@taskforcehq/taskforce 0.3.168

package/dist/server/routes.billing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/routes.billing.test.js

@@ -0,0 +1,387 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Readable } from 'stream';
+import Database from 'better-sqlite3';
+import { registerBillingRoutes } from './routes.billing';
+const mockConstructEvent = vi.fn();
+const mockPricesList = vi.fn(async () => ({ data: [], has_more: false }));
+const mockCheckoutCreate = vi.fn(async () => ({ id: 'cs_test', url: 'https://example.test/checkout' }));
+const mockPortalCreate = vi.fn(async () => ({ id: 'bps_test', url: 'https://example.test/portal' }));
+const mockSubscriptionCancel = vi.fn(async () => ({ id: 'sub_test', status: 'canceled' }));
+vi.mock('stripe', () => ({
+    default: class StripeMock {
+        webhooks = {
+            constructEvent: mockConstructEvent
+        };
+        prices = {
+            list: mockPricesList
+        };
+        checkout = {
+            sessions: {
+                create: mockCheckoutCreate
+            }
+        };
+        billingPortal = {
+            sessions: {
+                create: mockPortalCreate
+            }
+        };
+        subscriptions = {
+            cancel: mockSubscriptionCancel
+        };
+        constructor(_apiKey) { }
+    }
+}));
+function createMockReq(body, headers = {}) {
+    const req = Readable.from([Buffer.from(body, 'utf8')]);
+    req.headers = headers;
+    return req;
+}
+function createMockRes() {
+    const response = {
+        statusCode: 200,
+        headers: {},
+        body: '',
+        writeHead: vi.fn((statusCode, headers) => {
+            response.statusCode = statusCode;
+            response.headers = headers || {};
+            return response;
+        }),
+        end: vi.fn((payload) => {
+            response.body = String(payload || '');
+            return response;
+        })
+    };
+    return response;
+}
+function setupBillingSchema(db) {
+    db.exec(`
+        CREATE TABLE user_billing (
+            user_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            stripe_customer_id TEXT,
+            stripe_subscription_id TEXT,
+            stripe_price_id TEXT,
+            stripe_status TEXT,
+            tier TEXT NOT NULL DEFAULT 'free',
+            billing_interval TEXT,
+            entitlement_state TEXT NOT NULL DEFAULT 'free',
+            trial_end TEXT,
+            current_period_end TEXT,
+            effective_until TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        );
+        CREATE TABLE stripe_webhook_events (
+            event_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            event_type TEXT NOT NULL,
+            processed_at TEXT NOT NULL
+        );
+        CREATE TABLE stripe_webhook_failures (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            event_id TEXT NOT NULL,
+            event_type TEXT,
+            reason TEXT NOT NULL,
+            payload_excerpt TEXT,
+            purge_after TEXT NOT NULL,
+            created_at TEXT NOT NULL
+        );
+        CREATE TABLE billing_price_mappings (
+            tenant_id TEXT NOT NULL,
+            plan_version_id TEXT NOT NULL,
+            billing_interval TEXT NOT NULL,
+            stripe_price_id TEXT NOT NULL,
+            active INTEGER NOT NULL DEFAULT 1,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, stripe_price_id)
+        );
+        CREATE TABLE plan_versions (
+            plan_version_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            plan_id TEXT NOT NULL,
+            version_number INTEGER NOT NULL,
+            is_default INTEGER NOT NULL DEFAULT 0,
+            seat_limit INTEGER,
+            metadata_json TEXT NOT NULL DEFAULT '{}',
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        );
+        CREATE TABLE account_entitlements (
+            account_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL,
+            plan_version_id TEXT NOT NULL,
+            entitlement_state TEXT NOT NULL DEFAULT 'active',
+            effective_at TEXT,
+            effective_until TEXT,
+            updated_by TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        );
+        CREATE TABLE system_settings (
+            tenant_id TEXT NOT NULL,
+            settings_key TEXT NOT NULL,
+            payload TEXT,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, settings_key)
+        );
+    `);
+}
+function buildBillingRouteHandlers(db, opts) {
+    const routes = new Map();
+    const tenantId = 'default';
+    const core = {
+        getDatabaseAdapter: () => db,
+        getTenantId: () => tenantId,
+        createUserBillingRecord: (userId) => {
+            const now = new Date().toISOString();
+            db.prepare(`
+                INSERT INTO user_billing (
+                    user_id, tenant_id, tier, entitlement_state, created_at, updated_at
+                ) VALUES (?, ?, 'free', 'free', ?, ?)
+                ON CONFLICT (user_id) DO NOTHING
+            `).run(userId, tenantId, now, now);
+        }
+    };
+    registerBillingRoutes({
+        addRoute: (method, path, handler) => routes.set(`${method} ${path}`, handler),
+        core,
+        context: {
+            getRuntimeMode: () => 'cloud'
+        },
+        ensureAuthenticatedUser: () => true,
+        ensureAdminRole: () => opts?.isAdmin !== false,
+        requestUserId: () => 'u1',
+        resolveErrorStatusCode: (_error, fallback = 500) => fallback,
+        auditAdminAction: () => { }
+    });
+    return routes;
+}
+describe('Billing Webhook Routes', () => {
+    const originalEnv = { ...process.env };
+    let db;
+    let webhookHandler;
+    let routeHandlers;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        db = new Database(':memory:');
+        setupBillingSchema(db);
+        routeHandlers = buildBillingRouteHandlers(db);
+        webhookHandler = routeHandlers.get('POST /api/taskforce/billing/webhook');
+        process.env.TASKFORCE_BILLING_ENABLED = 'true';
+        process.env.TASKFORCE_STRIPE_SECRET_KEY = 'sk_test_123';
+        process.env.TASKFORCE_STRIPE_WEBHOOK_SECRET = 'whsec_123';
+    });
+    afterEach(() => {
+        process.env = { ...originalEnv };
+        db.close();
+    });
+    it('returns 400 for invalid webhook signature', async () => {
+        mockConstructEvent.mockImplementation(() => {
+            throw new Error('invalid signature');
+        });
+        const req = createMockReq('{"id":"evt_bad"}', {
+            'x-taskforce-runtime-mode': 'cloud',
+            'stripe-signature': 'bad_signature'
+        });
+        const res = createMockRes();
+        await webhookHandler(req, res, {});
+        expect(res.statusCode).toBe(400);
+    });
+    it('returns 200 no-op for duplicate event id', async () => {
+        const now = new Date().toISOString();
+        db.prepare(`
+            INSERT INTO stripe_webhook_events (event_id, tenant_id, event_type, processed_at)
+            VALUES (?, 'default', ?, ?)
+        `).run('evt_dupe', 'invoice.paid', now);
+        mockConstructEvent.mockReturnValue({
+            id: 'evt_dupe',
+            type: 'invoice.paid',
+            data: {
+                object: {
+                    customer: 'cus_1',
+                    lines: { data: [{ price: { id: 'price_1', recurring: { interval: 'month' } } }] }
+                }
+            }
+        });
+        const req = createMockReq('{"id":"evt_dupe"}', {
+            'x-taskforce-runtime-mode': 'cloud',
+            'stripe-signature': 'sig'
+        });
+        const res = createMockRes();
+        await webhookHandler(req, res, {});
+        expect(res.statusCode).toBe(200);
+        expect(JSON.parse(res.body)).toEqual({ received: true, duplicate: true });
+    });
+    it('returns 500 on processing failure so Stripe can retry', async () => {
+        mockConstructEvent.mockReturnValue({
+            id: 'evt_fail',
+            type: 'invoice.paid',
+            data: {
+                object: {
+                    customer: 'cus_missing',
+                    lines: { data: [{ price: { id: 'price_1', recurring: { interval: 'month' } } }] }
+                }
+            }
+        });
+        const req = createMockReq('{"id":"evt_fail"}', {
+            'x-taskforce-runtime-mode': 'cloud',
+            'stripe-signature': 'sig'
+        });
+        const res = createMockRes();
+        await webhookHandler(req, res, {});
+        expect(res.statusCode).toBe(500);
+        const failures = db.prepare(`SELECT event_id, reason FROM stripe_webhook_failures WHERE event_id = ?`).all('evt_fail');
+        expect(failures.length).toBeGreaterThan(0);
+        expect(failures[0]?.reason || '').toContain('Unable to resolve user for invoice event.');
+    });
+    it('preserves existing entitlement on unknown price_id and logs failure', async () => {
+        const now = new Date().toISOString();
+        db.prepare(`
+            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
+            VALUES ('u1', 'default', 'cus_123', 'free', ?, ?)
+        `).run(now, now);
+        db.prepare(`
+            INSERT INTO account_entitlements (
+                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
+            ) VALUES ('u1', 'default', 'starter-v1', 'active', ?, ?, ?)
+        `).run(now, now, now);
+        mockConstructEvent.mockReturnValue({
+            id: 'evt_unknown_price',
+            type: 'customer.subscription.updated',
+            data: {
+                object: {
+                    id: 'sub_123',
+                    customer: 'cus_123',
+                    status: 'active',
+                    trial_end: null,
+                    metadata: {},
+                    items: {
+                        data: [{
+                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
+                                price: { id: 'price_unknown', recurring: { interval: 'month' } }
+                            }]
+                    }
+                }
+            }
+        });
+        const req = createMockReq('{"id":"evt_unknown_price"}', {
+            'x-taskforce-runtime-mode': 'cloud',
+            'stripe-signature': 'sig'
+        });
+        const res = createMockRes();
+        await webhookHandler(req, res, {});
+        expect(res.statusCode).toBe(200);
+        const entitlement = db.prepare(`
+            SELECT plan_version_id
+            FROM account_entitlements
+            WHERE account_id = 'u1' AND tenant_id = 'default'
+        `).get();
+        expect(entitlement.plan_version_id).toBe('starter-v1');
+        const failure = db.prepare(`
+            SELECT reason
+            FROM stripe_webhook_failures
+            WHERE event_id = 'evt_unknown_price'
+            ORDER BY created_at DESC
+            LIMIT 1
+        `).get();
+        expect(failure.reason).toContain('Unknown price mapping');
+    });
+    it('purges expired webhook failures during webhook processing', async () => {
+        const past = new Date(Date.now() - 48 * 60 * 60 * 1000).toISOString();
+        const now = new Date().toISOString();
+        db.prepare(`
+            INSERT INTO stripe_webhook_failures (id, tenant_id, event_id, event_type, reason, payload_excerpt, purge_after, created_at)
+            VALUES ('whf_old', 'default', 'evt_old', 'invoice.paid', 'old', '{}', ?, ?)
+        `).run(past, now);
+        db.prepare(`
+            INSERT INTO stripe_webhook_events (event_id, tenant_id, event_type, processed_at)
+            VALUES ('evt_dup_for_purge', 'default', 'invoice.paid', ?)
+        `).run(now);
+        mockConstructEvent.mockReturnValue({
+            id: 'evt_dup_for_purge',
+            type: 'invoice.paid',
+            data: { object: { customer: 'cus_1', lines: { data: [] } } }
+        });
+        const req = createMockReq('{"id":"evt_dup_for_purge"}', {
+            'x-taskforce-runtime-mode': 'cloud',
+            'stripe-signature': 'sig'
+        });
+        const res = createMockRes();
+        await webhookHandler(req, res, {});
+        expect(res.statusCode).toBe(200);
+        const row = db.prepare(`SELECT id FROM stripe_webhook_failures WHERE id = 'whf_old'`).get();
+        expect(row).toBeUndefined();
+    });
+    it('creates checkout session with billing success/cancel URLs', async () => {
+        const now = new Date().toISOString();
+        db.prepare(`
+            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
+            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
+        `).run(now, now);
+        db.prepare(`
+            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
+            VALUES ('default', 'team-v1', 'month', 'price_team_month', 1, ?, ?)
+        `).run(now, now);
+        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
+        expect(checkoutHandler).toBeTypeOf('function');
+        const req = createMockReq(JSON.stringify({
+            tier: 'team',
+            interval: 'month'
+        }), {
+            'x-taskforce-runtime-mode': 'cloud',
+            host: 'app.taskforcehq.ai'
+        });
+        const res = createMockRes();
+        await checkoutHandler(req, res, {});
+        expect(res.statusCode).toBe(200);
+        expect(mockCheckoutCreate).toHaveBeenCalledTimes(1);
+        const firstCall = mockCheckoutCreate.mock.calls[0];
+        const args = (Array.isArray(firstCall) ? firstCall[0] : {});
+        expect(String(args.success_url || '')).toContain('/billing/success');
+        expect(String(args.cancel_url || '')).toContain('/billing/cancel');
+        expect(args.line_items?.[0]?.price).toBe('price_team_month');
+    });
+    it('lists webhook failure diagnostics for system admin', async () => {
+        const now = new Date().toISOString();
+        const old = new Date(Date.now() - 48 * 60 * 60 * 1000).toISOString();
+        db.prepare(`
+            INSERT INTO stripe_webhook_failures (id, tenant_id, event_id, event_type, reason, payload_excerpt, purge_after, created_at)
+            VALUES ('whf_keep_1', 'default', 'evt_1', 'invoice.paid', 'diagnostic-1', '{"id":"evt_1"}', ?, ?)
+        `).run(new Date(Date.now() + 48 * 60 * 60 * 1000).toISOString(), now);
+        db.prepare(`
+            INSERT INTO stripe_webhook_failures (id, tenant_id, event_id, event_type, reason, payload_excerpt, purge_after, created_at)
+            VALUES ('whf_purge_1', 'default', 'evt_old', 'invoice.paid', 'diagnostic-old', '{"id":"evt_old"}', ?, ?)
+        `).run(old, now);
+        const route = routeHandlers.get('GET /api/taskforce/admin/billing/webhook-failures');
+        expect(route).toBeTypeOf('function');
+        const req = createMockReq('', {
+            'x-taskforce-runtime-mode': 'cloud'
+        });
+        req.url = '/api/taskforce/admin/billing/webhook-failures?limit=10';
+        const res = createMockRes();
+        await route(req, res, {});
+        expect(res.statusCode).toBe(200);
+        const payload = JSON.parse(res.body);
+        expect(payload.purgedExpiredRows).toBeGreaterThanOrEqual(1);
+        expect(payload.total).toBeGreaterThanOrEqual(1);
+        expect(Array.isArray(payload.rows)).toBe(true);
+        expect(payload.rows[0]).toEqual(expect.objectContaining({
+            event_id: 'evt_1',
+            reason: 'diagnostic-1'
+        }));
+    });
+    it('rejects webhook failure diagnostics for non-admin', async () => {
+        const nonAdminHandlers = buildBillingRouteHandlers(db, { isAdmin: false });
+        const route = nonAdminHandlers.get('GET /api/taskforce/admin/billing/webhook-failures');
+        expect(route).toBeTypeOf('function');
+        const req = createMockReq('', {
+            'x-taskforce-runtime-mode': 'cloud'
+        });
+        req.url = '/api/taskforce/admin/billing/webhook-failures';
+        const res = createMockRes();
+        await route(req, res, {});
+        expect(res.statusCode).toBe(403);
+    });
+});

package/dist/server/routes.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Taskforce API Routes
+ *
+ * Extracted from vite.ts plugin to be reusable in both Vite plugin and standalone server.
+ * This is a minimal implementation with core routes - additional routes can be added incrementally.
+ */
+import { IncomingMessage, ServerResponse } from 'http';
+import { TaskforceCore } from '../core/Taskforce.js';
+import { type TaskforceAuthConfig } from './auth.js';
+import { type ResolvedObjectStorageConfig } from '../storage/objectStorage.js';
+export type RouteHandler = (req: IncomingMessage, res: ServerResponse, params: Record<string, string>) => Promise<void>;
+export interface Route {
+    pattern: RegExp;
+    keys: string[];
+    handler: RouteHandler;
+}
+export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<any>;
+/**
+ * Create API routes for Taskforce
+ *
+ * Core routes (29 total):
+ *
+ * **Task Management (12 routes)**
+ * - GET /api/taskforce/config
+ * - GET /api/taskforce/tasks
+ * - POST /api/taskforce/task
+ * - PATCH /api/taskforce/task/:id
+ * - DELETE /api/taskforce/task/:id
+ * - GET /api/taskforce/archive
+ * - POST /api/taskforce/task/:id/complete
+ * - POST /api/taskforce/task/:id/cancel
+ * - POST /api/taskforce/task/:id/comment
+ * - POST /api/taskforce/task/:id/unarchive
+ * - POST /api/taskforce/bulk-create
+ * - POST /api/taskforce/bulk-archive
+ * - POST /api/taskforce/bulk-update-fields
+ * - POST /api/taskforce/bulk-update-fields/preview
+ *
+ * **Configuration Management (10 routes)**
+ * - GET /api/taskforce/categories
+ * - POST /api/taskforce/categories
+ * - GET /api/taskforce/types
+ * - POST /api/taskforce/types
+ * - GET /api/taskforce/priorities
+ * - POST /api/taskforce/priorities
+ * - GET /api/taskforce/approaches
+ * - POST /api/taskforce/approaches
+ * - GET /api/taskforce/taxonomies
+ * - POST /api/taskforce/taxonomies
+ * - GET /api/taskforce/initiative-templates
+ * - POST /api/taskforce/initiative-templates/create
+ * - POST /api/taskforce/initiative-templates/clone-checklists
+ *
+ * **Advanced Features (7 routes)**
+ * - POST /api/taskforce/screenshot
+ * - GET /api/taskforce/screenshot/:filename
+ * - DELETE /api/taskforce/screenshot/:filename
+ * - GET /api/taskforce/specialists
+ * - GET /api/taskforce/folders
+ * - POST /api/taskforce/validate-paths
+ * - POST /api/taskforce/export-resources
+ * - GET /api/taskforce/health
+ */
+export interface RouteContext {
+    authConfig?: TaskforceAuthConfig;
+    objectStorage?: ResolvedObjectStorageConfig;
+}
+export declare function createRoutes(core: TaskforceCore, context?: RouteContext): Route[];
+export declare function matchRoute(method: string, pathname: string, routes: Route[]): {
+    handler: RouteHandler;
+    params: Record<string, string>;
+} | null;