@taskforcehq/taskforce 0.3.302 → 0.3.304

package/dist/server/routes/auth.js

@@ -20,6 +20,7 @@
  *   POST /api/taskforce/auth/invite/join
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/profile-summary
  *   GET  /api/taskforce/account/entitlements
  *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview
@@ -73,6 +74,121 @@ export function registerAuthRoutes(deps) {
         const stateAllows = state === 'active' || state === 'trialing' || state === 'grace';
         return teamAllowed && stateAllows ? 'team' : 'personal';
     };
+    const resolveBillingConflictCodeForUser = (userIdRaw, gateRaw) => {
+        const userId = String(userIdRaw || '').trim();
+        const gate = String(gateRaw || '').trim().toLowerCase();
+        if (!userId || !gate || gate === 'ok')
+            return null;
+        const db = core.getDatabaseAdapter();
+        const tenantId = core.getTenantId();
+        try {
+            const row = db.prepare(`
+                SELECT session_id, status, expires_at
+                FROM billing_checkout_attempts
+                WHERE tenant_id = ? AND user_id = ?
+                ORDER BY created_at DESC, session_id DESC
+                LIMIT 1
+            `).get(tenantId, userId);
+            const sessionId = String(row?.session_id || '').trim();
+            const status = String(row?.status || '').trim().toLowerCase();
+            const expiresAt = String(row?.expires_at || '').trim();
+            if (!sessionId)
+                return null;
+            if (status === 'open' && expiresAt) {
+                const expiresAtMs = Date.parse(expiresAt);
+                if (Number.isFinite(expiresAtMs) && expiresAtMs <= Date.now()) {
+                    db.prepare(`
+                        UPDATE billing_checkout_attempts
+                        SET status = 'expired', updated_at = ?
+                        WHERE tenant_id = ? AND session_id = ?
+                    `).run(new Date().toISOString(), tenantId, sessionId);
+                    return 'CHECKOUT_SESSION_EXPIRED';
+                }
+            }
+            if (status === 'expired')
+                return 'CHECKOUT_SESSION_EXPIRED';
+            if (status === 'superseded')
+                return 'CHECKOUT_SESSION_SUPERSEDED';
+        }
+        catch {
+            return null;
+        }
+        return null;
+    };
+    const buildAccountProfileSummary = (req) => {
+        const userId = requestUserId(req);
+        const workspaceId = requestWorkspaceId(req);
+        const access = core.getAccountAccessStatus(userId);
+        const resolvedAccess = core.resolveUserAccess(userId, workspaceId, 'member');
+        const hintedRole = normalizeTeamWorkspaceRole(requestHeader(req, 'x-taskforce-workspace-role', ''));
+        const workspaceRole = normalizeTeamWorkspaceRole(resolvedAccess?.role || hintedRole || null);
+        const canManageWorkspace = workspaceRole === 'owner' || workspaceRole === 'admin';
+        const db = core.getDatabaseAdapter();
+        const tenantId = core.getTenantId();
+        let billingRow;
+        try {
+            billingRow = db.prepare(`
+                SELECT stripe_status, stripe_customer_id, stripe_subscription_id, stripe_price_id, billing_interval,
+                       trial_end, current_period_end, effective_until, entitlement_state, tier
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get(tenantId, userId);
+        }
+        catch {
+            billingRow = undefined;
+        }
+        const planId = String(access.entitlement?.planId || billingRow?.tier || '').trim() || null;
+        const planVersionId = String(access.entitlement?.planVersionId || '').trim() || null;
+        let planRow;
+        if (planId) {
+            try {
+                planRow = db.prepare(`
+                    SELECT display_name
+                    FROM plan_catalog
+                    WHERE tenant_id = ? AND plan_id = ?
+                    LIMIT 1
+                `).get(tenantId, planId);
+            }
+            catch {
+                planRow = undefined;
+            }
+        }
+        let teamPlanMode = 'unknown';
+        try {
+            const entitlements = core.getAccountEntitlementsPayload({ userId, workspaceId });
+            teamPlanMode = resolveTeamPlanModeFromEntitlements(entitlements);
+        }
+        catch (error) {
+            if (error?.code === 'ENTITLEMENT_NOT_FOUND' && (access.gate === 'plan_selection_required' || access.gate === 'checkout_pending')) {
+                teamPlanMode = 'personal';
+            }
+        }
+        const billingConflictCode = resolveBillingConflictCodeForUser(userId, access.gate);
+        return {
+            stripeStatus: billingRow?.stripe_status || null,
+            stripeCustomerId: billingRow?.stripe_customer_id || null,
+            stripeSubscriptionId: billingRow?.stripe_subscription_id || null,
+            stripePriceId: billingRow?.stripe_price_id || null,
+            billingInterval: billingRow?.billing_interval || null,
+            trialEnd: billingRow?.trial_end || null,
+            currentPeriodEnd: billingRow?.current_period_end || null,
+            effectiveUntil: billingRow?.effective_until || null,
+            entitlementState: access.entitlement?.state || billingRow?.entitlement_state || null,
+            planVersionId,
+            planId,
+            planName: planRow?.display_name ? String(planRow.display_name) : planId,
+            gate: access.gate,
+            message: access.message,
+            billingConflictCode,
+            planSelectionRequired: access.planSelectionRequired,
+            workspaceId,
+            workspaceRole,
+            canManageWorkspace,
+            teamPlanMode,
+            teamManagementAllowed: canManageWorkspace && teamPlanMode === 'team'
+        };
+    };
     // === SECTION: Email delivery helpers ===
     const getEmailConfig = () => {
         if (context.authConfig?.runtimeMode !== 'cloud') {
@@ -86,7 +202,7 @@ export function registerAuthRoutes(deps) {
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
             allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
             requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
@@ -98,8 +214,8 @@ export function registerAuthRoutes(deps) {
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const getSiteBehavior = () => {
@@ -110,6 +226,23 @@ export function registerAuthRoutes(deps) {
             pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
         };
     };
+    const buildPasswordSessionCookieForUser = (req, authConfig, userIdRaw, options) => {
+        const userId = String(userIdRaw || '').trim();
+        const fallbackRole = String(options?.fallbackRole || authConfig.defaultRole || 'member').trim() || 'member';
+        const resolvedWorkspaceId = core.resolvePreferredUserWorkspaceId(userId, {
+            preferredWorkspaceId: options?.preferredWorkspaceId || null,
+            persistedWorkspaceId: options?.persistedWorkspaceId || null
+        });
+        const access = resolvedWorkspaceId
+            ? core.resolveUserAccess(userId, resolvedWorkspaceId, fallbackRole)
+            : null;
+        return createSessionTokenCookie(`pwd:${userId}`, authConfig, {
+            role: (access?.role || fallbackRole),
+            workspaceId: access?.workspaceId || '',
+            userId,
+            ...resolveSessionCookieAttributesForRequest(req, authConfig)
+        });
+    };
     const AVATAR_DRAFT_RETENTION_MS = 24 * 60 * 60 * 1000;
     const MAX_AVATAR_UPLOAD_BYTES = 5 * 1024 * 1024;
     const AVATAR_MIME_EXTENSION = {
@@ -175,7 +308,7 @@ export function registerAuthRoutes(deps) {
             ? 'Verify your Taskforce account'
             : 'Reset your Taskforce password';
         const text = kind === 'verify-email'
-            ? `Welcome to Taskforce.\n\nVerify your email by opening this link:\n${link}\n\nIf you did not create an account, you can ignore this message.`
+            ? `Welcome to Taskforce.\n\nYou're almost in. Enter this verification token on the verification screen to activate your account:\n\n${token}\n\nPrefer the faster route? Open the link below to verify your email automatically:\n${link}\n\nIf you didn't create a Taskforce account, you can safely ignore this email.`
             : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
         const result = await sendEmail({
             to: email,
@@ -268,7 +401,8 @@ export function registerAuthRoutes(deps) {
         let avatarUrl = null;
         let betaAccess = true;
         if (authenticated && access?.userId) {
-            await cleanupStaleAvatarDrafts(access.userId);
+            // Keep the session endpoint fast on reload; avatar draft cleanup is best-effort housekeeping.
+            void cleanupStaleAvatarDrafts(access.userId).catch(() => { });
             betaAccess = core.getUserBetaAccess(access.userId);
             const resolved = core.resolveUserAccess(access.userId, workspaceId, role);
             if (resolved) {
@@ -643,7 +777,7 @@ export function registerAuthRoutes(deps) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: false, error: 'Email and password are required.' }));
     });
-    // POST /api/taskforce/auth/register - Create account and exchange for secure session cookie
+    // POST /api/taskforce/auth/register - Create account and optionally start a session
     addRoute('POST', '/api/taskforce/auth/register', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
@@ -693,13 +827,6 @@ export function registerAuthRoutes(deps) {
                 role,
                 betaAccess: authBehavior.defaultNewUserBetaAccess
             });
-            const sessionWorkspaceId = created.workspaceId || '';
-            const cookie = createSessionTokenCookie(`pwd:${created.userId}`, authConfig, {
-                role: created.role,
-                workspaceId: sessionWorkspaceId,
-                userId: created.userId,
-                ...resolveSessionCookieAttributesForRequest(req, authConfig)
-            });
             let emailSent = true;
             let emailError;
             let verificationToken;
@@ -719,7 +846,13 @@ export function registerAuthRoutes(deps) {
                 role: created.role,
                 emailSent
             });
-            res.setHeader('Set-Cookie', cookie);
+            if (!authBehavior.requireVerifiedEmail) {
+                res.setHeader('Set-Cookie', buildPasswordSessionCookieForUser(req, authConfig, created.userId, {
+                    preferredWorkspaceId: created.workspaceId || null,
+                    persistedWorkspaceId: created.workspaceId || null,
+                    fallbackRole: created.role
+                }));
+            }
             res.writeHead(201, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 success: true,
@@ -727,6 +860,8 @@ export function registerAuthRoutes(deps) {
                 role: created.role,
                 workspaceSetupRequired: !created.workspaceId,
                 planSelectionRequired: created.planSelectionRequired === true,
+                checkoutPending: created.checkoutPending === true,
+                commercialState: created.commercialState,
                 verificationRequired: authBehavior.requireVerifiedEmail,
                 emailSent,
                 emailError,
@@ -736,6 +871,40 @@ export function registerAuthRoutes(deps) {
             }));
         }
         catch (error) {
+            if (error?.code === 'EMAIL_ALREADY_EXISTS'
+                && authBehavior.requireVerifiedEmail
+                && email
+                && !core.isEmailVerified(email)) {
+                let emailSent = true;
+                let emailError;
+                let verificationToken;
+                const verification = core.requestEmailVerification({ email });
+                verificationToken = verification.token || null;
+                if (verification.token) {
+                    const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
+                    emailSent = delivery.ok;
+                    emailError = delivery.error;
+                }
+                auditAuthAction(req, 'auth-register-existing-unverified', {
+                    email,
+                    workspaceId: workspaceIdInput || null,
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    emailSent
+                });
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    success: false,
+                    error: 'This email already has an unverified account. Continue with email verification instead.',
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    verificationRequired: true,
+                    emailSent,
+                    emailError,
+                    verificationToken: shouldExposeDevAuthTokens()
+                        ? (verificationToken || null)
+                        : undefined
+                }));
+                return;
+            }
             const statusCode = Number(error?.statusCode || 400);
             const message = String(error?.message || 'Unable to register');
             auditAuthAction(req, 'auth-register-failed', {
@@ -794,6 +963,12 @@ export function registerAuthRoutes(deps) {
     addRoute('POST', '/api/taskforce/auth/verify-email/confirm', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
+        const authConfig = context.authConfig;
+        if (!authConfig?.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication is not configured.' }));
+            return;
+        }
         const body = await parseJsonBody(req);
         const token = String(body?.token || '').trim();
         if (!token) {
@@ -801,6 +976,15 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: 'Token is required.' }));
             return;
         }
+        const inspection = core.inspectOneTimeAuthToken(token, 'email_verification');
+        if (!inspection.userId) {
+            auditAuthAction(req, 'auth-verify-confirm-failed', {
+                tokenProvided: true
+            });
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Invalid or expired token.' }));
+            return;
+        }
         const verified = core.verifyEmailWithToken(token);
         if (!verified) {
             auditAuthAction(req, 'auth-verify-confirm-failed', {
@@ -813,6 +997,11 @@ export function registerAuthRoutes(deps) {
         auditAuthAction(req, 'auth-verify-confirm-success', {
             tokenProvided: true
         });
+        const cookie = buildPasswordSessionCookieForUser(req, authConfig, inspection.userId, {
+            preferredWorkspaceId: inspection.workspaceId || null,
+            persistedWorkspaceId: inspection.workspaceId || null
+        });
+        res.setHeader('Set-Cookie', cookie);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
@@ -1098,6 +1287,24 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account access status'), code: error?.code, details: error?.details }));
         }
     });
+    // GET /api/taskforce/account/profile-summary - Fast authoritative summary for the visible account surface.
+    addRoute('GET', '/api/taskforce/account/profile-summary', async (req, res) => {
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const payload = buildAccountProfileSummary(req);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(payload));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account profile summary'), code: error?.code, details: error?.details }));
+        }
+    });
     // GET /api/taskforce/account/entitlements - Resolve effective plan/features for the active workspace.
     addRoute('GET', '/api/taskforce/account/entitlements', async (req, res) => {
         if (!ensureAuthenticatedUser(req)) {
@@ -1115,11 +1322,11 @@ export function registerAuthRoutes(deps) {
         catch (error) {
             if (error?.code === 'ENTITLEMENT_NOT_FOUND') {
                 const access = core.getAccountAccessStatus(requestUserId(req));
-                if (access.gate === 'plan_selection_required') {
+                if (access.gate === 'plan_selection_required' || access.gate === 'checkout_pending') {
                     res.writeHead(403, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
                         error: access.message,
-                        code: 'PLAN_SELECTION_REQUIRED',
+                        code: access.gate === 'checkout_pending' ? 'CHECKOUT_PENDING' : 'PLAN_SELECTION_REQUIRED',
                         details: {
                             gate: access.gate,
                             planSelectionRequired: access.planSelectionRequired,
@@ -1141,51 +1348,20 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: 'Authentication required.' }));
             return;
         }
-        const wid = requestWorkspaceId(req);
-        const userId = requestUserId(req);
-        const hintedRole = normalizeTeamWorkspaceRole(requestHeader(req, 'x-taskforce-workspace-role', ''));
-        const resolvedAccess = core.resolveUserAccess(userId, wid, 'member');
-        const role = normalizeTeamWorkspaceRole(resolvedAccess?.role || hintedRole || null);
-        const canManageWorkspace = role === 'owner' || role === 'admin';
-        if (!canManageWorkspace) {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                workspaceId: wid,
-                role,
-                canManageWorkspace: false,
-                teamPlanMode: 'unknown',
-                allowed: false
-            }));
-            return;
-        }
         try {
-            const entitlements = core.getAccountEntitlementsPayload({ userId, workspaceId: wid });
-            const teamPlanMode = resolveTeamPlanModeFromEntitlements(entitlements);
+            const payload = buildAccountProfileSummary(req);
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
-                workspaceId: wid,
-                role,
-                canManageWorkspace: true,
-                teamPlanMode,
-                allowed: teamPlanMode === 'team'
+                workspaceId: payload.workspaceId,
+                role: payload.workspaceRole,
+                canManageWorkspace: payload.canManageWorkspace,
+                teamPlanMode: payload.teamPlanMode,
+                allowed: payload.teamManagementAllowed,
+                gate: payload.gate,
+                planSelectionRequired: payload.planSelectionRequired
             }));
         }
         catch (error) {
-            if (error?.code === 'ENTITLEMENT_NOT_FOUND') {
-                const access = core.getAccountAccessStatus(userId);
-                const teamPlanMode = access.gate === 'plan_selection_required' ? 'personal' : 'unknown';
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    workspaceId: wid,
-                    role,
-                    canManageWorkspace: true,
-                    teamPlanMode,
-                    allowed: false,
-                    gate: access.gate,
-                    planSelectionRequired: access.planSelectionRequired
-                }));
-                return;
-            }
             const statusCode = resolveErrorStatusCode(error, 400);
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve team management access'), code: error?.code, details: error?.details }));