@tollwyn/baukasten 0.0.2 → 1.2.2

package/dist/server/adapter/migrate.js

@@ -0,0 +1,113 @@
+// One advisory lock, so that two starts never apply a file twice. Both layers are checked before
+// anything changes; each file runs in its own transaction together with its row in the list of its
+// layer.
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import pg from 'pg';
+import { migrationFiles, plan } from '../migrations.js';
+import { SHOPIFY_MIGRATIONS } from '../../shopify/migrations.js';
+import { BAUKASTEN_MIGRATIONS } from '../baukasten-migrations.js';
+/**
+ * The list of the applied migrations of each layer: the migration command lays that of the baukasten,
+ * the first file of the baukasten that of the product.
+ */
+const LEDGER = {
+    baukasten: 'baukasten.migrations',
+    product: 'baukasten.product_migrations'
+};
+/** Any number, the same in every product; it only has to differ from other locks of the database. */
+const LOCK = 7_270_011_001;
+const LAYER = {
+    webapp: BAUKASTEN_MIGRATIONS,
+    shopify: SHOPIFY_MIGRATIONS
+};
+export function migrationSources(root, art) {
+    return { baukasten: LAYER[art], product: path.join(root, 'migrations') };
+}
+async function productFiles(dir) {
+    if (!existsSync(dir))
+        return [];
+    const names = await readdir(dir);
+    const entries = await Promise.all(names.map(async (name) => ({ name, sql: await readFile(path.join(dir, name), 'utf8') })));
+    return migrationFiles('product', entries);
+}
+async function applied(db, layer) {
+    const list = await db.query('SELECT 1 AS found WHERE to_regclass($1) IS NOT NULL', [
+        LEDGER[layer]
+    ]);
+    if (list.length === 0)
+        return [];
+    return db.query(`SELECT name, checksum FROM ${LEDGER[layer]} ORDER BY name`);
+}
+async function plans(db, sources) {
+    const files = {
+        baukasten: migrationFiles('baukasten', sources.baukasten),
+        product: await productFiles(sources.product)
+    };
+    const layers = ['baukasten', 'product'];
+    return Promise.all(layers.map(async (layer) => ({ layer, ...plan(layer, files[layer], await applied(db, layer)) })));
+}
+/** What the database still needs of this version and what forbids migrating it, for /health/deep. */
+export async function migrationStatus(db, sources) {
+    const both = await plans(db, sources);
+    return {
+        pending: both.flatMap(({ layer, pending }) => pending.map((file) => `${layer}/${file.name}`)),
+        problems: both.flatMap(({ problems }) => problems)
+    };
+}
+class MigrationError extends Error {
+    name = 'MigrationError';
+}
+export async function migrate(databaseUrl, sources) {
+    const client = new pg.Client({ connectionString: databaseUrl });
+    await client.connect();
+    const db = {
+        query: async (sql, params) => (await client.query(sql, params)).rows
+    };
+    try {
+        await client.query('SELECT pg_advisory_lock($1)', [LOCK]);
+        await client.query(`CREATE SCHEMA IF NOT EXISTS baukasten;
+			CREATE TABLE IF NOT EXISTS ${LEDGER.baukasten} (
+				name text PRIMARY KEY,
+				checksum text NOT NULL,
+				applied_at timestamptz NOT NULL DEFAULT now()
+			)`);
+        const both = await plans(db, sources);
+        const problems = both.flatMap((layer) => layer.problems);
+        if (problems.length > 0)
+            throw new MigrationError(problems.join('; '));
+        const result = {
+            applied: { baukasten: [], product: [] },
+            ahead: { baukasten: [], product: [] }
+        };
+        for (const { layer, pending, ahead } of both) {
+            result.ahead[layer] = ahead;
+            for (const file of pending) {
+                await apply(client, layer, file);
+                result.applied[layer].push(file.name);
+            }
+        }
+        return result;
+    }
+    finally {
+        // Ending the session releases the lock as well.
+        await client.end();
+    }
+}
+async function apply(client, layer, file) {
+    await client.query('BEGIN');
+    try {
+        await client.query(file.sql);
+        await client.query(`INSERT INTO ${LEDGER[layer]} (name, checksum) VALUES ($1, $2)`, [
+            file.name,
+            file.checksum
+        ]);
+        await client.query('COMMIT');
+    }
+    catch (error) {
+        await client.query('ROLLBACK');
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new MigrationError(`${layer} migration ${file.name} failed: ${reason}`, { cause: error });
+    }
+}

package/dist/server/adapter/secrets.d.ts

@@ -0,0 +1,2 @@
+import type { Secrets } from '../ports.js';
+export declare const secrets: Secrets;

package/dist/server/adapter/secrets.js

@@ -0,0 +1,40 @@
+// scrypt takes 32 MiB; Node runs it on the libuv pool of four threads, which bounds the memory of
+// parallel logins. A hash carries its parameters, so that stronger ones can come for new hashes.
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+const N = 32_768;
+const R = 8;
+const P = 1;
+const KEY_LENGTH = 32;
+const MAX_MEMORY = 64 * 1024 * 1024;
+function derive(password, salt, n, r, p) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, KEY_LENGTH, { N: n, r, p, maxmem: MAX_MEMORY }, (error, key) => {
+            if (error === null)
+                resolve(key);
+            else
+                reject(error);
+        });
+    });
+}
+const STORED = /^scrypt\$(\d+)\$(\d+)\$(\d+)\$([A-Za-z0-9+/=]+)\$([A-Za-z0-9+/=]+)$/;
+export const secrets = {
+    token: () => randomBytes(32).toString('base64url'),
+    async hashPassword(password) {
+        const salt = randomBytes(16);
+        const key = await derive(password, salt, N, R, P);
+        return ['scrypt', N, R, P, salt.toString('base64'), key.toString('base64')].join('$');
+    },
+    async verifyPassword(password, stored) {
+        const match = STORED.exec(stored);
+        if (match === null)
+            return false;
+        const [, n, r, p, salt, key] = match;
+        if (n === undefined || r === undefined || p === undefined)
+            return false;
+        if (salt === undefined || key === undefined)
+            return false;
+        const expected = Buffer.from(key, 'base64');
+        const actual = await derive(password, Buffer.from(salt, 'base64'), Number(n), Number(r), Number(p));
+        return actual.length === expected.length && timingSafeEqual(actual, expected);
+    }
+};

package/dist/server/adapter/stripe.d.ts

@@ -0,0 +1,11 @@
+import type { StripeApi } from '../ports.js';
+export declare function createStripe(config: {
+    secretKey: string;
+    webhookSecret: string;
+    api: {
+        kind: 'stripe';
+    } | {
+        kind: 'double';
+        url: string;
+    };
+}): StripeApi;

package/dist/server/adapter/stripe.js

@@ -0,0 +1,333 @@
+// Answers of the API come in the version the SDK pins; the payload of a webhook comes in the version
+// of the endpoint, which the delivery service set up, so it is read with Zod, field by field, as far
+// as the baukasten needs it.
+import Stripe from 'stripe';
+import { z } from 'zod';
+import { StripeFailed } from '../billing.js';
+/** A request to Stripe ends after this long: a slow answer to a webhook makes Stripe send it again. */
+const TIMEOUT_MS = 8_000;
+/** A key of Stripe in a message, without its secret part. */
+function redacted(text) {
+    return text.replace(/\b(sk|rk|whsec)_[A-Za-z0-9_*]+/g, '$1_…');
+}
+async function call(what, request) {
+    try {
+        return await request();
+    }
+    catch (error) {
+        if (error instanceof Stripe.errors.StripeError) {
+            const kind = error.code ?? error.rawType ?? error.type;
+            throw new StripeFailed(kind, redacted(`stripe: ${what}: ${error.message}`), {
+                cause: error
+            });
+        }
+        throw error;
+    }
+}
+const isMissing = (error) => error instanceof StripeFailed && error.kind === 'resource_missing';
+const idOf = (value) => (typeof value === 'string' ? value : value.id);
+function priceOf(price) {
+    const base = {
+        id: price.id,
+        product: idOf(price.product),
+        amount: price.unit_amount,
+        currency: price.currency
+    };
+    return price.recurring === null
+        ? { ...base, type: 'one_time' }
+        : {
+            ...base,
+            type: 'recurring',
+            interval: price.recurring.interval,
+            intervalCount: price.recurring.interval_count
+        };
+}
+const STATUS = z.enum([
+    'incomplete',
+    'incomplete_expired',
+    'trialing',
+    'active',
+    'past_due',
+    'canceled',
+    'unpaid',
+    'paused'
+]);
+function statusOf(status) {
+    const known = STATUS.safeParse(status);
+    if (!known.success) {
+        throw new StripeFailed('unexpected_status', `stripe: a subscription with the status ${status}`);
+    }
+    return known.data;
+}
+const SESSION = z.object({
+    id: z.string(),
+    mode: z.string(),
+    customer: z.string().nullable(),
+    subscription: z.string().nullable().optional(),
+    payment_status: z.string(),
+    amount_total: z.int().nullable(),
+    currency: z.string().nullable(),
+    metadata: z.record(z.string(), z.string()).nullable().optional()
+});
+const SUBSCRIPTION = z.object({ id: z.string(), customer: z.string() });
+const INVOICE = z.object({
+    id: z.string(),
+    customer: z.string(),
+    amount_paid: z.int(),
+    currency: z.string(),
+    status_transitions: z.object({ paid_at: z.int().nullable() })
+});
+const EVENT = z.object({
+    id: z.string().min(1),
+    type: z.string().min(1),
+    created: z.int(),
+    data: z.object({ object: z.unknown() })
+});
+const at = (seconds) => new Date(seconds * 1_000);
+function read(schema, value, type) {
+    const parsed = schema.safeParse(value);
+    if (!parsed.success) {
+        throw new StripeFailed('unexpected_payload', `stripe: the payload of ${type} does not fit: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+function sessionOf(raw) {
+    const { id, customer } = raw;
+    if (raw.mode === 'subscription' && customer !== null && typeof raw.subscription === 'string') {
+        return { mode: 'subscription', id, customerId: customer, subscriptionId: raw.subscription };
+    }
+    const product = raw.metadata?.product;
+    const lookupKey = raw.metadata?.lookup_key;
+    if (raw.mode === 'payment' &&
+        customer !== null &&
+        raw.amount_total !== null &&
+        raw.currency !== null &&
+        product !== undefined &&
+        lookupKey !== undefined) {
+        return {
+            mode: 'payment',
+            id,
+            customerId: customer,
+            paid: raw.payment_status === 'paid',
+            amount: raw.amount_total,
+            currency: raw.currency,
+            product,
+            lookupKey
+        };
+    }
+    return { mode: 'other', id };
+}
+function eventOf(payload) {
+    const event = read(EVENT, payload, 'an event');
+    const base = { id: event.id, type: event.type, created: at(event.created) };
+    const object = event.data.object;
+    switch (event.type) {
+        case 'checkout.session.completed':
+        case 'checkout.session.async_payment_succeeded':
+            return { ...base, kind: 'checkout', session: sessionOf(read(SESSION, object, event.type)) };
+        case 'customer.subscription.created':
+        case 'customer.subscription.updated':
+        case 'customer.subscription.deleted': {
+            const subscription = read(SUBSCRIPTION, object, event.type);
+            return {
+                ...base,
+                kind: 'subscription',
+                subscriptionId: subscription.id,
+                customerId: subscription.customer
+            };
+        }
+        case 'invoice.paid': {
+            const invoice = read(INVOICE, object, event.type);
+            return {
+                ...base,
+                kind: 'invoice',
+                invoice: {
+                    id: invoice.id,
+                    customerId: invoice.customer,
+                    amount: invoice.amount_paid,
+                    currency: invoice.currency,
+                    // A paid invoice has its time of payment; the event is as late.
+                    paidAt: at(invoice.status_transitions.paid_at ?? event.created)
+                }
+            };
+        }
+        default:
+            return { ...base, kind: 'other' };
+    }
+}
+export function createStripe(config) {
+    const double = config.api.kind === 'double' ? new URL(config.api.url) : null;
+    const stripe = new Stripe(config.secretKey, {
+        timeout: TIMEOUT_MS,
+        maxNetworkRetries: 1,
+        ...(double === null ? {} : { host: double.hostname, port: double.port, protocol: 'http' })
+    });
+    return {
+        async product(id) {
+            try {
+                const found = await call('reading a product', () => stripe.products.retrieve(id));
+                return { id: found.id, name: found.name, active: found.active };
+            }
+            catch (error) {
+                if (isMissing(error))
+                    return null;
+                throw error;
+            }
+        },
+        async createProduct(product) {
+            await call('creating a product', () => stripe.products.create(product));
+        },
+        async updateProduct(product) {
+            await call('updating a product', () => stripe.products.update(product.id, { name: product.name, active: true }));
+        },
+        async activePrice(lookupKey) {
+            const { data } = await call('reading a price', () => stripe.prices.list({ lookup_keys: [lookupKey], active: true, limit: 1 }));
+            const [found] = data;
+            return found === undefined ? null : priceOf(found);
+        },
+        async createPrice(price) {
+            const created = await call('creating a price', () => stripe.prices.create({
+                product: price.product,
+                currency: price.currency,
+                unit_amount: price.amount,
+                lookup_key: price.lookupKey,
+                transfer_lookup_key: true,
+                ...(price.type === 'recurring' ? { recurring: { interval: price.interval } } : {})
+            }));
+            return created.id;
+        },
+        async defaultPortal() {
+            const { data } = await call('reading the customer portal', () => stripe.billingPortal.configurations.list({
+                is_default: true,
+                limit: 1,
+                // The products of the subscription updates come only on request.
+                expand: ['data.features.subscription_update.products']
+            }));
+            const [found] = data;
+            return found === undefined ? null : { id: found.id, configuration: found };
+        },
+        async updatePortal(id, configuration) {
+            await call('updating the customer portal', () => stripe.billingPortal.configurations.update(id, configuration));
+        },
+        async webhookEndpoints() {
+            const { data } = await call('reading the webhook endpoints', () => stripe.webhookEndpoints.list({ limit: 100 }));
+            return data.map((endpoint) => ({
+                id: endpoint.id,
+                url: endpoint.url,
+                enabled: endpoint.status === 'enabled'
+            }));
+        },
+        async createCustomer(customer) {
+            const created = await call('creating a customer', () => stripe.customers.create({
+                email: customer.email,
+                metadata: { account_id: customer.accountId }
+            }));
+            return created.id;
+        },
+        async updateCustomerEmail(customerId, email) {
+            await call('updating a customer', () => stripe.customers.update(customerId, { email }));
+        },
+        async subscriptionsOf(customerId) {
+            const { data } = await call('reading subscriptions', () => stripe.subscriptions.list({ customer: customerId, status: 'all', limit: 100 }));
+            return data.map((subscription) => ({
+                id: subscription.id,
+                status: statusOf(subscription.status)
+            }));
+        },
+        async subscription(id) {
+            const found = await call('reading a subscription', () => stripe.subscriptions.retrieve(id));
+            // The baukasten opens subscriptions of one price; the first item is that price.
+            const [item] = found.items.data;
+            if (item === undefined || item.quantity === undefined) {
+                throw new StripeFailed('unexpected_subscription', `stripe: the subscription ${id} has no item with a quantity`);
+            }
+            return {
+                id: found.id,
+                customerId: idOf(found.customer),
+                status: statusOf(found.status),
+                product: idOf(item.price.product),
+                price: { id: item.price.id, lookupKey: item.price.lookup_key },
+                quantity: item.quantity,
+                latestInvoice: found.latest_invoice === null ? null : idOf(found.latest_invoice)
+            };
+        },
+        async cancelSubscription(id) {
+            try {
+                await call('ending a subscription', () => stripe.subscriptions.cancel(id));
+                return 'canceled';
+            }
+            catch (error) {
+                if (isMissing(error))
+                    return 'missing';
+                throw error;
+            }
+        },
+        async createCheckout(request) {
+            const item = request.mode === 'subscription'
+                ? {
+                    price: request.priceId,
+                    quantity: request.quantity,
+                    ...(request.adjustable.kind === 'up to'
+                        ? {
+                            adjustable_quantity: {
+                                enabled: true,
+                                minimum: 1,
+                                maximum: request.adjustable.max
+                            }
+                        }
+                        : {})
+                }
+                : { price: request.priceId, quantity: 1 };
+            const session = await call('opening Checkout', () => stripe.checkout.sessions.create({
+                mode: request.mode,
+                customer: request.customerId,
+                client_reference_id: request.accountId,
+                line_items: [item],
+                // Whoever pays accepts the terms again, for the business; Stripe keeps the consent.
+                consent_collection: { terms_of_service: 'required' },
+                custom_text: { terms_of_service_acceptance: { message: request.termsMessage } },
+                billing_address_collection: 'required',
+                // A business may give its tax id; Stripe keeps it, name and address at the customer.
+                tax_id_collection: { enabled: true },
+                customer_update: { name: 'auto', address: 'auto' },
+                // Paid in the currency of the catalog, which alone counts as revenue.
+                adaptive_pricing: { enabled: false },
+                expires_at: Math.floor(request.expiresAt.getTime() / 1_000),
+                success_url: request.successUrl,
+                cancel_url: request.cancelUrl,
+                metadata: request.mode === 'payment'
+                    ? {
+                        account_id: request.accountId,
+                        product: request.product,
+                        lookup_key: request.lookupKey
+                    }
+                    : { account_id: request.accountId }
+            }));
+            if (session.url === null)
+                throw new StripeFailed('no_url', 'stripe: Checkout gave no address');
+            return session.url;
+        },
+        async createPortalSession(session) {
+            const created = await call('opening the customer portal', () => stripe.billingPortal.sessions.create({
+                customer: session.customerId,
+                configuration: session.configurationId,
+                return_url: session.returnUrl
+            }));
+            return created.url;
+        },
+        event(payload, signature) {
+            let verified;
+            try {
+                // Without the header there is no signature to fit.
+                verified = stripe.webhooks.constructEvent(payload, signature ?? '', config.webhookSecret);
+            }
+            catch (error) {
+                if (error instanceof Stripe.errors.StripeSignatureVerificationError) {
+                    return { kind: 'invalid' };
+                }
+                throw error;
+            }
+            return { kind: 'event', event: eventOf(verified) };
+        }
+    };
+}

package/dist/server/api.d.ts

@@ -0,0 +1,25 @@
+import type { z } from 'zod';
+import type { Log } from './log.js';
+import type { Messages } from './messages.js';
+export declare class ApiError extends Error {
+    name: string;
+    readonly status: number;
+    readonly code: string;
+    readonly details: unknown;
+    readonly headers: Readonly<Record<string, string>>;
+    constructor(status: number, code: string, message: string, options?: {
+        details?: unknown;
+        headers?: Record<string, string>;
+    });
+}
+/** Runs a handler of the API: an ApiError becomes its answer, anything else a logged 500. */
+export declare function respond(log: Log, messages: Messages, handler: () => Promise<Response>): Promise<Response>;
+/** The JSON body of a request, parsed with `schema`: 400 when it is no JSON, 422 when it does not fit. */
+export declare function readBody<S extends z.ZodType>(request: Request, schema: S, messages: Messages): Promise<z.output<S>>;
+/** The key in `Authorization: Bearer <prefix>_<secret>`, or null. */
+export declare function bearerKey(headers: Headers, prefix: string): string | null;
+/**
+ * SvelteKit answers some errors under /api/ itself, in text, HTML or its own JSON (an unknown path,
+ * a wrong method, a failed endpoint); the API promises its shape for every error.
+ */
+export declare function asApiError(response: Response, messages: Messages): Promise<Response>;

package/dist/server/api.js

@@ -0,0 +1,98 @@
+export class ApiError extends Error {
+    name = 'ApiError';
+    status;
+    code;
+    details;
+    headers;
+    constructor(status, code, message, options = {}) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.details = options.details;
+        this.headers = options.headers ?? {};
+    }
+}
+function errorResponse(error) {
+    const body = { code: error.code, message: error.message };
+    if (error.details !== undefined)
+        body.details = error.details;
+    return Response.json({ error: body }, { status: error.status, headers: error.headers });
+}
+/** Runs a handler of the API: an ApiError becomes its answer, anything else a logged 500. */
+export async function respond(log, messages, handler) {
+    try {
+        return await handler();
+    }
+    catch (caught) {
+        if (caught instanceof ApiError)
+            return errorResponse(caught);
+        log.error('api: unexpected error', { error: caught });
+        return errorResponse(new ApiError(500, 'internal', messages.api.internal));
+    }
+}
+/** The JSON body of a request, parsed with `schema`: 400 when it is no JSON, 422 when it does not fit. */
+export async function readBody(request, schema, messages) {
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        throw new ApiError(400, 'invalid_json', messages.api.invalidJson);
+    }
+    const result = schema.safeParse(body);
+    if (!result.success) {
+        throw new ApiError(422, 'invalid_request', messages.api.invalidRequest, {
+            details: result.error.issues.map((issue) => ({
+                path: issue.path.join('.'),
+                message: issue.message
+            }))
+        });
+    }
+    return result.data;
+}
+/** The key in `Authorization: Bearer <prefix>_<secret>`, or null. */
+export function bearerKey(headers, prefix) {
+    const match = new RegExp(`^Bearer (${prefix}_[A-Za-z0-9_-]{43})$`).exec(headers.get('authorization') ?? '');
+    return match?.[1] ?? null;
+}
+const CODES = {
+    403: (m) => ['forbidden', m.api.forbidden],
+    404: (m) => ['not_found', m.api.notFound],
+    405: (m) => ['method_not_allowed', m.api.methodNotAllowed],
+    413: (m) => ['payload_too_large', m.api.payloadTooLarge]
+};
+const isShaped = (body) => {
+    if (typeof body !== 'object' || body === null || !('error' in body))
+        return false;
+    const error = body.error;
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        typeof error.code === 'string' &&
+        'message' in error &&
+        typeof error.message === 'string');
+};
+/**
+ * SvelteKit answers some errors under /api/ itself, in text, HTML or its own JSON (an unknown path,
+ * a wrong method, a failed endpoint); the API promises its shape for every error.
+ */
+export async function asApiError(response, messages) {
+    if (response.status < 400)
+        return response;
+    if (response.headers.get('content-type')?.startsWith('application/json') === true) {
+        const body = await response
+            .clone()
+            .json()
+            .catch(() => null);
+        if (isShaped(body))
+            return response;
+    }
+    const [code, message] = CODES[response.status]?.(messages) ??
+        (response.status >= 500
+            ? ['internal', messages.api.internal]
+            : ['failed', messages.api.failed]);
+    const headers = new Headers(response.headers);
+    headers.delete('content-type');
+    headers.delete('content-length');
+    return Response.json({ error: { code, message } }, { status: response.status, headers });
+}

package/dist/server/baukasten-migrations.d.ts

@@ -0,0 +1,4 @@
+export declare const BAUKASTEN_MIGRATIONS: readonly {
+    name: string;
+    sql: string;
+}[];