@xuda.io/account_module 1.2.2286 → 1.2.2288

package/index.mjs

@@ -57,6 +57,8 @@ const team_ms = await import(`${module_path}/team_module/index_ms.mjs`);
 const email_ms = await import(`${module_path}/email_module/index_ms.mjs`);
 const marketplace_ms = await import(`${module_path}/marketplace_module/index_ms.mjs`);
 const stripe_ms = await import(`${module_path}/stripe_module/index_ms.mjs`);
+// Revoking an SSH key from the servers it is installed on (disable/delete/expiry).
+const deploy_ms = await import(`${module_path}/deploy_module/index_ms.mjs`);
 // Awaitable app handle for the ops termination flow (power off / destroy).
 const app_ms = await import(`${module_path}/app_module/index_ms.mjs`);
 
@@ -2663,8 +2665,40 @@ export const add_app_log_util = async function (body, status, service, source, r
   }
 };
 
+// Append one entry to the SSH access log (xuda_ssh_keys, docType ssh_key_event).
+// stat:3 is stamped so the existing idx_ssh_keys_uid [docType, uid, stat] index
+// serves the log reads. deploy_module carries the same writer on purpose: cpi
+// modules do not import each other.
+const _ssh_key_event = async function (uid, action, extra = {}) {
+  try {
+    if (!uid) return;
+    await db_module.save_couch_doc('xuda_ssh_keys', {
+      _id: await _common.xuda_get_uuid('ssh_key_event'),
+      docType: 'ssh_key_event',
+      uid, action, stat: 3, at: Date.now(), ...extra,
+    });
+  } catch (e) {}
+};
+
+// Pull a key off every server it is installed on (assigned_apps is the reverse
+// index deploy_module maintains at assign time). Best-effort per app: one
+// unreachable server must not leave the key half-revoked on the others.
+const _ssh_key_revoke_everywhere = async function (doc) {
+  const apps = Array.isArray(doc.assigned_apps) ? doc.assigned_apps : [];
+  const failed = [];
+  for (const app_id of apps) {
+    try {
+      const r = await deploy_ms.revoke_ssh_keys({ app_id, ssh_keys: [doc._id] });
+      if (!(r && r.code > 0)) failed.push(app_id);
+    } catch (e) {
+      failed.push(app_id);
+    }
+  }
+  return { apps, failed };
+};
+
 export const save_ssh_key = async function (req) {
-  const { uid, _id, ssh_key_name, ssh_key_content } = req;
+  const { uid, _id, ssh_key_name, ssh_key_content, expires_at, enabled } = req;
 
   function isValidSSHPublicKey(sshPublicKey) {
     // Regular expression to match SSH public keys
@@ -2677,6 +2711,16 @@ export const save_ssh_key = async function (req) {
     return { code: -1, data: 'invalid ssh key' };
   }
 
+  // Optional expiry (epoch ms). null/0 clears it; a date in the past is a
+  // mistake the UI should hear about, not silently store.
+  let _exp = null;
+  if (expires_at !== undefined && expires_at !== null && expires_at !== 0 && expires_at !== '') {
+    _exp = Number(expires_at);
+    if (!Number.isFinite(_exp) || _exp <= Date.now()) {
+      return { code: -1, data: 'expires_at must be a future date (epoch milliseconds)' };
+    }
+  }
+
   var doc = {
     uid,
     docType: 'ssh_key',
@@ -2685,36 +2729,92 @@ export const save_ssh_key = async function (req) {
     stat: 3,
   };
 
+  var is_new = true;
   if (_id) {
     const ret = await db_module.get_couch_doc('xuda_ssh_keys', _id);
     if (ret.code < 0) {
       return ret;
     }
+    if (ret.data.uid !== uid) {
+      return { code: -403, data: 'not your key' };
+    }
     doc = ret.data;
     doc.date_updated_ts = Date.now();
+    is_new = false;
   } else {
     doc._id = await _common.xuda_get_uuid('ssh_key');
   }
 
   doc.ssh_key_name = ssh_key_name;
   doc.ssh_key_content = ssh_key_content;
+  if (expires_at !== undefined) doc.expires_at = _exp;
+  if (enabled !== undefined) doc.enabled = enabled !== false;
+  if (doc.enabled === undefined) doc.enabled = true;
 
   const save_ret = await db_module.save_couch_doc('xuda_ssh_keys', doc);
+  if (save_ret.code > -1) {
+    await _ssh_key_event(uid, is_new ? 'create' : 'update', { ssh_key_id: doc._id, key_name: ssh_key_name, expires_at: doc.expires_at || null });
+  }
 
   return save_ret;
 };
+
+// On/off switch for one key. Switching OFF also pulls the key from every server
+// it is installed on, so "off" means the developer is locked out now, not on the
+// next reassign. Switching ON does not auto-reinstall: the user re-assigns
+// per server (deliberate: re-granting access is an explicit act).
+export const set_ssh_key_enabled = async function (req) {
+  const { uid, ssh_key_id, enabled } = req;
+  const ret = await db_module.get_couch_doc('xuda_ssh_keys', ssh_key_id);
+  if (ret.code < 0) return ret;
+  const doc = ret.data;
+  if (doc.uid !== uid) return { code: -403, data: 'not your key' };
+
+  const on = enabled !== false;
+  let revoked = null;
+  if (!on) {
+    revoked = await _ssh_key_revoke_everywhere(doc);
+    if (revoked.failed.length) {
+      return { code: -1, data: `could not remove the key from ${revoked.failed.length} server(s) (${revoked.failed.join(', ')}). The key stays ON so the state on your servers is never ambiguous. Try again.` };
+    }
+  }
+  // revoke_ssh_keys rewrote the key doc (assigned_apps); refetch before saving.
+  const fresh = await db_module.get_couch_doc('xuda_ssh_keys', ssh_key_id);
+  const fdoc = fresh.code > -1 ? fresh.data : doc;
+  fdoc.enabled = on;
+  fdoc.date_updated_ts = Date.now();
+  const save_ret = await db_module.save_couch_doc('xuda_ssh_keys', fdoc);
+  if (save_ret.code > -1) {
+    await _ssh_key_event(uid, on ? 'enable' : 'disable', { ssh_key_id, key_name: fdoc.ssh_key_name, ...(revoked ? { removed_from: revoked.apps } : {}) });
+  }
+  return save_ret.code > -1 ? { code: 1, data: { enabled: on, removed_from: revoked ? revoked.apps : [] } } : save_ret;
+};
+
 export const delete_ssh_key = async function (req) {
-  const { ssh_key_id } = req;
+  const { uid, ssh_key_id } = req;
 
   const ret = await db_module.get_couch_doc('xuda_ssh_keys', ssh_key_id);
   if (ret.code < 0) {
     return ret;
   }
   var doc = ret.data;
+  if (doc.uid !== uid) {
+    return { code: -403, data: 'not your key' };
+  }
+  // A deleted key must stop opening doors: pull it off every server first.
+  const revoked = await _ssh_key_revoke_everywhere(doc);
+  if (revoked.failed.length) {
+    return { code: -1, data: `could not remove the key from ${revoked.failed.length} server(s) (${revoked.failed.join(', ')}). The key was NOT deleted. Try again.` };
+  }
+  const fresh = await db_module.get_couch_doc('xuda_ssh_keys', ssh_key_id);
+  doc = fresh.code > -1 ? fresh.data : doc;
   doc.date_updated_ts = Date.now();
   doc.stat = 4;
 
   const save_ret = await db_module.save_couch_doc('xuda_ssh_keys', doc);
+  if (save_ret.code > -1) {
+    await _ssh_key_event(uid, 'delete', { ssh_key_id, key_name: doc.ssh_key_name, ...(revoked.apps.length ? { removed_from: revoked.apps } : {}) });
+  }
 
   return save_ret;
 };
@@ -2734,6 +2834,22 @@ export const get_ssh_keys = async function (req) {
   return ret;
 };
 
+// The account's SSH access log: every grant, revoke, on/off flip, expiry and
+// delete, newest first. Selector rides idx_ssh_keys_uid ([docType, uid, stat]).
+export const get_ssh_key_events = async function (req) {
+  const { uid, ssh_key_id, app_id, limit } = req;
+  const opt = {
+    selector: { docType: 'ssh_key_event', uid, stat: { $gte: 0 } },
+    limit: 2000,
+  };
+  if (ssh_key_id) opt.selector.ssh_key_id = ssh_key_id;
+  if (app_id) opt.selector.app_id = app_id;
+  const ret = await db_module.find_couch_query('xuda_ssh_keys', opt);
+  if (ret.code < 0) return ret;
+  const rows = (ret.docs || ret.data?.docs || []).sort((a, b) => (b.at || 0) - (a.at || 0)).slice(0, Math.min(Number(limit) || 200, 1000));
+  return { code: 1, data: rows };
+};
+
 export const search_users = async function (req) {
   const { _id, search, limit, skip, bookmark, uid } = req;
 
@@ -5534,6 +5650,8 @@ export const update_account_profile = async function (req, job_id, headers) {
     'active_ai_model',
     'ai_models',
     'active_agents',
+    // Email Template tab: { style: 'plain' | 'card' | 'accent' | 'minimal' }
+    'email_template',
   ];
   try {
     let { data: account_profile_doc } = await db_module.get_app_couch_doc(app_id, _id);
@@ -5917,10 +6035,21 @@ export const record_ai_usage = async function (uid, input_tokens, output_tokens,
   try {
     if (!account_profile_info) throw new Error('missing account_profile_info');
 
-    const cost = _conf?.ai_models?.[model] || {
+    // `model` arrives as the stable ai_models code (the key profiles/agents store,
+    // e.g. 'gpt-5.4'). Price by that code, but store the real OpenAI model name in
+    // the usage record (e.g. 'gpt-5.6-terra') so usage/billing reflects the actual
+    // model used. Also match by .model so a caller that already passed a real id
+    // still prices correctly.
+    const models = _conf?.ai_models || {};
+    // Canonicalize a legacy key (still stored on old profiles/agents, e.g. 'gpt-5.4')
+    // to its current catalog code before pricing.
+    const code = _conf?.ai_model_aliases?.[model] || model;
+    const entry = models[code] || Object.values(models).find((e) => e && e.model === model) || null;
+    const cost = entry || {
       input: 1.0,
       output: 1.0,
     };
+    const model_name = entry?.model || model;
 
     const t = Date.now();
     let usage_doc = {
@@ -5934,7 +6063,7 @@ export const record_ai_usage = async function (uid, input_tokens, output_tokens,
       output_tokens,
       stat: 3,
       metadata,
-      model,
+      model: model_name,
       cost,
       account_profile_info,
       tools,
@@ -6226,6 +6355,64 @@ const _nl_gif_url = (g) => (g ? `https://xuda.ai/dist/images/email/${g}.gif` : '
 const _nl_esc = (v) =>
   String(v == null ? '' : v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 
+// Self-healing storage: xuda_newsletter lives on master ONLY and replicates to
+// master2 ONLY (never regions — the fleet control-DB hub must not pick it up).
+// Creates the DB if missing (fresh master build / DR restore / master2 promote)
+// and upserts the continuous master->master2 replicator doc, modeled on the
+// fw_repl_* docs. Idempotent; called from newsletter_generate which is already
+// gated to master + dev, so this can never materialize the DB on a region.
+const _nl_ensure_storage = async () => {
+  const cc = _conf.couchdb_control_database?.[process.env.XUDA_HOSTNAME] || _conf.couchdb_control_database;
+  if (!cc?.db_server_location) return;
+  await db_module.create_couch_database(NEWSLETTER_DB, `${cc.db_server_http}://${cc.db_server_username}:${cc.db_server_password}@${cc.db_server_location}`);
+  if (process.env.XUDA_HOSTNAME !== 'master.xuda.ai') return;
+  const m2 = _conf.couchdb_control_database?.['master2.xuda.ai'];
+  if (!m2?.db_server_location) return;
+  const rep_id = 'nl_repl_master_to_master2';
+  const existing = await db_module.get_couch_doc('_replicator', rep_id);
+  if (existing.code > 0 && existing.data) return;
+  const b64 = (u, p) => 'Basic ' + Buffer.from(`${u}:${p}`).toString('base64');
+  const save = await db_module.save_couch_doc('_replicator', {
+    _id: rep_id,
+    source: { url: `${cc.db_server_http}://${cc.db_server_location}/${NEWSLETTER_DB}`, headers: { Authorization: b64(cc.db_server_username, cc.db_server_password) } },
+    target: { url: `${m2.db_server_http}://${m2.db_server_location}/${NEWSLETTER_DB}`, headers: { Authorization: b64(m2.db_server_username || cc.db_server_username, m2.db_server_password || cc.db_server_password) } },
+    continuous: true,
+    create_target: true,
+  });
+  if (save.code < 0) console.error('[newsletter] replicator ensure failed:', save.data);
+};
+
+// The admin panel is served from whatever region CF routes the superuser to, but
+// xuda_newsletter lives on master + master2 only. So the read-side methods must
+// resolve MASTER's couch when running on a region (reachable over the WG hub at
+// 10.8.0.1), and read the local couch on master itself and on dev (standalone,
+// is_debug). Returns a DSN for the _custom read helpers, or null = local couch.
+const _nl_read_dsn = () => {
+  if (_conf.is_debug) return null;
+  if (process.env.XUDA_HOSTNAME === 'master.xuda.ai') return null;
+  const m = _conf.couchdb_control_database?.['master.xuda.ai'];
+  if (!m?.db_server_location) return null;
+  return `${m.db_server_http}://${m.db_server_username}:${m.db_server_password}@${m.db_server_location}`;
+};
+
+// Mango query against xuda_newsletter wherever it actually lives (master from a
+// region, local on master/dev). Same {docs} shape either way.
+const _nl_find = async (selector, extra = {}) => {
+  const dsn = _nl_read_dsn();
+  if (dsn) return await db_module.find_couch_query_custom(NEWSLETTER_DB, dsn, { selector, ...extra });
+  return await db_module.find_couch_query(NEWSLETTER_DB, { selector, ...extra }, true);
+};
+
+// Fetch one issue by _id from the same source. Returns {code, data} like
+// get_couch_doc so callers stay unchanged.
+const _nl_get = async (id) => {
+  const dsn = _nl_read_dsn();
+  if (!dsn) return await db_module.get_couch_doc(NEWSLETTER_DB, id);
+  const ret = await db_module.find_couch_query_custom(NEWSLETTER_DB, dsn, { selector: { _id: id }, limit: 1 });
+  const doc = (ret.docs || [])[0];
+  return doc ? { code: 1, data: doc } : { code: -1, data: 'issue not found' };
+};
+
 // Next issue number = max(existing) + 1. Read-only projection (never PUT these).
 const _nl_next_number = async () => {
   try {
@@ -6583,6 +6770,10 @@ const _newsletter_send_sample_internal = async (issue, to_email, theme) => {
 export const newsletter_generate = async function (req = {}) {
   try {
     if (!req.system && !_ops_is_super(req)) return { code: -403, data: 'superuser only' };
+    // Master-only (dev exempt for testing): the issue DB must never be created
+    // on a regional couch, and the weekly coupon/sample flow belongs to master.
+    if (!_conf.is_debug && process.env.XUDA_HOSTNAME !== 'master.xuda.ai') return { code: -1, data: 'newsletter_generate runs on master only' };
+    await _nl_ensure_storage();
 
     // Two DISTINCT tips: one for "Did you know?", one for "Tip of the week".
     const _two_tips = async () => {
@@ -6651,7 +6842,7 @@ export const newsletter_generate = async function (req = {}) {
 export const newsletter_list_issues = async function (req = {}) {
   try {
     if (!_ops_is_super(req)) return { code: -403, data: 'superuser only' };
-    const ret = await db_module.find_couch_query(NEWSLETTER_DB, { selector: { docType: 'newsletter_issue' }, limit: 500 }, true);
+    const ret = await _nl_find({ docType: 'newsletter_issue' }, { limit: 500 });
     const rows = (ret.docs || [])
       .sort((a, b) => (b.issue_number || 0) - (a.issue_number || 0))
       .map((d) => ({ id: d._id, issue_number: d.issue_number, status: d.status, subject: d.subject, created_ts: d.created_ts, published_ts: d.published_ts || null, coupon: d.content && d.content.coupon ? d.content.coupon.promo_code : null, sent: d.sent || { count: 0, failed: 0 } }));
@@ -6665,7 +6856,7 @@ export const newsletter_preview = async function (req = {}) {
   try {
     if (!_ops_is_super(req)) return { code: -403, data: 'superuser only' };
     const id = req.id || `nl_issue_${req.issue_number}`;
-    const ret = await db_module.get_couch_doc(NEWSLETTER_DB, id);
+    const ret = await _nl_get(id);
     if (ret.code < 0 || !ret.data) return { code: -1, data: 'issue not found' };
     const host = _ops_host();
     const [fpool, ppool] = await Promise.all([_nl_fashion_pool(), _nl_partner_pool()]);
@@ -6684,7 +6875,7 @@ export const newsletter_send_sample = async function (req = {}) {
   try {
     if (!_ops_is_super(req)) return { code: -403, data: 'superuser only' };
     const id = req.id || `nl_issue_${req.issue_number}`;
-    const ret = await db_module.get_couch_doc(NEWSLETTER_DB, id);
+    const ret = await _nl_get(id);
     if (ret.code < 0 || !ret.data) return { code: -1, data: 'issue not found' };
     const to = req.email || 'info@xuda.ai';
     const sr = await _newsletter_send_sample_internal(ret.data, to, req.theme);
@@ -6740,6 +6931,9 @@ const _newsletter_blast = async (issue, by_uid) => {
 export const newsletter_publish = async function (req = {}) {
   try {
     if (!_ops_is_super(req)) return { code: -403, data: 'superuser only' };
+    // Same master-only gate as generate: the blast must run where xuda_newsletter
+    // and the authoritative xuda_accounts live (dev exempt for testing).
+    if (!_conf.is_debug && process.env.XUDA_HOSTNAME !== 'master.xuda.ai') return { code: -1, data: 'newsletter_publish runs on master only' };
     const id = req.id || `nl_issue_${req.issue_number}`;
     const gret = await db_module.get_couch_doc(NEWSLETTER_DB, id);
     if (gret.code < 0 || !gret.data) return { code: -1, data: 'issue not found' };

package/index_ms.mjs

@@ -249,6 +249,10 @@ export const save_ssh_key = async function (...args) {
   return await broker.send_to_queue("save_ssh_key", ...args);
 };
 
+export const set_ssh_key_enabled = async function (...args) {
+  return await broker.send_to_queue("set_ssh_key_enabled", ...args);
+};
+
 export const delete_ssh_key = async function (...args) {
   return await broker.send_to_queue("delete_ssh_key", ...args);
 };
@@ -257,6 +261,10 @@ export const get_ssh_keys = async function (...args) {
   return await broker.send_to_queue("get_ssh_keys", ...args);
 };
 
+export const get_ssh_key_events = async function (...args) {
+  return await broker.send_to_queue("get_ssh_key_events", ...args);
+};
+
 export const search_users = async function (...args) {
   return await broker.send_to_queue("search_users", ...args);
 };

package/index_msa.mjs

@@ -249,6 +249,10 @@ export const save_ssh_key =  function (...args) {
    broker.send_to_queue_async("save_ssh_key", ...args);
 };
 
+export const set_ssh_key_enabled =  function (...args) {
+   broker.send_to_queue_async("set_ssh_key_enabled", ...args);
+};
+
 export const delete_ssh_key =  function (...args) {
    broker.send_to_queue_async("delete_ssh_key", ...args);
 };
@@ -257,6 +261,10 @@ export const get_ssh_keys =  function (...args) {
    broker.send_to_queue_async("get_ssh_keys", ...args);
 };
 
+export const get_ssh_key_events =  function (...args) {
+   broker.send_to_queue_async("get_ssh_key_events", ...args);
+};
+
 export const search_users =  function (...args) {
    broker.send_to_queue_async("search_users", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.2286",
+  "version": "1.2.2288",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {