+    }
+
+    return NextResponse.json(result.data);
+  };
+}
+
+/**
+ * DELETE /api/admin/vibe/data/[collection]/[table]/[id]
+ * Delete record (admin access)
+ */
+export function createDeleteRecordHandler(config: AdminVibeHandlerConfig) {
+  return async function DELETE(
+    request: NextRequest,
+    { params }: { params: Promise<{ collection: string; table: string; id: string }> }
+  ) {
+    const { collection, table, id } = await params;
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const endpoint = `/v1/collections/${collection}/tables/${table}/${id}`;
+    const result = await vibeServiceRequest<any>(endpoint, { method: 'DELETE' });
+
+    if (!result.ok) {
+      return NextResponse.json(
+        { success: false, error: { code: 'DELETE_ERROR', message: result.error } },
+        { status: result.status || 500 }
+      );
+    }
+
+    return new NextResponse(null, { status: 204 });
+  };
+}
+
+/**
+ * POST /api/admin/vibe/data/[collection]/[table]/query
+ * Query records with filters (admin access)
+ */
+export function createQueryHandler(config: AdminVibeHandlerConfig) {
+  return async function POST(
+    request: NextRequest,
+    { params }: { params: Promise<{ collection: string; table: string }> }
+  ) {
+    const { collection, table } = await params;
+    const adminCheck = await checkAdminRole(config.getAuthOptions);
+    if (adminCheck.error) return adminCheck.error;
+
+    const body = await request.json();
+    const endpoint = `/v1/collections/${collection}/tables/${table}/query`;
+    const result = await vibeServiceRequest<any>(endpoint, { method: 'POST', body });
+
+    if (result.status === 204) {
+      return NextResponse.json({ data: [], meta: { total: 0, page: 1, pageSize: 20 } });
+    }
+
+    if (!result.ok) {
+      return NextResponse.json(
+        { success: false, error: { code: 'QUERY_ERROR', message: result.error } },
+        { status: result.status || 500 }
+      );
+    }
+
+    return NextResponse.json(result.data);
+  };
+}

package/src/api-handlers/anon/preferences.ts

@@ -0,0 +1,123 @@
+/**
+ * Anonymous Session Preferences API Handler
+ *
+ * GET /api/anon/preferences - Get current preferences
+ * POST /api/anon/preferences - Update preferences
+ *
+ * Sets a cookie to track anonymous visitors and stores preferences in Redis.
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  getOrCreateAnonSession,
+  updateAnonPreferences,
+  ANON_COOKIE_NAME,
+  AnonSessionPreferences,
+} from '../../lib/anon-session';
+
+const COOKIE_MAX_AGE = 90 * 24 * 60 * 60; // 90 days in seconds
+
+/**
+ * GET handler - retrieves anonymous session preferences
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const cookieStore = await cookies();
+    let anonId = cookieStore.get(ANON_COOKIE_NAME)?.value;
+
+    // Get or create session
+    const session = await getOrCreateAnonSession(anonId);
+
+    // Build response
+    const response = NextResponse.json({
+      success: true,
+      data: {
+        id: session.id,
+        preferences: session.preferences,
+        metrics: session.metrics,
+      },
+    });
+
+    // Set cookie if it's a new session
+    if (!anonId || anonId !== session.id) {
+      response.cookies.set(ANON_COOKIE_NAME, session.id, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: COOKIE_MAX_AGE,
+        path: '/',
+      });
+    }
+
+    return response;
+  } catch (error) {
+    console.error('[ANON-PREFERENCES] GET error:', error);
+    return NextResponse.json(
+      { success: false, error: 'Failed to get preferences' },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST handler - updates anonymous session preferences
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const cookieStore = await cookies();
+    let anonId = cookieStore.get(ANON_COOKIE_NAME)?.value;
+
+    // Get or create session first
+    const session = await getOrCreateAnonSession(anonId);
+    anonId = session.id;
+
+    // Parse body for preferences to update
+    const body = await request.json();
+    const preferences: Partial<AnonSessionPreferences> = body.preferences || body;
+
+    // Validate preferences
+    if (typeof preferences !== 'object') {
+      return NextResponse.json(
+        { success: false, error: 'Invalid preferences format' },
+        { status: 400 }
+      );
+    }
+
+    // Update preferences
+    const updatedSession = await updateAnonPreferences(anonId, preferences);
+
+    if (!updatedSession) {
+      return NextResponse.json(
+        { success: false, error: 'Session not found' },
+        { status: 404 }
+      );
+    }
+
+    // Build response
+    const response = NextResponse.json({
+      success: true,
+      data: {
+        id: updatedSession.id,
+        preferences: updatedSession.preferences,
+      },
+    });
+
+    // Ensure cookie is set
+    response.cookies.set(ANON_COOKIE_NAME, anonId, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'lax',
+      maxAge: COOKIE_MAX_AGE,
+      path: '/',
+    });
+
+    return response;
+  } catch (error) {
+    console.error('[ANON-PREFERENCES] POST error:', error);
+    return NextResponse.json(
+      { success: false, error: 'Failed to update preferences' },
+      { status: 500 }
+    );
+  }
+}