@startup-api/cloudflare 0.0.1

package/src/handlers/utils.ts

@@ -0,0 +1,120 @@
+import { StartupAPIEnv } from '../StartupAPIEnv';
+import { CookieManager } from '../CookieManager';
+
+export function getActiveProviders(env: StartupAPIEnv): string[] {
+  const providers: string[] = [];
+  if (env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET) {
+    providers.push('google');
+  }
+  if (env.TWITCH_CLIENT_ID && env.TWITCH_CLIENT_SECRET) {
+    providers.push('twitch');
+  }
+  return providers;
+}
+
+export function isAdmin(user: any, env: StartupAPIEnv): boolean {
+  if (!env.ADMIN_IDS) return false;
+  const adminIds = env.ADMIN_IDS.split(',')
+    .map((e) => e.trim())
+    .filter(Boolean);
+
+  const userId = user.id;
+
+  return (
+    adminIds.includes(userId) ||
+    (env.ENVIRONMENT === 'test' &&
+      adminIds.some((id) => {
+        try {
+          return userId === env.USER.idFromName(id).toString();
+        } catch (_e) {
+          return false;
+        }
+      }))
+  );
+}
+
+export function parseCookies(cookieHeader: string): Record<string, string> {
+  return cookieHeader.split(';').reduce(
+    (acc, cookie) => {
+      const [key, value] = cookie.split('=').map((c) => c.trim());
+      if (key && value) acc[key] = value;
+      return acc;
+    },
+    {} as Record<string, string>,
+  );
+}
+
+export async function getUserFromSession(request: Request, env: StartupAPIEnv, cookieManager: CookieManager): Promise<any> {
+  const cookieHeader = request.headers.get('Cookie');
+  if (!cookieHeader) return null;
+
+  const cookies = parseCookies(cookieHeader);
+  const sessionCookieEncrypted = cookies['session_id'];
+  if (!sessionCookieEncrypted) return null;
+
+  const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
+  if (!sessionCookie || !sessionCookie.includes(':')) return null;
+
+  const [sessionId, doId] = sessionCookie.split(':');
+  try {
+    const id = env.USER.idFromString(doId);
+    const userStub = env.USER.get(id);
+    const result = await userStub.validateSession(sessionId);
+    if (result.valid) return { id: doId, sessionId, profile: result.profile, credential: result.credential };
+  } catch (_e) {
+    // ignore
+  }
+  return null;
+}
+
+export async function checkAndClearStaleSession(
+  request: Request,
+  env: StartupAPIEnv,
+  cookieManager: CookieManager,
+  originalResponse: Response,
+): Promise<Response> {
+  const cookieHeader = request.headers.get('Cookie');
+  if (!cookieHeader) return originalResponse;
+
+  const cookies = parseCookies(cookieHeader);
+  const sessionCookieEncrypted = cookies['session_id'];
+  if (!sessionCookieEncrypted) return originalResponse;
+
+  const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
+  if (!sessionCookie || !sessionCookie.includes(':')) return originalResponse;
+
+  const [sessionId, doId] = sessionCookie.split(':');
+  try {
+    const id = env.USER.idFromString(doId);
+    const userStub = env.USER.get(id);
+
+    // If we are here, it means getUserFromSession already returned null.
+    // We want to know IF it's because the user was deleted.
+    const profile = await userStub.getProfile();
+    if (Object.keys(profile).length === 0) {
+      // User was deleted! Clear session in DO and remove cookie.
+      await userStub.deleteSession(sessionId);
+
+      const headers = new Headers(originalResponse.headers);
+      headers.set('Set-Cookie', 'session_id=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0');
+
+      // If it was a redirect, we just update the headers
+      if (originalResponse.status === 301 || originalResponse.status === 302) {
+        return new Response(null, {
+          status: originalResponse.status,
+          headers,
+        });
+      }
+
+      // Otherwise return new response with same body/status but updated headers
+      return new Response(originalResponse.body, {
+        status: originalResponse.status,
+        headers,
+      });
+    }
+  } catch (_e) {
+    // ignore
+  }
+
+  return originalResponse;
+}

package/src/index.ts

@@ -0,0 +1,190 @@
+import { handleAuth } from './auth/index';
+import { injectPowerStrip } from './PowerStrip';
+import { UserDO } from './storage/UserDO';
+import { AccountDO } from './storage/AccountDO';
+import { SystemDO } from './storage/SystemDO';
+import { CredentialDO } from './storage/CredentialDO';
+import { CookieManager } from './CookieManager';
+import { initPlans } from './billing/plansConfig';
+import { getActiveProviders, parseCookies, getUserFromSession } from './handlers/utils';
+import { handleAdmin } from './handlers/admin';
+import {
+  handleMe,
+  handleUpdateProfile,
+  handleListCredentials,
+  handleDeleteCredential,
+  handleMeImage,
+  handleUserImage,
+} from './handlers/user';
+import { handleMyAccounts, handleSwitchAccount, handleAccountDetails, handleAccountImage, handleAccountMembers } from './handlers/account';
+import { handleLogout } from './handlers/auth';
+import { handleSSR } from './handlers/ssr';
+import { Plan } from './billing/Plan';
+
+const DEFAULT_USERS_PATH = '/users/';
+
+export { UserDO, AccountDO, SystemDO, CredentialDO };
+
+import type { StartupAPIEnv } from './StartupAPIEnv';
+
+export default {
+  /**
+   * Main Worker fetch handler.
+   */
+  async fetch(request: Request, env: StartupAPIEnv): Promise<Response> {
+    if (!Plan.isInitialized()) {
+      initPlans();
+    }
+
+    // Prevent infinite loops when serving assets
+    if (request.headers.has('x-skip-worker')) {
+      return env.ASSETS.fetch(request);
+    }
+
+    if (!env.ORIGIN_URL || !env.SESSION_SECRET) {
+      return env.ASSETS.fetch(request);
+    }
+
+    const url = new URL(request.url);
+    const usersPath = env.USERS_PATH || DEFAULT_USERS_PATH;
+
+    const cookieManager = new CookieManager(env.SESSION_SECRET);
+
+    // SSR Routes
+    const usersPathNormalized = usersPath.endsWith('/') ? usersPath : usersPath + '/';
+    if (url.pathname.startsWith(usersPathNormalized)) {
+      const subPath = url.pathname.slice(usersPathNormalized.length);
+      const isProfile = subPath === 'profile.html' || subPath === 'profile';
+      const isAccounts = subPath === 'accounts.html' || subPath === 'accounts';
+
+      if (isProfile || isAccounts) {
+        return handleSSR(request, env, url, usersPath, cookieManager);
+      }
+    }
+
+    // Handle OAuth Routes
+    if (url.pathname.startsWith(usersPath + 'auth/')) {
+      return handleAuth(request, env, url, usersPath, cookieManager);
+    }
+
+    if (url.pathname === usersPath + 'me/avatar') {
+      return handleMeImage(request, env, 'avatar', cookieManager);
+    }
+
+    // Handle API Routes
+    if (url.pathname.startsWith(usersPath + 'api/')) {
+      const apiPath = url.pathname.replace(usersPath + 'api/', '/');
+
+      if (apiPath === '/me') {
+        return handleMe(request, env, cookieManager);
+      }
+
+      if (apiPath === '/me/profile' && request.method === 'POST') {
+        return handleUpdateProfile(request, env, cookieManager);
+      }
+
+      if (apiPath === '/me/credentials') {
+        if (request.method === 'GET') {
+          return handleListCredentials(request, env, cookieManager);
+        } else if (request.method === 'DELETE') {
+          return handleDeleteCredential(request, env, cookieManager);
+        }
+      }
+
+      if (apiPath === '/stop-impersonation' && request.method === 'POST') {
+        const cookieHeader = request.headers.get('Cookie');
+        const cookies = parseCookies(cookieHeader || '');
+        const backupSessionEncrypted = cookies['backup_session_id'];
+
+        if (!backupSessionEncrypted) {
+          return new Response('No impersonation session found', { status: 400 });
+        }
+
+        const backupSession = await cookieManager.decrypt(backupSessionEncrypted);
+        if (!backupSession) {
+          return new Response('Invalid backup session', { status: 400 });
+        }
+
+        const headers = new Headers();
+        const newSessionIdEncrypted = await cookieManager.encrypt(backupSession);
+        headers.set('Set-Cookie', `session_id=${newSessionIdEncrypted}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+        headers.append('Set-Cookie', `backup_session_id=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+
+        return Response.json({ success: true }, { headers });
+      }
+
+      if (apiPath === '/me/accounts') {
+        return handleMyAccounts(request, env, cookieManager);
+      }
+
+      if (apiPath === '/me/accounts/switch' && request.method === 'POST') {
+        return handleSwitchAccount(request, env, cookieManager);
+      }
+
+      if (apiPath.startsWith('/me/accounts/')) {
+        const parts = apiPath.split('/');
+        if (parts.length === 4) {
+          return handleAccountDetails(request, env, parts[3], cookieManager);
+        }
+        if (parts.length === 5 && parts[4] === 'avatar') {
+          return handleAccountImage(request, env, parts[3], 'avatar', cookieManager);
+        }
+        if (parts.length >= 5 && parts[4] === 'members') {
+          return handleAccountMembers(request, env, parts[3], parts.slice(5), cookieManager);
+        }
+      }
+
+      if (apiPath.startsWith('/users/')) {
+        const parts = apiPath.split('/');
+        if (parts.length === 4 && parts[3] === 'avatar') {
+          return handleUserImage(request, env, parts[2], 'avatar', cookieManager);
+        }
+      }
+    }
+
+    if (url.pathname === usersPath + 'logout') {
+      return handleLogout(request, env, url, usersPath, cookieManager);
+    }
+
+    // Admin Routes
+    if (url.pathname.startsWith(usersPath + 'admin/')) {
+      return handleAdmin(request, env, usersPath, cookieManager);
+    }
+
+    // Intercept requests to usersPath and serve them from the public/users directory.
+    if (url.pathname.startsWith(usersPath)) {
+      url.pathname = url.pathname.replace(usersPath, '/users/');
+      const newRequest = new Request(url.toString(), request);
+      newRequest.headers.set('x-skip-worker', 'true');
+      return env.ASSETS.fetch(newRequest);
+    }
+
+    if (env.ORIGIN_URL) {
+      const originUrl = new URL(env.ORIGIN_URL);
+      url.protocol = originUrl.protocol;
+      url.host = originUrl.host;
+      url.port = originUrl.port;
+
+      const newRequest = new Request(url.toString(), request);
+      newRequest.headers.set('Host', url.host);
+
+      const user = await getUserFromSession(request, env, cookieManager);
+      if (user) {
+        newRequest.headers.set('X-StartupAPI-User-Id', user.id);
+        const userStub = env.USER.get(env.USER.idFromString(user.id));
+        const currentAccount = await userStub.getCurrentAccount();
+        if (currentAccount) {
+          newRequest.headers.set('X-StartupAPI-Account-Id', currentAccount.account_id);
+        }
+      }
+
+      const response = await fetch(newRequest);
+      const providers = getActiveProviders(env);
+
+      return injectPowerStrip(response, usersPath, providers);
+    }
+
+    // do not modify the request as it will loop through the same worker again
+    return env.ASSETS.fetch(request);
+  },
+} satisfies ExportedHandler<StartupAPIEnv>;

package/src/schemas/account.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+
+export const AccountInfoSchema = z.object({
+  id: z.string().optional(),
+  name: z.string().nullable().optional(),
+  plan: z.string().optional(),
+  personal: z.boolean().optional(),
+  billing: z.record(z.any()).optional(),
+});
+
+export type AccountInfo = z.infer<typeof AccountInfoSchema>;
+
+export const MemberSchema = z.object({
+  user_id: z.string(),
+  role: z.number(),
+  joined_at: z.number().optional(),
+  name: z.string().optional(),
+  picture: z.string().nullable().optional(),
+});
+
+export type Member = z.infer<typeof MemberSchema>;
+
+export const SystemAccountSchema = z.object({
+  id: z.string().optional(),
+  name: z.string().max(100),
+  status: z.string().optional(),
+  plan: z.string().optional(),
+  member_count: z.number().optional(),
+  created_at: z.number().optional(),
+  ownerId: z.string().optional(),
+});
+
+export type SystemAccount = z.infer<typeof SystemAccountSchema>;
+
+export const SwitchAccountSchema = z.object({
+  account_id: z.string(),
+});

package/src/schemas/admin.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+
+export const ImpersonateSchema = z
+  .object({
+    user_id: z.string().optional(),
+    userId: z.string().optional(),
+  })
+  .refine((data) => data.user_id || data.userId, {
+    message: 'Either user_id or userId must be provided',
+  });

package/src/schemas/billing.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+
+export const BillingStateSchema = z.object({
+  plan_slug: z.string(),
+  status: z.enum(['active', 'canceled', 'past_due', 'unpaid', 'trialing']),
+  schedule_idx: z.number().optional(),
+  next_billing_date: z.number().optional(),
+  next_plan_slug: z.string().optional(),
+});
+
+export type BillingState = z.infer<typeof BillingStateSchema>;

package/src/schemas/credential.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+
+export const CredentialSchema = z.object({
+  provider: z.string(),
+  subject_id: z.coerce.string(),
+});
+
+export const PublicCredentialSchema = z.object({
+  provider: z.string(),
+  subject_id: z.coerce.string(),
+  email: z.string().optional(),
+  created_at: z.number().optional(),
+});
+
+export type PublicCredential = z.infer<typeof PublicCredentialSchema>;
+
+export const OAuthCredentialSchema = z.object({
+  subject_id: z.coerce.string(),
+  user_id: z.coerce.string(),
+  access_token: z.string().nullable().optional(),
+  refresh_token: z.string().nullable().optional(),
+  expires_at: z.coerce.number().nullable().optional(),
+  scope: z
+    .union([z.string(), z.array(z.string())])
+    .transform((val) => (Array.isArray(val) ? val.join(' ') : val))
+    .nullable()
+    .optional(),
+  profile_data: z.record(z.any()).nullable().optional(),
+  created_at: z.number().optional(),
+  updated_at: z.number().optional(),
+});
+
+export type OAuthCredential = z.input<typeof OAuthCredentialSchema>;
+export type OAuthCredentialOutput = z.output<typeof OAuthCredentialSchema>;
+
+export const DeleteCredentialSchema = z.object({
+  provider: z.string(),
+});

package/src/schemas/membership.ts

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+
+export const MembershipSchema = z.object({
+  account_id: z.string(),
+  role: z.number().optional(),
+  is_current: z.boolean().optional(),
+});
+
+export type Membership = z.infer<typeof MembershipSchema>;

package/src/schemas/session.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+
+export const SessionSchema = z.object({
+  id: z.string(),
+  created_at: z.number(),
+  expires_at: z.number(),
+  meta: z.record(z.any()).nullable().optional(),
+});
+
+export type Session = z.infer<typeof SessionSchema>;

package/src/schemas/user.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+
+export const UserProfileSchema = z.object({
+  id: z.string().optional(),
+  name: z.coerce.string().optional(),
+  email: z.string().nullable().optional(),
+  picture: z.string().nullable().optional(),
+  provider: z.string().nullable().optional(),
+  verified_email: z.coerce.boolean().optional(),
+});
+
+export type UserProfile = z.infer<typeof UserProfileSchema>;
+
+export const SystemUserSchema = z.object({
+  id: z.string(),
+  name: z.coerce.string(),
+  email: z.string().nullable().optional(),
+  provider: z.string().nullable().optional(),
+  created_at: z.number().optional(),
+});
+
+export type SystemUser = z.infer<typeof SystemUserSchema>;