adonia 0.1.0

package/registry/auth/tests/fakes/memory_session_manager.ts

@@ -0,0 +1,23 @@
+import type { User } from '#modules/contracts/index'
+import type {
+  SessionManager,
+  SessionResult,
+} from '#modules/auth/contracts/index'
+
+/**
+ * In-memory SessionManager. Cookie-style hosts return {}.
+ */
+export class MemorySessionManager implements SessionManager {
+  logins: User[] = []
+  logouts = 0
+  result: SessionResult = {}
+
+  async login(user: User): Promise<SessionResult> {
+    this.logins.push(user)
+    return this.result
+  }
+
+  async logout(): Promise<void> {
+    this.logouts++
+  }
+}

package/registry/auth/tests/fakes/memory_user_store.ts

@@ -0,0 +1,89 @@
+import type { RegisterUserInput, User, UserStore } from '#modules/contracts/index'
+
+type StoredUser = User & { password: string }
+
+/**
+ * In-memory UserStore for unit tests. Records saves for side-effect assertions.
+ */
+export class MemoryUserStore implements UserStore {
+  users = new Map<number, StoredUser>()
+  saves: User[] = []
+  nextId = 1
+
+  async createEmailUser(data: RegisterUserInput): Promise<User> {
+    const user: StoredUser = {
+      id: this.nextId++,
+      email: data.email,
+      pendingEmail: null,
+      password: data.password,
+      authMethod: 'email',
+      firstName: data.firstName ?? data.fullName?.split(' ')[0] ?? '',
+      lastName: data.lastName ?? data.fullName?.split(' ').slice(1).join(' ') ?? '',
+      avatarKey: null,
+      emailVerifiedAt: null,
+      emailVerificationToken: null,
+    }
+    this.users.set(user.id, user)
+    return this.toDto(user)
+  }
+
+  async findOrFail(id: number): Promise<User> {
+    const user = this.users.get(id)
+    if (!user) throw new Error(`User ${id} not found`)
+    return this.toDto(user)
+  }
+
+  async findByEmail(email: string): Promise<User | null> {
+    const user = [...this.users.values()].find((row) => row.email === email)
+    return user ? this.toDto(user) : null
+  }
+
+  async findByEmailOrFail(email: string): Promise<User> {
+    const user = await this.findByEmail(email)
+    if (!user) throw new Error(`User ${email} not found`)
+    return user
+  }
+
+  async findByVerificationToken(token: string): Promise<User | null> {
+    const user = [...this.users.values()].find((row) => row.emailVerificationToken === token)
+    return user ? this.toDto(user) : null
+  }
+
+  async verifyCredentials(email: string, password: string): Promise<User> {
+    const user = [...this.users.values()].find(
+      (row) => row.email === email && row.password === password
+    )
+    if (!user) throw new Error('Invalid credentials')
+    return this.toDto(user)
+  }
+
+  async verifyPassword(userId: number, password: string): Promise<boolean> {
+    const user = this.users.get(userId)
+    return !!user && user.password === password
+  }
+
+  async save(dto: User): Promise<User> {
+    const existing = this.users.get(dto.id)
+    if (!existing) throw new Error(`User ${dto.id} not found`)
+    const next: StoredUser = { ...existing, ...dto, password: existing.password }
+    this.users.set(dto.id, next)
+    this.saves.push(this.toDto(next))
+    return this.toDto(next)
+  }
+
+  async updatePassword(dto: User, password: string): Promise<User> {
+    const existing = this.users.get(dto.id)
+    if (!existing) throw new Error(`User ${dto.id} not found`)
+    existing.password = password
+    return this.toDto(existing)
+  }
+
+  async delete(userId: number): Promise<void> {
+    this.users.delete(userId)
+  }
+
+  private toDto(user: StoredUser): User {
+    const { password: _, ...dto } = user
+    return { ...dto }
+  }
+}

package/registry/constants/exceptions.ts

@@ -0,0 +1,64 @@
+import type { StatusCodeEntry } from '#modules/types/constants'
+
+/**
+ * Exception codes for modules + documented host-facing codes.
+ * Hosts extend via defineCodes in app/constants/.
+ *
+ * Host-facing (not thrown by a module service today):
+ * - INVALID_CREDENTIALS, UNAUTHENTICATED, SESSION_EXPIRED — auth middleware
+ * - FORBIDDEN — authorization failures
+ * - TOO_MANY_ATTEMPTS, TOO_MANY_REQUESTS — rate limiting
+ * - PAYLOAD_TOO_LARGE — file upload limits (HTTP 413)
+ */
+export const exceptions = {
+  INVALID_CREDENTIALS: {
+    status: 401,
+    code: 'E_INVALID_CREDENTIALS',
+  },
+  UNAUTHENTICATED: {
+    status: 401,
+    code: 'E_UNAUTHENTICATED',
+  },
+  SESSION_EXPIRED: {
+    status: 401,
+    code: 'E_SESSION_EXPIRED',
+  },
+  ACCOUNT_UNVERIFIED: {
+    status: 403,
+    code: 'E_ACCOUNT_UNVERIFIED',
+  },
+  FORBIDDEN: {
+    status: 403,
+    code: 'E_FORBIDDEN',
+  },
+  SAME_EMAIL: {
+    status: 400,
+    code: 'E_SAME_EMAIL',
+  },
+  INVALID_PASSWORD: {
+    status: 400,
+    code: 'E_INVALID_PASSWORD',
+  },
+  INVALID_TOKEN: {
+    status: 400,
+    code: 'E_INVALID_TOKEN',
+  },
+  PAYLOAD_TOO_LARGE: {
+    status: 413,
+    code: 'E_PAYLOAD_TOO_LARGE',
+  },
+  EMAIL_EXISTS: {
+    status: 409,
+    code: 'E_EMAIL_EXISTS',
+  },
+  TOO_MANY_ATTEMPTS: {
+    status: 429,
+    code: 'E_TOO_MANY_ATTEMPTS',
+  },
+  TOO_MANY_REQUESTS: {
+    status: 429,
+    code: 'E_TOO_MANY_REQUESTS',
+  },
+} as const satisfies Record<string, StatusCodeEntry>
+
+export type ExceptionKey = keyof typeof exceptions

package/registry/constants/index.ts

@@ -0,0 +1,12 @@
+import type { StatusCodeEntry } from '#modules/types/constants'
+
+export { exceptions } from './exceptions.ts'
+export { responseCodes } from './responseCodes.ts'
+
+/**
+ * Typed helper so hosts get the same `as const satisfies` ergonomics when
+ * extending catalogs in app/constants/.
+ */
+export function defineCodes<T extends Record<string, StatusCodeEntry>>(codes: T): T {
+  return codes
+}

package/registry/constants/responseCodes.ts

@@ -0,0 +1,87 @@
+import type { StatusCodeEntry } from '#modules/types/constants'
+
+/**
+ * Success message codes for auth/account controllers.
+ * Domain services do not import these — controllers build envelopes.
+ */
+export const responseCodes = {
+  AUTH_LOGIN: {
+    status: 200,
+    code: 'M_AUTH_LOGIN',
+  },
+  AUTH_LOGOUT: {
+    status: 200,
+    code: 'M_AUTH_LOGOUT',
+  },
+  AUTH_REGISTER: {
+    status: 201,
+    code: 'M_AUTH_REGISTER',
+  },
+  AUTH_RESET_PASSWORD_REQUEST: {
+    status: 200,
+    code: 'M_AUTH_RESET_PASSWORD_REQUEST',
+  },
+  AUTH_UPDATE_PASSWORD: {
+    status: 200,
+    code: 'M_AUTH_UPDATE_PASSWORD',
+  },
+  AUTH_ACTIVATE_ACCOUNT_REQUEST: {
+    status: 200,
+    code: 'M_AUTH_ACTIVATE_ACCOUNT_REQUEST',
+  },
+  AUTH_ACTIVATE_ACCOUNT: {
+    status: 200,
+    code: 'M_AUTH_ACTIVATE_ACCOUNT',
+  },
+  AUTH_VALIDATE_PASSWORD_RESET: {
+    status: 200,
+    code: 'M_AUTH_VALIDATE_PASSWORD_RESET',
+  },
+
+  PROFILE_UPDATED: {
+    status: 200,
+    code: 'M_PROFILE_UPDATED',
+  },
+  EMAIL_VERIFICATION_SENT: {
+    status: 200,
+    code: 'M_EMAIL_VERIFICATION_SENT',
+  },
+  EMAIL_CHANGE_CONFIRMED: {
+    status: 200,
+    code: 'M_EMAIL_CHANGE_CONFIRMED',
+  },
+  PASSWORD_UPDATED: {
+    status: 200,
+    code: 'M_PASSWORD_UPDATED',
+  },
+  ACCOUNT_DELETED: {
+    status: 200,
+    code: 'M_ACCOUNT_DELETED',
+  },
+  USER_SHOW: {
+    status: 200,
+    code: 'M_USER_SHOW',
+  },
+  NOTIFICATIONS_FETCHED: {
+    status: 200,
+    code: 'M_NOTIFICATIONS_FETCHED',
+  },
+  NOTIFICATIONS_UPDATED: {
+    status: 200,
+    code: 'M_NOTIFICATIONS_UPDATED',
+  },
+  INBOX_FETCHED: {
+    status: 200,
+    code: 'M_INBOX_FETCHED',
+  },
+  INBOX_MARKED_READ: {
+    status: 200,
+    code: 'M_INBOX_MARKED_READ',
+  },
+  INBOX_MARKED_ALL_READ: {
+    status: 200,
+    code: 'M_INBOX_MARKED_ALL_READ',
+  },
+} as const satisfies Record<string, StatusCodeEntry>
+
+export type ResponseCodeKey = keyof typeof responseCodes

package/registry/contracts/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Shared module contracts (cross-cutting ports).
+ * Module-specific contracts stay under modules/<name>/contracts.
+ */
+export type { AuthMethod, User, RegisterUserInput, UserStore } from './user.ts'

package/registry/contracts/user.ts

@@ -0,0 +1,78 @@
+/**
+ * Shared user port — used by auth, account, and any future user-facing module.
+ */
+
+export type AuthMethod = 'email' | 'github' | 'google'
+
+/**
+ * Portable user DTO. Host adapters map persistence models ↔ this shape.
+ */
+export type User = {
+  id: number
+  email: string
+  /** Staged email awaiting confirmation; current email stays valid until then. */
+  pendingEmail: string | null
+  authMethod: AuthMethod
+  firstName: string
+  lastName: string
+  avatarKey: string | null
+  emailVerifiedAt: Date | null
+  emailVerificationToken: string | null
+}
+
+/**
+ * Input for creating an email-auth user via UserStore.createEmailUser.
+ */
+export type RegisterUserInput = {
+  email: string
+  password: string
+  firstName?: string
+  lastName?: string
+  fullName?: string | null
+}
+
+/**
+ * Host must implement this. Auth/Account services talk only to this contract.
+ * Persistence, hashing, and schema details stay in the host adapter.
+ */
+export interface UserStore {
+  /**
+   * Persist a new email-auth user (hash password).
+   * Do not set emailVerifiedAt or verification token — the service owns that flow.
+   */
+  createEmailUser(data: RegisterUserInput): Promise<User>
+
+  findOrFail(id: number): Promise<User>
+
+  findByEmail(email: string): Promise<User | null>
+
+  findByEmailOrFail(email: string): Promise<User>
+
+  findByVerificationToken(token: string): Promise<User | null>
+
+  /**
+   * Verify email/password. Throw a framework/auth error on failure
+   * (mapped by the global exception handler).
+   */
+  verifyCredentials(email: string, password: string): Promise<User>
+
+  /**
+   * Verify a stored password for an existing user (no login).
+   */
+  verifyPassword(userId: number, password: string): Promise<boolean>
+
+  /**
+   * Persist User field changes (verification token, emailVerifiedAt, profile, …).
+   */
+  save(user: User): Promise<User>
+
+  /**
+   * Hash and persist a new password for the user.
+   */
+  updatePassword(user: User, password: string): Promise<User>
+
+  /**
+   * Permanently delete the user row.
+   */
+  delete(userId: number): Promise<void>
+}

package/registry/creem/contracts/creem_client.ts

@@ -0,0 +1,34 @@
+import type { CreemInvoice } from './types.ts'
+
+/**
+ * Narrow port over the Creem payment SDK.
+ * Host supplies a creem_io adapter (or a test double).
+ */
+export interface CreemClient {
+  createCheckout(input: {
+    successUrl: string
+    productId: string
+    customerEmail: string
+    userId: number
+  }): Promise<{ checkoutUrl: string | null | undefined }>
+
+  createPortalLink(customerId: string): Promise<{ portalUrl: string }>
+
+  listTransactions(
+    customerId: string,
+    limit: number
+  ): Promise<{ items: CreemInvoice[] }>
+
+  handleWebhookEvents(
+    rawBody: string,
+    signature: string,
+    handlers: CreemWebhookHandlers
+  ): Promise<void>
+}
+
+/**
+ * Webhook handlers passed through to the SDK.
+ * Typed loosely so the host can use creem_io's WebhookOptions shape
+ * without this contract importing the SDK.
+ */
+export type CreemWebhookHandlers = Record<string, ((...args: any[]) => any) | undefined>

package/registry/creem/contracts/index.ts

@@ -0,0 +1,8 @@
+export type {
+  CreemPlan,
+  CreemConfig,
+  CreemClientOptions,
+  CreemInvoice,
+} from './types.ts'
+
+export type { CreemClient, CreemWebhookHandlers } from './creem_client.ts'

package/registry/creem/contracts/types.ts

@@ -0,0 +1,30 @@
+/**
+ * Creem module config + shared value types.
+ * Product→plan mapping and default plan are host-owned.
+ */
+
+/** Plan names are free-form strings owned by the host. */
+export type CreemPlan = string
+
+export type CreemConfig = {
+  successUrl: string
+  /** Creem product id → plan name */
+  productPlans: Record<string, CreemPlan>
+  /** Plan when a product id is unmapped. Also used by SubscriptionService. */
+  defaultPlan: string
+}
+
+export type CreemClientOptions = {
+  apiKey: string
+  webhookSecret?: string
+  testMode?: boolean
+}
+
+export type CreemInvoice = {
+  id: string
+  type: 'payment' | 'invoice'
+  amount: number
+  currency: string
+  status: string
+  createdAt: number
+}

package/registry/creem/events.ts

@@ -0,0 +1,9 @@
+/**
+ * Creem module events. Import this file so the EventsList augmentation loads.
+ */
+declare module '@adonisjs/core/types' {
+  interface EventsList {
+    'Creem:CheckoutCreated': { userId: number; productId: string; checkoutUrl: string }
+    'Creem:PortalLinkCreated': { customerId: string }
+  }
+}

package/registry/creem/module.json

@@ -0,0 +1,28 @@
+{
+  "name": "creem",
+  "description": "Creem checkout, portal, invoices, and webhook verification",
+  "files": [
+    "service.ts",
+    "events.ts",
+    "contracts/**",
+    "module.json"
+  ],
+  "stubs": [
+    "stubs/adapters/**/*"
+  ],
+  "dependencies": {
+    "creem_io": "^1.0.0"
+  },
+  "registryDependencies": ["api"],
+  "peerModels": [],
+  "configKeys": ["modules.creem"],
+  "env": [
+    "CREEM_API_KEY",
+    "CREEM_WEBHOOK_SECRET",
+    "CREEM_TEST_MODE",
+    "CREEM_SUCCESS_URL"
+  ],
+  "events": ["Creem:CheckoutCreated", "Creem:PortalLinkCreated"],
+  "hostFacingExceptions": [],
+  "hostTests": []
+}

package/registry/creem/service.ts

@@ -0,0 +1,87 @@
+/**
+ * CreemService
+ *
+ * Checkout, customer portal, product→plan resolution, invoices, webhooks.
+ * Depends on CreemClient + CreemConfig — no env, no creem_io import.
+ */
+import ApiService from '#modules/api/service'
+import type {
+  CreemClient,
+  CreemConfig,
+  CreemInvoice,
+  CreemPlan,
+  CreemWebhookHandlers,
+} from '#modules/creem/contracts/index'
+import '#modules/creem/events'
+
+export class CreemService extends ApiService {
+  namespace = 'creem'
+
+  constructor(
+    private client: CreemClient,
+    private config: CreemConfig
+  ) {
+    super()
+  }
+
+  get defaultPlan(): string {
+    return this.config.defaultPlan
+  }
+
+  /**
+   * Creates a Creem checkout session.
+   * Passes userId in metadata so it can be linked on checkout.completed.
+   */
+  async createCheckout(productId: string, userId: number, userEmail: string): Promise<string> {
+    const checkout = await this.client.createCheckout({
+      successUrl: this.config.successUrl,
+      productId,
+      customerEmail: userEmail,
+      userId,
+    })
+
+    if (!checkout.checkoutUrl) {
+      throw new Error('Creem did not return a checkout URL')
+    }
+
+    this.emitSafe('Creem:CheckoutCreated', {
+      userId,
+      productId,
+      checkoutUrl: checkout.checkoutUrl,
+    })
+
+    return checkout.checkoutUrl
+  }
+
+  /**
+   * Generates a Creem customer portal link.
+   */
+  async createPortalLink(creemCustomerId: string): Promise<string> {
+    const portal = await this.client.createPortalLink(creemCustomerId)
+    this.emitSafe('Creem:PortalLinkCreated', { customerId: creemCustomerId })
+    return portal.portalUrl
+  }
+
+  /**
+   * Maps a Creem product ID to a plan string. Falls back to config.defaultPlan.
+   */
+  resolveProductPlan(creemProductId: string): CreemPlan {
+    return this.config.productPlans[creemProductId] ?? this.config.defaultPlan
+  }
+
+  async getLastInvoices(creemCustomerId: string): Promise<CreemInvoice[]> {
+    const result = await this.client.listTransactions(creemCustomerId, 3)
+    return result.items.filter((t) => t.type === 'invoice')
+  }
+
+  /**
+   * Delegates to the client webhook handler (signature verification included).
+   */
+  async handleWebhookEvents(
+    rawBody: string,
+    signature: string,
+    handlers: CreemWebhookHandlers
+  ): Promise<void> {
+    await this.client.handleWebhookEvents(rawBody, signature, handlers)
+  }
+}

package/registry/creem/stubs/adapters/creem.ts

@@ -0,0 +1,23 @@
+/**
+ * Host Creem factory. Copied to app/adapters/creem.ts.
+ * Import as `#adapters/creem`.
+ */
+import { CreemService } from '#modules/creem/service'
+import { CreemIoClient } from './creem_io_client.ts'
+import type {
+  CreemClientOptions,
+  CreemConfig,
+} from '#modules/creem/contracts/index'
+
+export { CreemIoClient } from './creem_io_client.ts'
+
+export type CreateCreemServiceOptions = CreemClientOptions & CreemConfig
+
+export function createCreemService(options: CreateCreemServiceOptions) {
+  const { successUrl, productPlans, defaultPlan, ...clientOptions } = options
+  return new CreemService(new CreemIoClient(clientOptions), {
+    successUrl,
+    productPlans,
+    defaultPlan,
+  })
+}

package/registry/creem/stubs/adapters/creem_io_client.ts

@@ -0,0 +1,70 @@
+/**
+ * Default CreemClient backed by creem_io. Copied to app/adapters/creem_io_client.ts.
+ * Host supplies API keys from env.
+ */
+import { createCreem } from 'creem_io'
+import type { WebhookOptions } from 'creem_io'
+import type {
+  CreemClient,
+  CreemClientOptions,
+  CreemWebhookHandlers,
+} from '#modules/creem/contracts/index'
+
+export class CreemIoClient implements CreemClient {
+  private client: ReturnType<typeof createCreem>
+
+  constructor(options: CreemClientOptions) {
+    this.client = createCreem({
+      apiKey: options.apiKey,
+      webhookSecret: options.webhookSecret,
+      testMode: options.testMode,
+    })
+  }
+
+  async createCheckout(input: {
+    successUrl: string
+    productId: string
+    customerEmail: string
+    userId: number
+  }) {
+    const checkout = await this.client.checkouts.create({
+      successUrl: input.successUrl,
+      productId: input.productId,
+      customer: { email: input.customerEmail },
+      metadata: { userId: String(input.userId) },
+    })
+
+    return { checkoutUrl: checkout.checkoutUrl }
+  }
+
+  async createPortalLink(customerId: string) {
+    const portal = await this.client.customers.createPortal({ customerId })
+    return { portalUrl: portal.customerPortalLink }
+  }
+
+  async listTransactions(customerId: string, limit: number) {
+    const result = await this.client.transactions.list({ customerId, limit })
+    return {
+      items: result.items.map((t) => ({
+        id: t.id,
+        type: t.type,
+        amount: t.amount,
+        currency: t.currency,
+        status: t.status,
+        createdAt: t.createdAt,
+      })),
+    }
+  }
+
+  async handleWebhookEvents(
+    rawBody: string,
+    signature: string,
+    handlers: CreemWebhookHandlers
+  ) {
+    await this.client.webhooks.handleEvents(
+      rawBody,
+      signature,
+      handlers as Omit<WebhookOptions, 'webhookSecret'>
+    )
+  }
+}