@xuda.io/account_module 1.2.2282 → 1.2.2283

package/index.mjs

@@ -225,6 +225,7 @@ export const update_account_info = async function (req, job_id, headers) {
       eb.status = 'cleared';
       eb.cleared_ts = Date.now();
       account_obj.account_email_bounce_suspended = 0;
+      _clear_bounce_suspension_banner(uid); // retire the suspension banner
     }
   }
 
@@ -1227,6 +1228,11 @@ export const get_account_data = async function (req) {
       login_screen: await resolve_effective_login_screen(acc_obj),
     };
 
+    // A bounce-suspended account must always see the suspension banner (the
+    // one-shot notice at suspension time can be missed or predate this). Best-
+    // effort + fire-and-forget; only touches the DB for the rare suspended account.
+    if (acc_obj.account_email_bounce_suspended) _ensure_bounce_suspension_banner(acc_obj);
+
     return ret;
   } catch (err) {
     console.error(err);
@@ -1413,6 +1419,71 @@ export const get_account_external_apps = async function (req) {
   }
 };
 
+// Eligible backends for a load balancer's pool: the user's ACTIVE apps of one
+// chosen deploy_type. full_stack_vps is stored as app_type:'vps' + is_full_stack,
+// so it's split out here. Balancers themselves are never selectable. Each row
+// carries the origin (ip/region) the balancer needs, plus a `reachable` flag —
+// farm/mesh-hosted backends (private IP) are shown but can't be pooled by a v1
+// DO balancer. req: { uid, data:{ backend_deploy_type } }
+export const get_load_balancer_candidates = async function (req) {
+  try {
+    const uid = req.uid;
+    const bt = req.data?.backend_deploy_type || req.backend_deploy_type;
+    if (!bt) return { code: -2, data: 'backend_deploy_type required' };
+    const excluded = _conf.balancer?.excluded_backend_types || ['cron', 'emitter'];
+    if (excluded.includes(bt)) return { code: -2, data: `${bt} is not balanceable` };
+
+    const isSuper = _conf.superuser_account_ids?.includes(uid);
+    const app_type = bt === 'full_stack_vps' ? 'vps' : bt;
+    const selector = isSuper ? { app_type, docType: 'app', app_status_code: 3 } : { app_uId: uid, app_type, docType: 'app', app_status_code: 3 };
+    const ret = await db_module.find_couch_query('xuda_master', { selector, limit: 1000 });
+    let docs = ret?.docs || [];
+
+    // Split the shared app_type:'vps' bucket into vps vs full_stack_vps.
+    if (bt === 'full_stack_vps') docs = docs.filter((d) => d.is_full_stack);
+    else if (bt === 'vps') docs = docs.filter((d) => !d.is_full_stack);
+    docs = docs.filter((d) => !d.is_load_balancer && d.app_type !== 'balancer');
+
+    const is_private = (ip) => !ip || /^(10\.|127\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(String(ip));
+    const rows = docs.map((d) => {
+      const ip = d.app_hosting_server?.ip || null;
+      const farm_hosted = is_private(ip) || d.app_hosting_server?.provider === 'proxmox';
+      return {
+        app_id: d._id,
+        name: d.app_name,
+        app_type: bt,
+        region_code: d.app_hosting_server?.region_slug || d.app_hosting?.app_region || null,
+        ip,
+        public_url: `https://${d.app_access_url || `${d._id}.${_conf.app_domain}`}`,
+        farm_hosted,
+        reachable: !!ip && !farm_hosted,
+        status: d.app_status_code,
+      };
+    });
+    return { code: 1, data: { rows } };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
+// Load balancers are apps (app_type:'balancer') not emitted by any user_* view,
+// so — like get_account_external_apps — a Mango query surfaces them for the
+// sidenav bucket (DATA.balancer) right after create. req: { uid }
+export const get_account_balancers = async function (req) {
+  try {
+    const isSuper = _conf.superuser_account_ids?.includes(req.uid);
+    const selector = isSuper ? { app_type: 'balancer', docType: 'app' } : { app_uId: req.uid, app_type: 'balancer', docType: 'app' };
+    const ret = await db_module.find_couch_query('xuda_master', {
+      selector,
+      limit: 1000,
+    });
+    const rows = (ret?.docs || []).map((d) => ({ id: d._id, value: d }));
+    return { code: 1, data: { rows } };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
 export const get_account_info = async function (req) {
   return await get_account_data({
     uid: req.uid,
@@ -1432,6 +1503,23 @@ export const get_account_info = async function (req) {
 // ===================================================================
 const _OPS_SERVER_TYPES = ['datacenter', 'deployment', 'vps', 'managed_vps', 'instance', 'master'];
 const _ops_is_super = (req) => !!(req && req.uid && Array.isArray(_conf.superuser_account_ids) && _conf.superuser_account_ids.includes(req.uid));
+
+// info@xuda.ai (platform owner) + any superuser account are permanently exempt
+// from billing hold / suspension / termination — manual OR automated. A held or
+// suspended owner account would lock the operator out. Email-keyed so it holds
+// across the dev/master account-id divergence. Mirrors the same guard in
+// stripe_module's webhook paths. Extend via _conf.billing_hold_exempt_emails.
+const _HOLD_EXEMPT_EMAILS = new Set(
+  ['info@xuda.ai', ...(Array.isArray(_conf.billing_hold_exempt_emails) ? _conf.billing_hold_exempt_emails : [])]
+    .map((e) => String(e).trim().toLowerCase()).filter(Boolean)
+);
+const _is_billing_restriction_exempt = (account_obj) => {
+  if (!account_obj) return false;
+  const email = String(account_obj.account_info?.email || '').trim().toLowerCase();
+  if (email && _HOLD_EXEMPT_EMAILS.has(email)) return true;
+  const supers = _conf.superuser_account_ids;
+  return !!(Array.isArray(supers) && account_obj._id && supers.includes(account_obj._id));
+};
 const _ops_host = () => (_conf.is_debug ? process.env.XUDA_HOSTNAME || _conf.domain : _conf.domain) || 'xuda.ai';
 const _ops_appeal_days = () => Number(_conf.termination?.appeal_days) || 14;
 
@@ -1477,6 +1565,7 @@ export const ops_suspend_account = async function (req = {}) {
     const ar = await db_module.get_couch_doc('xuda_accounts', account_uid);
     if (ar.code < 0 || !ar.data) return { code: -1, data: 'account not found' };
     const account = ar.data;
+    if (_is_billing_restriction_exempt(account)) return { code: -1, data: 'account is on the permanent allowlist (info@ / superuser); suspension refused' };
     account.account_suspension_status = 1;
     account.account_suspension_date = Date.now();
     account.suspension_reason = req.reason || '';
@@ -1501,6 +1590,7 @@ export const ops_terminate_account = async function (req = {}) {
     const ar = await db_module.get_couch_doc('xuda_accounts', account_uid);
     if (ar.code < 0 || !ar.data) return { code: -1, data: 'account not found' };
     const account = ar.data;
+    if (_is_billing_restriction_exempt(account)) return { code: -1, data: 'account is on the permanent allowlist (info@ / superuser); termination refused' };
     const appeal_days = _ops_appeal_days();
     account.account_termination_status = 1;
     account.account_termination_date = Date.now();
@@ -1573,6 +1663,20 @@ export const ops_reinstate_account = async function (req = {}) {
     account.appeal_status = 'accepted';
     account.reinstated_ts = Date.now();
     account.reinstated_by_uid = req.uid;
+    // Reinstate means "reactivate", regardless of which suspension type is in
+    // effect — so also lift an email-bounce suspension if present. This mirrors
+    // the clear branch of sweep_email_bounces (:3630) so the two paths agree.
+    const _eb = account.account_email_bounce;
+    const _was_bounce_suspended = account.account_email_bounce_suspended || (_eb && (_eb.status === 'suspended' || _eb.status === 'flagged'));
+    if (_was_bounce_suspended) {
+      if (_eb) {
+        _eb.status = 'cleared';
+        _eb.cleared_ts = Date.now();
+        account.account_email_bounce = _eb;
+      }
+      account.account_email_bounce_suspended = 0;
+    }
+    if (account.stat === 5) account.stat = 3; // defensive: clear a hard suspended stat if one was set
     const sr = await db_module.save_couch_doc('xuda_accounts', account);
     if (sr.code < 0) return { code: -1, data: sr.data };
     const power = await _ops_services_power(account_uid, true);
@@ -1680,6 +1784,19 @@ export const ops_account_snapshot = async function (req = {}) {
         billing_hold_date: a.account_billing_hold_date || null,
         billing_hold_reason: a.billing_hold_reason || '',
         reinstated_ts: a.reinstated_ts || null,
+        // Email-bounce suspension (a distinct suspension type — an outbound
+        // platform email to the account hard-bounced). Surfaced so the admin
+        // can see it's the reason an account reads as inactive.
+        email_bounce: a.account_email_bounce_suspended
+          ? {
+              suspended: true,
+              recipient: a.account_email_bounce?.recipient || '',
+              reason: a.account_email_bounce?.reason || '',
+              status: a.account_email_bounce?.status || '',
+              bounce_count: a.account_email_bounce?.bounce_count || 0,
+              suspended_ts: a.account_email_bounce?.suspended_ts || null,
+            }
+          : null,
         entitlements: get_effective_entitlements(a),
         credits,
       },
@@ -1696,6 +1813,7 @@ export const ops_set_billing_hold = async function (req = {}) {
     const ar = await db_module.get_couch_doc('xuda_accounts', account_uid);
     if (ar.code < 0 || !ar.data) return { code: -1, data: 'account not found' };
     const account = ar.data;
+    if (_is_billing_restriction_exempt(account)) return { code: -1, data: 'account is on the permanent allowlist (info@ / superuser); billing hold refused' };
     account.account_billing_hold_status = 1;
     account.account_billing_hold_date = Date.now();
     account.billing_hold_reason = req.reason || '';
@@ -3412,12 +3530,18 @@ const _notify_bounce_suspended = async (account) => {
     await notification_msa.submit_notification({
       type: 'account',
       app_id: null,
+      // Account-level banner: tag with an empty app_id so get_system_notifications
+      // (which scopes to app_id: '') returns it on every reload, not just the
+      // one live WebSocket push at suspension time.
+      to_app_id: '',
       uid_arr: [account._id],
       topic: 'email_bounce_update_required',
       params: {
         recipient_email: eb.recipient || account.account_info?.email || '',
         settings_url: _bounce_settings_url(),
         support_url: `https://${host}/dashboard/support`,
+        action_label: 'Update email',
+        action_href: _bounce_settings_url(),
       },
     });
   } catch (e) { console.error('bounce user notice failed:', e.message); }
@@ -3444,6 +3568,79 @@ const _notify_bounce_suspended = async (account) => {
   }
 };
 
+// Ensure a bounce-suspended account has a LIVE suspension banner on the
+// dashboard. The suspend-time notice (_notify_bounce_suspended) fires once and
+// can be missed or predate this; get_account_data calls this on every load.
+// Idempotent + banner-only: bails if a persistent (app_id '') banner already
+// exists, so it never duplicates the doc or re-sends the SMS.
+const _ensure_bounce_suspension_banner = async (account) => {
+  try {
+    const uid = account._id;
+    const ret = await db_module.find_couch_query('xuda_notification', {
+      selector: { docType: 'notification', uid, topic: 'email_bounce_update_required', delivery_method: 'banner', read: false },
+    });
+    const docs = ret?.docs || [];
+    if (docs.length) {
+      // Self-heal: concurrent get_account_data calls on boot can race the create
+      // (find-then-create isn't atomic + CouchDB's index lags the fresh doc), so
+      // more than one can slip through. Keep the newest, retire the rest.
+      docs.sort((a, b) => (b.date_created_ts || 0) - (a.date_created_ts || 0));
+      for (let i = 1; i < docs.length; i++) {
+        docs[i].read = true;
+        docs[i].stat = 4;
+        docs[i].stat_ts = Date.now();
+        await db_module.save_couch_doc('xuda_notification', docs[i]).catch(() => {});
+      }
+      // Upgrade an older-format banner in place (created before locked / the
+      // Update-email action existed) so it picks up the current fields.
+      const keep = docs[0];
+      if (!keep.locked || !keep.params?.action_href) {
+        keep.locked = true;
+        keep.params = { ...(keep.params || {}), action_label: 'Update email', action_href: _bounce_settings_url() };
+        await db_module.save_couch_doc('xuda_notification', keep).catch(() => {});
+      }
+      return;
+    }
+    const eb = account.account_email_bounce || {};
+    const host = _conf.is_debug ? process.env.XUDA_HOSTNAME || _conf.domain : _conf.domain;
+    await notification_msa.submit_notification({
+      type: 'account',
+      app_id: null,
+      to_app_id: '',
+      uid_arr: [uid],
+      topic: 'email_bounce_update_required',
+      delivery_filter: ['banner'], // banner only — the SMS already went out at suspension time
+      params: {
+        recipient_email: eb.recipient || account.account_info?.email || '',
+        settings_url: _bounce_settings_url(),
+        support_url: `https://${host}/dashboard/support`,
+        action_label: 'Update email',
+        action_href: _bounce_settings_url(),
+      },
+    });
+  } catch (e) {
+    console.error('ensure bounce banner failed:', e.message);
+  }
+};
+
+// Retire the suspension banner once the bounce is resolved (email changed).
+// Marks it read so get_system_notifications stops returning it next load.
+const _clear_bounce_suspension_banner = async (uid) => {
+  try {
+    const ret = await db_module.find_couch_query('xuda_notification', {
+      selector: { docType: 'notification', uid, topic: 'email_bounce_update_required', read: false },
+    });
+    for (const doc of ret?.docs || []) {
+      doc.read = true;
+      doc.stat = 4;
+      doc.stat_ts = Date.now();
+      await db_module.save_couch_doc('xuda_notification', doc);
+    }
+  } catch (e) {
+    console.error('clear bounce banner failed:', e.message);
+  }
+};
+
 // Hard-email-bounce handler. Called (via account_ms RPC) by email_module's
 // scan_platform_bounces when a platform email to this account's address bounces
 // permanently (5.x.x). Policy: suspend IMMEDIATELY (account_email_bounce_suspended,

package/index_ms.mjs

@@ -121,6 +121,14 @@ export const get_account_external_apps = async function (...args) {
   return await broker.send_to_queue("get_account_external_apps", ...args);
 };
 
+export const get_load_balancer_candidates = async function (...args) {
+  return await broker.send_to_queue("get_load_balancer_candidates", ...args);
+};
+
+export const get_account_balancers = async function (...args) {
+  return await broker.send_to_queue("get_account_balancers", ...args);
+};
+
 export const get_account_info = async function (...args) {
   return await broker.send_to_queue("get_account_info", ...args);
 };

package/index_msa.mjs

@@ -121,6 +121,14 @@ export const get_account_external_apps =  function (...args) {
    broker.send_to_queue_async("get_account_external_apps", ...args);
 };
 
+export const get_load_balancer_candidates =  function (...args) {
+   broker.send_to_queue_async("get_load_balancer_candidates", ...args);
+};
+
+export const get_account_balancers =  function (...args) {
+   broker.send_to_queue_async("get_account_balancers", ...args);
+};
+
 export const get_account_info =  function (...args) {
    broker.send_to_queue_async("get_account_info", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.2282",
+  "version": "1.2.2283",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {