@startup-api/cloudflare 0.0.1

package/src/auth/TwitchProvider.ts

@@ -0,0 +1,64 @@
+import type { StartupAPIEnv } from '../StartupAPIEnv';
+
+import { OAuthProvider, OAuthTokenResponse, UserProfile } from './OAuthProvider';
+
+export class TwitchProvider extends OAuthProvider {
+  static create(env: StartupAPIEnv, redirectBase: string): TwitchProvider | null {
+    if (!env.TWITCH_CLIENT_ID || !env.TWITCH_CLIENT_SECRET) return null;
+    return new TwitchProvider(env.TWITCH_CLIENT_ID, env.TWITCH_CLIENT_SECRET, redirectBase + '/twitch/callback', 'twitch');
+  }
+
+  getAuthUrl(state: string): string {
+    const params = new URLSearchParams({
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      response_type: 'code',
+      scope: 'user:read:email',
+      state: state,
+    });
+    return `https://id.twitch.tv/oauth2/authorize?${params.toString()}`;
+  }
+
+  getIcon(): string {
+    return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+      <circle cx="12" cy="12" r="11" fill="#9146FF" stroke="white" stroke-width="1"/>
+      <path d="M7 6H6v10h2v3l3-3h3l4-4V6H7zm9 6l-2 2h-3l-2 2v-2H8V7h8v5z" fill="white"/>
+      <path d="M14 8.5h1.5v2H14V8.5zm-3 0h1.5v2H11v-2z" fill="white"/>
+    </svg>`;
+  }
+
+  async getToken(code: string): Promise<OAuthTokenResponse> {
+    const params = new URLSearchParams({
+      code,
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      redirect_uri: this.redirectUri,
+      grant_type: 'authorization_code',
+    });
+
+    return this.fetchJson<OAuthTokenResponse>('https://id.twitch.tv/oauth2/token', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: params.toString(),
+    });
+  }
+
+  async getUserProfile(accessToken: string): Promise<UserProfile> {
+    const data = await this.fetchJson<{ data: any[] }>('https://api.twitch.tv/helix/users', {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'Client-Id': this.clientId,
+      },
+    });
+
+    const user = data.data[0];
+    return {
+      id: user.id,
+      email: user.email,
+      name: user.display_name,
+      picture: user.profile_image_url,
+    };
+  }
+}

package/src/auth/index.ts

@@ -0,0 +1,231 @@
+import type { StartupAPIEnv } from '../StartupAPIEnv';
+
+import { GoogleProvider } from './GoogleProvider';
+import { TwitchProvider } from './TwitchProvider';
+import { OAuthProvider } from './OAuthProvider';
+import { CookieManager } from '../CookieManager';
+
+export async function handleAuth(
+  request: Request,
+  env: StartupAPIEnv,
+  url: URL,
+  usersPath: string,
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const path = url.pathname;
+  const origin = env.AUTH_ORIGIN && env.AUTH_ORIGIN !== '' ? env.AUTH_ORIGIN : url.origin;
+
+  // Standardize redirectBase
+  const baseUsersPath = usersPath.startsWith('/') ? usersPath : '/' + usersPath;
+  const redirectBase = new URL((baseUsersPath.endsWith('/') ? baseUsersPath : baseUsersPath + '/') + 'auth', origin).toString();
+
+  // For internal matching, we still need authPath
+  const authPath = new URL(redirectBase).pathname;
+
+  // Instantiate providers
+  const providers: (OAuthProvider | null)[] = [GoogleProvider.create(env, redirectBase), TwitchProvider.create(env, redirectBase)];
+
+  const activeProviders = providers.filter((p): p is OAuthProvider => p !== null);
+
+  // Handle Auth Start
+  for (const provider of activeProviders) {
+    if (provider.isMatch(path, authPath)) {
+      const returnUrl = url.searchParams.get('return_url');
+      const stateObj = {
+        nonce: Math.random().toString(36).substring(2),
+        return_url: returnUrl,
+      };
+      // Use robust base64 encoding for state
+      const state = btoa(unescape(encodeURIComponent(JSON.stringify(stateObj))))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+      const authUrl = provider.getAuthUrl(state);
+      return Response.redirect(authUrl, 302);
+    }
+  }
+
+  // Handle Auth Callback
+  for (const provider of activeProviders) {
+    if (provider.isCallback(path, authPath)) {
+      console.log(`[Auth] Callback received for ${provider.name}`);
+      const code = url.searchParams.get('code');
+      if (!code) return new Response('Missing code', { status: 400 });
+
+      const stateBase64 = url.searchParams.get('state');
+      let returnUrl: string | null = null;
+      if (stateBase64) {
+        try {
+          // Robust base64 decoding
+          const base64 = stateBase64.replace(/-/g, '+').replace(/_/g, '/');
+          const stateJson = decodeURIComponent(escape(atob(base64)));
+          const stateObj = JSON.parse(stateJson);
+          returnUrl = stateObj.return_url;
+        } catch (e) {
+          console.error('Failed to parse state', e);
+        }
+      }
+
+      try {
+        const token = await provider.getToken(code);
+        const profile = await provider.getUserProfile(token.access_token);
+
+        const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
+
+        // 1. Try to resolve existing user by credential
+        const credentialStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName(provider.name));
+        const resolveData = await credentialStub.get(profile.id);
+
+        let userIdStr: string | null = null;
+        let staleSessionId: string | null = null;
+
+        if (resolveData) {
+          userIdStr = resolveData.user_id;
+        } else {
+          // 2. Not found, check if user is already logged in (to link account)
+          const cookieHeader = request.headers.get('Cookie');
+          if (cookieHeader) {
+            const cookies = cookieHeader.split(';').reduce(
+              (acc, cookie) => {
+                const [key, value] = cookie.split('=').map((c) => c.trim());
+                if (key && value) acc[key] = value;
+                return acc;
+              },
+              {} as Record<string, string>,
+            );
+            const sessionCookieEncrypted = cookies['session_id'];
+            if (sessionCookieEncrypted) {
+              const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
+              if (sessionCookie && sessionCookie.includes(':')) {
+                const parts = sessionCookie.split(':');
+                staleSessionId = parts[0];
+                userIdStr = parts[1];
+              }
+            }
+          }
+        }
+
+        if (userIdStr) {
+          // Verify user still exists (has a profile)
+          const userStub = env.USER.get(env.USER.idFromString(userIdStr));
+          const profileData = await userStub.getProfile();
+          if (Object.keys(profileData).length === 0) {
+            // User was deleted!
+            if (staleSessionId) {
+              try {
+                await userStub.deleteSession(staleSessionId);
+              } catch (_e) {
+                // ignore
+              }
+            }
+            userIdStr = null;
+          }
+        }
+
+        const isNewUser = !userIdStr;
+        const id = userIdStr ? env.USER.idFromString(userIdStr) : env.USER.newUniqueId();
+        const userStub = env.USER.get(id);
+        userIdStr = id.toString();
+
+        // Fetch and Store Avatar (Only for new users)
+        if (isNewUser && profile.picture) {
+          try {
+            const picRes = await fetch(profile.picture);
+            if (picRes.ok) {
+              const picBlob = await picRes.arrayBuffer();
+              await userStub.storeImage('avatar', picBlob, picRes.headers.get('Content-Type') || 'image/jpeg');
+              // Update profile.picture to point to our worker
+              profile.picture = usersPath + 'me/avatar';
+            }
+          } catch (e) {
+            console.error('Failed to fetch avatar', e);
+          }
+        }
+
+        // Register credential in provider-specific CredentialDO
+        await credentialStub.put({
+          user_id: userIdStr,
+          subject_id: profile.id,
+          access_token: token.access_token,
+          refresh_token: token.refresh_token,
+          expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
+          scope: token.scope,
+          profile_data: profile,
+        });
+
+        // Register credential mapping in UserDO
+        await userStub.addCredential(provider.name, profile.id);
+
+        // Register User in SystemDO index (Only for new users)
+        if (isNewUser) {
+          await userStub.updateProfile(profile);
+          await systemStub.registerUser({
+            id: userIdStr,
+            name: profile.name || userIdStr,
+            email: profile.email,
+            provider: provider.name,
+          });
+        }
+
+        // Ensure user has at least one account
+        const memberships = await userStub.getMemberships();
+
+        if (memberships.length === 0) {
+          // Create a personal account
+          const accountId = env.ACCOUNT.newUniqueId();
+          const accountStub = env.ACCOUNT.get(accountId);
+          const accountIdStr = accountId.toString();
+
+          // Initialize account info
+          await accountStub.updateInfo({
+            name: `${profile.name || userIdStr}'s Account`,
+            personal: true,
+          });
+
+          // Register Account in SystemDO
+          await systemStub.registerAccount({
+            id: accountIdStr,
+            name: `${profile.name || profile.id}'s Account`,
+            status: 'active',
+            plan: 'free',
+          });
+
+          // Add user as ADMIN to the account
+          await accountStub.addMember(id.toString(), 1);
+
+          // Add membership to user
+          await userStub.addMembership(accountIdStr, 1, true);
+        }
+
+        // Create Session
+        const session = await userStub.createSession({ provider: provider.name });
+
+        // Set cookie and redirect
+        const encryptedSession = await cookieManager.encrypt(`${session.sessionId}:${userIdStr}`);
+        const headers = new Headers();
+        headers.set('Set-Cookie', `session_id=${encryptedSession}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+
+        let redirectUrl = !isNewUser ? usersPath + 'profile.html' : '/';
+        if (returnUrl) {
+          try {
+            const parsedReturn = new URL(returnUrl, origin);
+            if (parsedReturn.origin === origin) {
+              redirectUrl = parsedReturn.toString();
+            }
+          } catch (_e) {
+            if (returnUrl.startsWith('/')) {
+              redirectUrl = returnUrl;
+            }
+          }
+        }
+
+        headers.set('Location', redirectUrl);
+        return new Response(null, { status: 302, headers });
+      } catch (e) {
+        return new Response(`Auth failed: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+      }
+    }
+  }
+
+  return new Response('Auth route not found', { status: 404 });
+}

package/src/billing/PaymentEngine.ts

@@ -0,0 +1,20 @@
+export abstract class PaymentEngine {
+  abstract charge(accountId: string, amount: number, currency: string): Promise<boolean>;
+  abstract setupRecurring(accountId: string, planSlug: string, scheduleIdx: number): Promise<void>;
+  abstract cancelRecurring(accountId: string): Promise<void>;
+}
+
+export class MockPaymentEngine extends PaymentEngine {
+  async charge(accountId: string, amount: number, currency: string): Promise<boolean> {
+    console.log(`[MockPaymentEngine] Charging ${accountId} ${amount} ${currency}`);
+    return true;
+  }
+
+  async setupRecurring(accountId: string, planSlug: string, scheduleIdx: number): Promise<void> {
+    console.log(`[MockPaymentEngine] Setup recurring for ${accountId} on plan ${planSlug} schedule ${scheduleIdx}`);
+  }
+
+  async cancelRecurring(accountId: string): Promise<void> {
+    console.log(`[MockPaymentEngine] Cancel recurring for ${accountId}`);
+  }
+}

package/src/billing/Plan.ts

@@ -0,0 +1,80 @@
+export interface PaymentScheduleConfig {
+  charge_amount: number;
+  charge_period: number; // in days
+  is_default?: boolean;
+}
+
+export class PaymentSchedule {
+  charge_amount: number;
+  charge_period: number;
+  is_default: boolean;
+
+  constructor(config: PaymentScheduleConfig) {
+    this.charge_amount = config.charge_amount;
+    this.charge_period = config.charge_period;
+    this.is_default = config.is_default || false;
+  }
+}
+
+export interface PlanConfig {
+  slug: string;
+  name: string;
+  capabilities?: Record<string, boolean>;
+  downgrade_to_slug?: string;
+  grace_period?: number;
+  schedules?: PaymentScheduleConfig[];
+  account_activate_hook?: (accountId: string) => Promise<void>;
+  account_deactivate_hook?: (accountId: string) => Promise<void>;
+}
+
+export class Plan {
+  slug: string;
+  name: string;
+  capabilities: Record<string, boolean>;
+  downgrade_to_slug?: string;
+  grace_period: number;
+  schedules: PaymentSchedule[];
+  account_activate_hook?: (accountId: string) => Promise<void>;
+  account_deactivate_hook?: (accountId: string) => Promise<void>;
+
+  constructor(config: PlanConfig) {
+    this.slug = config.slug;
+    this.name = config.name;
+    this.capabilities = config.capabilities || {};
+    this.downgrade_to_slug = config.downgrade_to_slug;
+    this.grace_period = config.grace_period || 0;
+    this.schedules = (config.schedules || []).map((s) => new PaymentSchedule(s));
+    this.account_activate_hook = config.account_activate_hook;
+    this.account_deactivate_hook = config.account_deactivate_hook;
+  }
+
+  // Registry of plans
+  private static plans: Map<string, Plan> = new Map();
+
+  static init(plans: PlanConfig[]) {
+    Plan.plans.clear();
+    for (const p of plans) {
+      Plan.plans.set(p.slug, new Plan(p));
+    }
+  }
+
+  static isInitialized(): boolean {
+    return Plan.plans.size > 0;
+  }
+
+  static clear() {
+    Plan.plans.clear();
+  }
+
+  static get(slug: string): Plan | undefined {
+    return Plan.plans.get(slug);
+  }
+
+  static getAll(): Plan[] {
+    return Array.from(Plan.plans.values());
+  }
+
+  getDefaultSchedule(): PaymentSchedule | undefined {
+    return this.schedules.find((s) => s.is_default) || this.schedules[0];
+  }
+}

package/src/billing/plansConfig.ts

@@ -0,0 +1,48 @@
+import { Plan, PlanConfig } from './Plan';
+
+const plans: PlanConfig[] = [
+  {
+    slug: 'free',
+    name: 'Free',
+    capabilities: {
+      can_access_basic: true,
+      can_access_pro: false,
+    },
+    schedules: [{ charge_amount: 0, charge_period: 30, is_default: true }],
+  },
+  /*
+  {
+    slug: 'pro',
+    name: 'Pro',
+    capabilities: {
+      can_access_basic: true,
+      can_access_pro: true,
+    },
+    downgrade_to_slug: 'free',
+    grace_period: 7,
+    schedules: [
+      { charge_amount: 2900, charge_period: 30, is_default: true }, // $29.00 / month
+      { charge_amount: 29000, charge_period: 365 }, // $290.00 / year
+    ],
+  },
+  {
+    slug: 'enterprise',
+    name: 'Enterprise',
+    capabilities: {
+      can_access_basic: true,
+      can_access_pro: true,
+      can_access_enterprise: true,
+    },
+    downgrade_to_slug: 'pro',
+    grace_period: 14,
+    schedules: [
+      { charge_amount: 49900, charge_period: 30, is_default: true }, // $499.00 / month
+      { charge_amount: 499000, charge_period: 365 }, // $4990.00 / year
+    ],
+  },
+  */
+];
+
+export function initPlans() {
+  Plan.init(plans);
+}

package/src/handlers/account.ts

@@ -0,0 +1,246 @@
+import { StartupAPIEnv } from '../StartupAPIEnv';
+import { CookieManager } from '../CookieManager';
+import { getUserFromSession, checkAndClearStaleSession, isAdmin } from './utils';
+import { AccountDO } from '../storage/AccountDO';
+import { AccountInfoSchema, MemberSchema, SwitchAccountSchema } from '../schemas/account';
+
+export async function handleMyAccounts(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  try {
+    const id = env.USER.idFromString(user.id);
+    const userStub = env.USER.get(id);
+
+    // Fetch memberships
+    const memberships = await userStub.getMemberships();
+
+    const accounts = await Promise.all(
+      memberships.map(async (m: any) => {
+        try {
+          const accountStub = env.ACCOUNT.get(env.ACCOUNT.idFromString(m.account_id));
+          const info = await accountStub.getInfo();
+          return {
+            account_id: m.account_id,
+            name: info.name || 'Unknown Account',
+            role: m.role,
+            is_current: m.is_current,
+          };
+        } catch (_e) {
+          return { account_id: m.account_id, name: 'Unknown Account', role: m.role, is_current: m.is_current };
+        }
+      }),
+    );
+
+    return Response.json(accounts);
+  } catch (_e) {
+    return new Response('Unauthorized', { status: 401 });
+  }
+}
+
+export async function handleSwitchAccount(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  try {
+    const data = await request.json();
+    const { account_id } = SwitchAccountSchema.parse(data);
+
+    const id = env.USER.idFromString(user.id);
+    const userStub = env.USER.get(id);
+    return Response.json(await userStub.switchAccount(account_id));
+  } catch (e) {
+    return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+  }
+}
+
+export async function handleAccountDetails(
+  request: Request,
+  env: StartupAPIEnv,
+  accountId: string,
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  const userStub = env.USER.get(env.USER.idFromString(user.id));
+  const memberships = await userStub.getMemberships();
+  const membership = memberships.find((m: any) => m.account_id === accountId);
+
+  const isAccountAdmin = membership && (membership as any).role === AccountDO.ROLE_ADMIN;
+  const isSysAdmin = isAdmin(user, env);
+
+  if (!isAccountAdmin && !isSysAdmin) {
+    return new Response('Forbidden', { status: 403 });
+  }
+
+  const accountStub = env.ACCOUNT.get(env.ACCOUNT.idFromString(accountId));
+
+  if (request.method === 'GET') {
+    const info = await accountStub.getInfo();
+    const billing = await accountStub.getBillingInfo();
+    return Response.json({ ...info, billing, role: membership?.role });
+  }
+
+  if (request.method === 'POST') {
+    try {
+      const data = await request.json();
+      const validatedData = AccountInfoSchema.partial().parse(data);
+      const result = await accountStub.updateInfo(validatedData);
+
+      // Sync with SystemDO index if name or plan changed
+      if (validatedData.name || validatedData.plan) {
+        try {
+          const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
+          const updates: any = {};
+          if (validatedData.name) updates.name = validatedData.name;
+          if (validatedData.plan) updates.plan = validatedData.plan;
+          await systemStub.updateAccount(accountId, updates);
+        } catch (_e) {
+          console.error('Failed to sync account updates to SystemDO', _e);
+        }
+      }
+      return Response.json(result);
+    } catch (e) {
+      return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+    }
+  }
+
+  return new Response('Method Not Allowed', { status: 405 });
+}
+
+export async function handleAccountImage(
+  request: Request,
+  env: StartupAPIEnv,
+  accountId: string,
+  type: string,
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) return new Response('Unauthorized', { status: 401 });
+
+  const userStub = env.USER.get(env.USER.idFromString(user.id));
+  const memberships = await userStub.getMemberships();
+  const membership = memberships.find((m: any) => m.account_id === accountId);
+
+  // For viewing, we might allow any member to see account avatar
+  if (!membership && !isAdmin(user, env)) {
+    return new Response('Forbidden', { status: 403 });
+  }
+
+  const accountStub = env.ACCOUNT.get(env.ACCOUNT.idFromString(accountId));
+
+  try {
+    if (request.method === 'PUT') {
+      // Only admins can upload
+      if (membership?.role !== AccountDO.ROLE_ADMIN && !isAdmin(user, env)) {
+        return new Response('Forbidden', { status: 403 });
+      }
+
+      const contentType = request.headers.get('Content-Type');
+      if (!contentType || !contentType.startsWith('image/')) {
+        return new Response('Invalid image type', { status: 400 });
+      }
+
+      const blob = await request.arrayBuffer();
+      if (blob.byteLength > 1024 * 1024) {
+        return new Response('Image too large (max 1MB)', { status: 400 });
+      }
+
+      await accountStub.storeImage(type, blob, contentType);
+      return Response.json({ success: true });
+    }
+
+    if (request.method === 'DELETE') {
+      // Only admins can delete
+      if (membership?.role !== AccountDO.ROLE_ADMIN && !isAdmin(user, env)) {
+        return new Response('Forbidden', { status: 403 });
+      }
+
+      await accountStub.deleteImage(type);
+      return Response.json({ success: true });
+    }
+
+    const image = await accountStub.getImage(type);
+    if (!image) return new Response('Not Found', { status: 404 });
+    return new Response(image.value, { headers: { 'Content-Type': image.mime_type } });
+  } catch (e) {
+    console.error('[handleAccountImage] Error:', e instanceof Error ? e.message : String(e), e instanceof Error ? e.stack : '');
+    return new Response(`Error handling account image: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  }
+}
+
+export async function handleAccountMembers(
+  request: Request,
+  env: StartupAPIEnv,
+  accountId: string,
+  pathParts: string[],
+  cookieManager: CookieManager,
+): Promise<Response> {
+  const user = await getUserFromSession(request, env, cookieManager);
+  if (!user) {
+    return checkAndClearStaleSession(request, env, cookieManager, new Response('Unauthorized', { status: 401 }));
+  }
+
+  const userStub = env.USER.get(env.USER.idFromString(user.id));
+  const memberships = await userStub.getMemberships();
+  const membership = memberships.find((m: any) => m.account_id === accountId);
+
+  const isAccountAdmin = membership && (membership as any).role === AccountDO.ROLE_ADMIN;
+  const isSysAdmin = isAdmin(user, env);
+
+  if (!isAccountAdmin && !isSysAdmin) {
+    return new Response('Forbidden', { status: 403 });
+  }
+
+  const accountStub = env.ACCOUNT.get(env.ACCOUNT.idFromString(accountId));
+
+  if (pathParts.length === 0) {
+    if (request.method === 'GET') {
+      return Response.json(await accountStub.getMembers());
+    }
+    if (request.method === 'POST') {
+      try {
+        const data = await request.json();
+        const { user_id, role } = MemberSchema.partial().parse(data);
+        if (!user_id || role === undefined) {
+          return new Response('Missing user_id or role', { status: 400 });
+        }
+        return Response.json(await accountStub.addMember(user_id, role));
+      } catch (e) {
+        return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+      }
+    }
+  } else if (pathParts.length === 1) {
+    const targetUserId = pathParts[0];
+    if (request.method === 'DELETE') {
+      if (targetUserId === user.id) {
+        return new Response('Cannot remove yourself', { status: 400 });
+      }
+      return Response.json(await accountStub.removeMember(targetUserId));
+    }
+    if (request.method === 'PATCH') {
+      try {
+        const data = await request.json();
+        const { role } = MemberSchema.partial().parse(data);
+        if (role === undefined) {
+          return new Response('Missing role', { status: 400 });
+        }
+        if (targetUserId === user.id && role !== AccountDO.ROLE_ADMIN) {
+          return new Response('Cannot demote yourself', { status: 400 });
+        }
+        return Response.json(await accountStub.updateMemberRole(targetUserId, role));
+      } catch (e) {
+        return new Response(e instanceof Error ? e.message : String(e), { status: 400 });
+      }
+    }
+  }
+
+  return new Response('Not Found', { status: 404 });
+}