backend-manager 5.9.6 → 5.9.8

package/templates/backend-manager-config.json

@@ -0,0 +1,249 @@
+{
+  parent: '',  // 'self' = this BEM is the parent (newsletter-sources provider); a URL = external parent; '' = no parent
+  brand: {
+    id: 'my-app',
+    name: 'My Brand',
+    description: '',
+    url: 'https://example.com',
+    contact: {
+      email: 'support@example.com',
+    },
+    // Physical postal address — required by CAN-SPAM in commercial email footers.
+    // Rendered in the newsletter footer + transactional email footers.
+    // Structured so the renderer can format it consistently across locales
+    // and break onto multiple lines if needed. line2/region/postalCode are optional.
+    address: {
+      line1: '123 Main St',
+      line2: 'Suite 100',
+      city: 'City',
+      region: 'ST',
+      postalCode: '12345',
+      country: 'United States',
+    },
+    images: {
+      wordmark: 'https://example.com/wordmark.png',
+      brandmark: 'https://example.com/wordmark.png',
+      combomark: 'https://example.com/combomark.png',
+    },
+  },
+  github: {
+    user: 'username',
+    repo_website: 'https://github.com/username/backend-manager',
+  },
+  parent: '',  // URL of the parent BEM instance (e.g., 'https://api.itwcreativeworks.com') — used by newsletter generator to pull sources
+  sentry: {
+    dsn: 'https://d965557418748jd749d837asf00552f@o777489.ingest.sentry.io/8789941',
+  },
+  analytics: {
+    providers: {
+      google: {
+        id: null,
+      },
+      meta: {
+        id: null,
+      },
+      tiktok: {
+        id: null,
+      },
+    },
+  },
+  oauth2: {},
+  payment: {
+    processors: {
+      stripe: {
+        publishableKey: null,
+      },
+      paypal: {
+        clientId: null,
+      },
+      chargebee: {
+        site: null,
+      },
+      coinbase: {
+        enabled: false,
+      },
+    },
+    products: [
+      {
+        id: 'basic',
+        name: 'Basic',
+        type: 'subscription',
+        limits: {
+          requests: 100,
+        },
+      },
+      {
+        id: 'premium',
+        name: 'Premium',
+        type: 'subscription',
+        limits: {
+          requests: 1000,
+        },
+        trial: {
+          days: 14,
+        },
+        prices: {
+          monthly: 4.99,
+          annually: 49.99,
+        },
+        stripe: {
+          productId: null,
+        },
+        paypal: {
+          productId: null,
+        },
+        chargebee: {
+          itemId: null,
+          legacyPlanIds: [],
+        },
+      },
+      {
+        id: 'ultimate',
+        name: 'Ultimate',
+        type: 'subscription',
+        limits: {
+          requests: 10000,
+        },
+        prices: {
+          monthly: 19.99,
+          annually: 199.99,
+        },
+        stripe: {
+          productId: null,
+        },
+        paypal: {
+          productId: null,
+        },
+        chargebee: {
+          itemId: null,
+          legacyPlanIds: [],
+        },
+      },
+      {
+        id: 'credits-100',
+        name: '100 Credits',
+        type: 'one-time',
+        prices: {
+          once: 9.99,
+        },
+        stripe: {
+          productId: null,
+        },
+        chargebee: {
+          itemId: null,
+        },
+      },
+      // Add more products/tiers here
+    ],
+  },
+  marketing: {
+    campaigns: {
+      enabled: true,
+      platform: 'sendgrid',
+      listId: '',  // SendGrid Marketing list UUID. Populated by OMEGA's sendgrid/ensure/list.js. Skips runtime list-discovery API call.
+    },
+    newsletter: {
+      enabled: false,
+      platform: 'beehiiv',
+      publicationId: '',  // Beehiiv publication ID (e.g., 'pub_xxxxx'). Populated by OMEGA's beehiiv/ensure/publication.js. Required for marketing sync to Beehiiv.
+      // Content: single object or array (matches blog config shape). Generator uses the first entry.
+      content: [
+        {
+          sources: ['$parent'],    // '$parent' | '$feed:https://...' | '$brand'
+          categories: [],          // e.g., ['social-media', 'marketing'] — topic constraints + AI categorization
+          links: [],               // links to inject into generated content
+          instructions: '',        // free-form text passed to the AI
+          tone: 'professional',    // 'professional' | 'casual' | 'actionable' | 'witty' | etc.
+          keywords: [],            // SEO keywords to weave in
+          template: 'clean',       // 'clean' | 'editorial' | 'field-report' — layout template
+          article: {
+            enabled: false,        // expand lead section into a full blog post via Ghostii
+            author: null,
+          },
+          theme: {
+            primaryColor: '#5B5BFF',
+            secondaryColor: '#1E1E2A',
+            accentColor: '#F6F7FB',
+            font: 'Inter, system-ui, sans-serif',
+          },
+          sponsorships: [],
+        },
+      ],
+    },
+    prune: {
+      enabled: true,
+    },
+  },
+  firebaseConfig: {
+    apiKey: '123-456',
+    authDomain: 'PROJECT-ID.firebaseapp.com',
+    projectId: 'PROJECT-ID',
+    storageBucket: 'PROJECT-ID.appspot.com',
+    messagingSenderId: '123',
+    appId: '1:123:web:456',
+    measurementId: 'G-0123456789',
+  },
+  // Standalone blog auto-publisher (daily cron). OPT-IN: disabled by default.
+  // Set enabled: true and quantity >= 1 to auto-publish independent blog posts.
+  // For newsletter-linked articles, use marketing.newsletter.content.article.enabled instead.
+  //
+  // `platform` selects the article-generation provider (only 'ghostii' for now).
+  //
+  // Source types:
+  //   '$brand'                          — generic brand-topic generation
+  //   '$feed:https://example.com/feed'  — RSS/Atom/JSON feed: pick one unprocessed article per run
+  //   '$parent'                         — fetch sources from parent server's source pool (without claiming)
+  //   'https://example.com/page'        — fetch URL content as prompt seed
+  //   'Write about topic X'             — text: use directly as prompt seed
+  //
+  // All feed/parent sources are tracked in Firestore (`content-sources`) so the same
+  // article is never reprocessed. When a feed is unreachable or exhausted, falls back to $brand.
+  blog: {
+    enabled: false,
+    platform: 'ghostii',
+    content: [
+      {
+        sources: [             // '$brand' | '$feed:https://...' | '$parent'
+          '$brand',
+          // '$feed:https://techcrunch.com/feed/',
+          // '$parent',
+        ],
+        categories: [],        // topic constraints + output tags
+        links: [],             // links to inject into generated content
+        instructions: '',      // free-form text passed to the AI
+        tone: 'professional',  // 'professional' | 'casual' | 'actionable' | 'witty' | etc.
+        keywords: [],          // SEO keywords to weave in
+        quantity: 0,           // number of articles to generate per run
+        chance: 1.0,
+        author: null,
+        postPath: 'ghostii',  // defaults to platform name; sub-folder under _posts/{year}/
+        // Per-entry Ghostii API overrides (all optional, fall back to framework defaults)
+        overrides: {
+          // keywords: ['AI', 'technology'],
+          // length: 'long',              // short | medium | long | comprehensive
+          // research: true,              // web search for real external links
+          // insertImages: true,          // section images from Unsplash
+          // headerImageUrl: 'unsplash',  // disabled | unsplash | generate
+          // maxLinks: 6,
+          // sectionQuantity: 5,
+          // feedUrl: '',                 // brand blog feed for title dedup
+        },
+        // brand: 'other-app-id',                // Optional: target a different brand
+        // brandUrl: 'https://api.otherapp.com',  // Required if brand is set
+      },
+    ],
+  },
+  reviews: {
+    enabled: true,
+    sites: [
+      'trustpilot.com',
+    ],
+  },
+  dataRequest: {
+    // Additional queries to include in GDPR data exports
+    // BEM always exports: users, auth record, data-requests, payments-intents, payments-orders
+    // Single doc: { path: 'collection/{uid}', redact: ['field.to.redact'] }
+    // Collection query: { collection: 'my-data', where: [['ownerField', '==', '{uid}']] }
+    queries: [],
+  },
+}

package/templates/database.rules.json

@@ -0,0 +1,83 @@
+{
+  "rules": {
+    ///---backend-manager---///
+    ///---version=0.0.0---///
+
+    // Sessions rules
+    "sessions": {
+      ".read": false,
+      ".write": false,
+			"$room": {
+        ".read": "
+        	(auth.uid != null && query.equalTo == auth.uid)
+        ",
+        ".write": false,
+        ".indexOn": ["uid"],
+        "$id": {
+          ".read": "
+          	// Allowed if user is authenticated AND is the owner of the doc
+          	(auth != null && auth.uid == data.child('uid').val())
+            // Allowed if uid is equal to the doc id [LEGACY FOR SOMIIBO]
+            || (auth != null && auth.uid == $id)
+          	// Allowed if user is not authenticated AND is the doc has no owner
+          	|| (auth == null && (data.child('uid').val() == ''))
+          ",
+          ".write": "
+          	// Allowed if the user is authenticated AND is the owner of the existing doc
+          	(auth != null && auth.uid == data.child('uid').val())
+          	// Allowed if the user is authenticated AND is the owner of the new doc
+          	|| (auth != null && auth.uid == newData.child('uid').val())
+            // Allowed if the user is authenticated AND is the owner of the existing doc
+          	|| (auth != null && auth.uid == data.child('uid').val())
+            // Allowed if uid is equal to the doc id [LEGACY FOR SOMIIBO]
+            || (auth != null && auth.uid == $id)
+            // Allowed if the existing doc has no owner
+          	|| (data.child('uid').val() == '')
+          	// Allowed if the new doc has no owner
+          	|| (newData.child('uid').val() == '')
+            // Allowed if it's a delete
+          	|| (!newData.exists())
+          ",
+      	}
+      }
+    },
+    "gatherings": {
+      ".read": false,
+      ".write": false,
+			"$room": {
+        ".read": "
+        	(auth.uid != null && query.equalTo == auth.uid)
+        ",
+        ".write": false,
+        ".indexOn": ["uid"],
+        "$id": {
+          ".read": "
+          	// Allowed if user is authenticated AND is the owner of the doc
+          	(auth != null && auth.uid == data.child('uid').val())
+            // Allowed if uid is equal to the doc id [LEGACY FOR SOMIIBO]
+            || (auth != null && auth.uid == $id)
+          	// Allowed if user is not authenticated AND is the doc has no owner
+          	|| (auth == null && (data.child('uid').val() == ''))
+          ",
+          ".write": "
+          	// Allowed if the user is authenticated AND is the owner of the existing doc
+          	(auth != null && auth.uid == data.child('uid').val())
+          	// Allowed if the user is authenticated AND is the owner of the new doc
+          	|| (auth != null && auth.uid == newData.child('uid').val())
+            // Allowed if the user is authenticated AND is the owner of the existing doc
+          	|| (auth != null && auth.uid == data.child('uid').val())
+            // Allowed if uid is equal to the doc id [LEGACY FOR SOMIIBO]
+            || (auth != null && auth.uid == $id)
+            // Allowed if the existing doc has no owner
+          	|| (data.child('uid').val() == '')
+          	// Allowed if the new doc has no owner
+          	|| (newData.child('uid').val() == '')
+            // Allowed if it's a delete
+          	|| (!newData.exists())
+          ",
+      	}
+      }
+    },
+    ///---------end---------///
+  }
+}

package/templates/firebase.json

@@ -0,0 +1,66 @@
+{
+  "hosting": {
+    "public": "public",
+    "ignore": [
+      "firebase.json",
+      "**/.*",
+      "**/node_modules/**"
+    ],
+    "rewrites": [
+      {
+        "source": "{/backend-manager,/backend-manager/**,/mcp,/mcp/**,/.well-known/oauth-protected-resource,/.well-known/oauth-authorization-server,/authorize,/token,/register}",
+        "function": "bm_api"
+      }
+    ]
+  },
+  "functions": [
+    {
+      "source": "functions",
+      "codebase": "default",
+      "ignore": [
+        "node_modules",
+        ".git",
+        "firebase-debug.log",
+        "firebase-debug.*.log"
+      ]
+    }
+  ],
+  "firestore": {
+    "rules": "firestore.rules",
+    "indexes": "firestore.indexes.json"
+  },
+  "database": {
+    "rules": "database.rules.json"
+  },
+  "storage": {
+    "rules": "storage.rules"
+  },
+  "emulators": {
+    "auth": {
+      "port": 9099
+    },
+    "functions": {
+      "port": 5001
+    },
+    "firestore": {
+      "port": 8080
+    },
+    "database": {
+      "port": 9000
+    },
+    "hosting": {
+      "port": 5002
+    },
+    "storage": {
+      "port": 9199
+    },
+    "ui": {
+      "enabled": true,
+      "port": 4050
+    },
+    "pubsub": {
+      "port": 8085
+    },
+    "singleProjectMode": true
+  }
+}

package/templates/firestore.indexes.json

@@ -0,0 +1,4 @@
+{
+  "indexes": [],
+  "fieldOverrides": []
+}

package/templates/firestore.rules

@@ -0,0 +1,112 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+    // Custom rules
+    // ...
+
+    ///---backend-manager---///
+    ///---version=0.0.0---///
+    // Lock by default
+    match /{document=**} {
+      allow read, write: if isAdmin();
+    }
+
+    // Protect user account data
+    match /users/{uid} {
+      allow read: if belongsTo(uid);
+      allow write: if belongsTo(uid) && !isWritingProtectedUserField();
+    }
+
+    // Protect notification data
+    match /notifications/{token} {
+      allow read: if resource == null || existingData().token == token || belongsTo(existingData().owner);
+      allow update: if existingData().token == token;
+      allow create: if true;
+    }
+
+    // Protect abandoned cart data
+    match /payments-carts/{uid} {
+      allow create, update: if belongsTo(uid)
+        && incomingData().owner == uid
+        && incomingData().status == 'pending';
+      allow read: if belongsTo(uid);
+    }
+
+    // Auth functions
+    function authEmail() {
+      return request.auth.token.email;
+    }
+    function authUid() {
+      return request.auth.uid;
+    }
+    function isAuthenticated() {
+      return request.auth != null;
+    }
+    function belongsTo(identity) {
+      return isAuthenticated() && (authUid() == identity || authEmail() == identity);
+      // eventually include a check for (existingData().owner == identity)...(in case its a doc owned by a user that's not actually user doc)
+    }
+
+    function getRoles() {
+      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.roles;
+    }
+    function getVerifications() {
+      return get(/databases/$(database)/documents/users/$(request.auth.uid)).data.verifications;
+    }
+    function isAdmin() {
+      return getRoles().admin == true;
+    }
+    function emailVerified() {
+      return getVerifications().email == true;
+    }
+
+    function isWritingProtectedUserField() {
+      return isWritingField('auth')
+        || isWritingField('roles')
+        || isWritingField('flags')
+        || isWritingField('plan') // TODO: REMOVE THIS WHEN ALL PROJECTS UPDATED
+        || isWritingField('subscription')
+        || isWritingField('affiliate')
+        || isWritingField('api')
+        || isWritingField('metadata')
+        || isWritingField('usage')
+        || isWritingField('consent');
+    }
+
+    function isCreatingField(field) {
+      return !(field in resource.data) && field in request.resource.data;
+    }
+
+    function isUpdatingField(field) {
+      return field in resource.data && field in request.resource.data && resource.data[field] != request.resource.data[field];
+    }
+
+    function isWritingField(field) {
+      return isCreatingField(field) || isUpdatingField(field);
+    }
+
+    // function userEmail(userId) {
+    //   return get(/databases/$(database)/documents/users/$(userId)).data.email;
+    // }
+    // Helper functions
+    // [READ] Data that exists on the Firestore document
+    function existingData() {
+      return resource.data;
+    }
+    // [WRITE] Data that is sent to a Firestore document
+    function incomingData() {
+      return request.resource.data;
+    }
+    ///--------tests--------///
+    // match /test-cases/write/admin {
+    //   allow write: if isAdmin();
+    // }
+    ///------resources------///
+    // https://fireship.io/snippets/firestore-rules-recipes/
+    // https://github.com/jaysquared/atom-firestore-grammar
+    // https://fireship.io/courses/firestore-data-modeling/models-roles/
+    // https://firebase.google.com/docs/firestore/security/test-rules-emulator
+    ///---------end---------///
+
+  }
+}

package/templates/public/404.html

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>404 Error Page</title>
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet">
+  </head>
+
+  <body>
+    <div class="d-flex align-items-center justify-content-center vh-100">
+      <div class="text-center">
+        <h1 class="display-1 fw-bold">404</h1>
+
+        <p class="fs-3"> <span class="text-danger">Opps!</span> Page not found.</p>
+
+        <p class="lead">
+          The page you're looking for doesn't exist.
+        </p>
+
+        <a href="{url}" class="btn btn-primary">Go Home</a>
+      </div>
+    </div>
+  </body>
+</html>

package/templates/public/index.html

@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>404 Error Page</title>
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet">
+  </head>
+
+  <body>
+    <div class="d-flex align-items-center justify-content-center vh-100">
+      <div class="text-center">
+        <h1 class="display-1 fw-bold">Welcome!</h1>
+
+        <p class="lead">
+          This is an internal page, please return to our main website
+        </p>
+
+        <a href="{url}" class="btn btn-primary">Go Home</a>
+      </div>
+    </div>
+  </body>
+</html>

package/templates/remoteconfig.template.json

@@ -0,0 +1 @@
+{}

package/templates/storage-lifecycle-config-1-day.json

@@ -0,0 +1,9 @@
+{
+  "rule":
+  [
+    {
+      "action": {"type": "Delete"},
+      "condition": {"age": 1}
+    }
+  ]
+}

package/templates/storage-lifecycle-config-30-days.json

@@ -0,0 +1,9 @@
+{
+  "rule":
+  [
+    {
+      "action": {"type": "Delete"},
+      "condition": {"age": 30}
+    }
+  ]
+}

package/templates/storage.rules

@@ -0,0 +1,8 @@
+rules_version = '2';
+service firebase.storage {
+  match /b/{bucket}/o {
+    match /{allPaths=**} {
+      allow read, write: if request.auth!=null;
+    }
+  }
+}

package/test/_init/accounts-validation.js

@@ -0,0 +1,58 @@
+const { TEST_ACCOUNTS } = require('../../src/test/test-accounts.js');
+
+/**
+ * Test: Account Structure Validation
+ * Verifies that all test accounts were created with the expected User helper fields
+ * This catches failures in auth:on-create before other tests run
+ */
+module.exports = {
+  description: 'Test accounts have required User structure',
+  auth: 'none',
+  timeout: 10000,
+
+  async run({ accounts, assert, firestore }) {
+    const accountIds = Object.keys(TEST_ACCOUNTS);
+
+    for (const accountId of accountIds) {
+      const account = accounts[accountId];
+
+      // Check account was fetched
+      assert.ok(account, `Account '${accountId}' should exist in accounts object`);
+      assert.ok(account.uid, `Account '${accountId}' should have uid`);
+
+      // Fetch full user doc from Firestore
+      const userDoc = await firestore.get(`users/${account.uid}`);
+
+      assert.ok(userDoc, `User doc for '${accountId}' should exist in Firestore`);
+
+      // Validate auth fields (set by on-create)
+      assert.hasProperty(userDoc, 'auth.uid', `Account '${accountId}' should have auth.uid`);
+      assert.hasProperty(userDoc, 'auth.email', `Account '${accountId}' should have auth.email`);
+
+      // Validate API fields (generated by on-create via User helper)
+      assert.hasProperty(userDoc, 'api.clientId', `Account '${accountId}' should have api.clientId`);
+      assert.hasProperty(userDoc, 'api.privateKey', `Account '${accountId}' should have api.privateKey`);
+
+      // Validate privateKey was fetched correctly
+      assert.ok(account.privateKey, `Account '${accountId}' privateKey should be fetched`);
+      assert.equal(
+        account.privateKey,
+        userDoc.api.privateKey,
+        `Account '${accountId}' fetched privateKey should match Firestore`
+      );
+
+      // Validate affiliate code (generated by on-create via User helper)
+      assert.hasProperty(userDoc, 'affiliate.code', `Account '${accountId}' should have affiliate.code`);
+
+      // Validate metadata.created (set by on-create via User helper)
+      assert.hasProperty(userDoc, 'metadata.created.timestamp', `Account '${accountId}' should have metadata.created.timestamp`);
+      assert.hasProperty(userDoc, 'metadata.created.timestampUNIX', `Account '${accountId}' should have metadata.created.timestampUNIX`);
+
+      // Validate subscription fields (merged from test account properties)
+      assert.hasProperty(userDoc, 'subscription.product.id', `Account '${accountId}' should have subscription.product.id`);
+      assert.hasProperty(userDoc, 'subscription.status', `Account '${accountId}' should have subscription.status`);
+    }
+
+    return { success: true };
+  },
+};