crewly 1.2.3 → 1.2.4

package/dist/backend/backend/src/services/cloud/auth/auth.types.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Auth Types
+ *
+ * Type definitions for the CrewlyAI Cloud account system.
+ * Covers user entities, JWT payloads, and request/response shapes.
+ *
+ * @module services/cloud/auth/auth.types
+ */
+import type { UserPlan } from '../../../constants.js';
+/** Stored user record (password hash included, never exposed via API). */
+export interface UserRecord {
+    /** Unique user identifier (UUID) */
+    id: string;
+    /** User email address (unique) */
+    email: string;
+    /** Scrypt-hashed password (hex-encoded salt:hash) */
+    passwordHash: string;
+    /** Display name */
+    displayName: string;
+    /** Subscription plan */
+    plan: UserPlan;
+    /** ISO timestamp of account creation */
+    createdAt: string;
+    /** ISO timestamp of last update */
+    updatedAt: string;
+}
+/** Public user profile (no sensitive fields). */
+export interface UserProfile {
+    /** Unique user identifier */
+    id: string;
+    /** User email address */
+    email: string;
+    /** Display name */
+    displayName: string;
+    /** Subscription plan */
+    plan: UserPlan;
+    /** ISO timestamp of account creation */
+    createdAt: string;
+}
+/** Payload embedded in JWT access tokens. */
+export interface JwtPayload {
+    /** Subject — user ID */
+    sub: string;
+    /** User email */
+    email: string;
+    /** User plan */
+    plan: UserPlan;
+    /** Issued-at timestamp (seconds since epoch) */
+    iat: number;
+    /** Expiration timestamp (seconds since epoch) */
+    exp: number;
+    /** Issuer */
+    iss: string;
+    /** Token type discriminator */
+    type: 'access' | 'refresh';
+}
+/** Request body for POST /api/auth/register. */
+export interface RegisterRequest {
+    email: string;
+    password: string;
+    displayName: string;
+}
+/** Request body for POST /api/auth/login. */
+export interface LoginRequest {
+    email: string;
+    password: string;
+}
+/** Request body for POST /api/auth/refresh. */
+export interface RefreshRequest {
+    refreshToken: string;
+}
+/** Request body for PUT /api/auth/me. */
+export interface UpdateProfileRequest {
+    displayName?: string;
+}
+/** Auth response with tokens. */
+export interface AuthTokenResponse {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    user: UserProfile;
+}
+/** License status response. */
+export interface LicenseStatus {
+    plan: UserPlan;
+    features: string[];
+    active: boolean;
+}
+/**
+ * Check whether a value is a valid UserPlan.
+ *
+ * @param value - Value to check
+ * @returns true if value is 'free' or 'pro'
+ */
+export declare function isValidPlan(value: unknown): value is UserPlan;
+/**
+ * Check whether a parsed object is a valid JwtPayload.
+ *
+ * @param data - Parsed JWT payload
+ * @returns true if data has all required fields
+ */
+export declare function isJwtPayload(data: unknown): data is JwtPayload;
+/**
+ * Convert a UserRecord to a public UserProfile (strips sensitive data).
+ *
+ * @param record - Full user record
+ * @returns Public profile without passwordHash
+ */
+export declare function toUserProfile(record: UserRecord): UserProfile;
+//# sourceMappingURL=auth.types.d.ts.map

package/dist/backend/backend/src/services/cloud/auth/auth.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/auth.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAMtD,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB;IAChB,IAAI,EAAE,QAAQ,CAAC;IACf,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC5B;AAMD,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,+BAA+B;AAC/B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,UAAU,CAY9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAQ7D"}

package/dist/backend/backend/src/services/cloud/auth/auth.types.js

@@ -0,0 +1,54 @@
+/**
+ * Auth Types
+ *
+ * Type definitions for the CrewlyAI Cloud account system.
+ * Covers user entities, JWT payloads, and request/response shapes.
+ *
+ * @module services/cloud/auth/auth.types
+ */
+// ---------------------------------------------------------------------------
+// Type guards
+// ---------------------------------------------------------------------------
+/**
+ * Check whether a value is a valid UserPlan.
+ *
+ * @param value - Value to check
+ * @returns true if value is 'free' or 'pro'
+ */
+export function isValidPlan(value) {
+    return value === 'free' || value === 'pro';
+}
+/**
+ * Check whether a parsed object is a valid JwtPayload.
+ *
+ * @param data - Parsed JWT payload
+ * @returns true if data has all required fields
+ */
+export function isJwtPayload(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const obj = data;
+    return (typeof obj['sub'] === 'string' &&
+        typeof obj['email'] === 'string' &&
+        typeof obj['plan'] === 'string' &&
+        typeof obj['iat'] === 'number' &&
+        typeof obj['exp'] === 'number' &&
+        typeof obj['iss'] === 'string' &&
+        (obj['type'] === 'access' || obj['type'] === 'refresh'));
+}
+/**
+ * Convert a UserRecord to a public UserProfile (strips sensitive data).
+ *
+ * @param record - Full user record
+ * @returns Public profile without passwordHash
+ */
+export function toUserProfile(record) {
+    return {
+        id: record.id,
+        email: record.email,
+        displayName: record.displayName,
+        plan: record.plan,
+        createdAt: record.createdAt,
+    };
+}
+//# sourceMappingURL=auth.types.js.map

package/dist/backend/backend/src/services/cloud/auth/auth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.types.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/auth.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwGH,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,OAAO,CACL,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;QAChC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ;QAC9B,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/cloud/auth/auth.utils.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared authentication utilities.
+ *
+ * Provides common types and helpers used across both JWT and Supabase
+ * authentication middleware to eliminate duplication.
+ *
+ * @module services/cloud/auth/auth.utils
+ */
+import type { Request } from 'express';
+import type { UserPlan } from '../../../constants.js';
+/** Authenticated user info attached to the request by auth middleware. */
+export interface AuthenticatedUser {
+    /** User ID (from JWT or Supabase) */
+    userId: string;
+    /** User email */
+    email: string;
+    /** User plan (resolved from license or token claims) */
+    plan: UserPlan;
+}
+/** Extended request type with authenticated user. */
+export interface AuthenticatedRequest extends Request {
+    /** Authenticated user data (set by auth middleware) */
+    user: AuthenticatedUser;
+}
+/** Minimum password length for registration. */
+export declare const MIN_PASSWORD_LENGTH = 8;
+/** Simple email format check regex. */
+export declare const EMAIL_REGEX: RegExp;
+/**
+ * Extract the Bearer token from an Authorization header.
+ *
+ * @param req - Express request
+ * @returns Token string or null if no valid Bearer token found
+ */
+export declare function extractBearerToken(req: Request): string | null;
+//# sourceMappingURL=auth.utils.d.ts.map

package/dist/backend/backend/src/services/cloud/auth/auth.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.utils.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/auth.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAMtD,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IACjC,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,IAAI,EAAE,QAAQ,CAAC;CACf;AAED,qDAAqD;AACrD,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACpD,uDAAuD;IACvD,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAMD,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,uCAAuC;AACvC,eAAO,MAAM,WAAW,QAA+B,CAAC;AAMxD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI9D"}

package/dist/backend/backend/src/services/cloud/auth/auth.utils.js

@@ -0,0 +1,31 @@
+/**
+ * Shared authentication utilities.
+ *
+ * Provides common types and helpers used across both JWT and Supabase
+ * authentication middleware to eliminate duplication.
+ *
+ * @module services/cloud/auth/auth.utils
+ */
+// ---------------------------------------------------------------------------
+// Shared Validation Constants
+// ---------------------------------------------------------------------------
+/** Minimum password length for registration. */
+export const MIN_PASSWORD_LENGTH = 8;
+/** Simple email format check regex. */
+export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+// ---------------------------------------------------------------------------
+// Shared Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Extract the Bearer token from an Authorization header.
+ *
+ * @param req - Express request
+ * @returns Token string or null if no valid Bearer token found
+ */
+export function extractBearerToken(req) {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer '))
+        return null;
+    return header.slice(7);
+}
+//# sourceMappingURL=auth.utils.js.map

package/dist/backend/backend/src/services/cloud/auth/auth.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.utils.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/auth.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyBH,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,uCAAuC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAExD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.d.ts

@@ -0,0 +1,47 @@
+/**
+ * JWT Auth Middleware
+ *
+ * Express middleware for authenticating requests using JWT tokens
+ * and gating features based on user plan (free vs pro).
+ *
+ * Extracts the Bearer token from the Authorization header, verifies
+ * it via AuthService, and attaches the decoded user info to the request.
+ *
+ * @module services/cloud/auth/jwt-auth.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+export type { AuthenticatedUser, AuthenticatedRequest } from './auth.utils.js';
+/**
+ * Express middleware that requires a valid JWT access token.
+ *
+ * Extracts the Bearer token, verifies it with AuthService, and
+ * attaches the user info to `req.user`. Responds with 401 if
+ * the token is missing, invalid, or expired.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireAuth, handler);
+ * // handler can access (req as AuthenticatedRequest).user
+ * ```
+ */
+export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireAuth, requirePlan('pro'), handler);
+ * ```
+ */
+export declare function requirePlan(requiredPlan: 'pro'): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=jwt-auth.middleware.d.ts.map

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/jwt-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAa/D,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAS/E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA2CjF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CA4B1G"}

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.js

@@ -0,0 +1,116 @@
+/**
+ * JWT Auth Middleware
+ *
+ * Express middleware for authenticating requests using JWT tokens
+ * and gating features based on user plan (free vs pro).
+ *
+ * Extracts the Bearer token from the Authorization header, verifies
+ * it via AuthService, and attaches the decoded user info to the request.
+ *
+ * @module services/cloud/auth/jwt-auth.middleware
+ */
+import { AuthService } from './auth.service.js';
+import { LoggerService } from '../../core/logger.service.js';
+const logger = LoggerService.getInstance().createComponentLogger('JwtAuthMiddleware');
+import { extractBearerToken } from './auth.utils.js';
+// ---------------------------------------------------------------------------
+// Middleware
+// ---------------------------------------------------------------------------
+/**
+ * Express middleware that requires a valid JWT access token.
+ *
+ * Extracts the Bearer token, verifies it with AuthService, and
+ * attaches the user info to `req.user`. Responds with 401 if
+ * the token is missing, invalid, or expired.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireAuth, handler);
+ * // handler can access (req as AuthenticatedRequest).user
+ * ```
+ */
+export function requireAuth(req, res, next) {
+    const token = extractBearerToken(req);
+    if (!token) {
+        res.status(401).json({
+            success: false,
+            error: 'Authentication required. Provide a Bearer token in the Authorization header.',
+        });
+        return;
+    }
+    let payload;
+    try {
+        const authService = AuthService.getInstance();
+        payload = authService.verifyToken(token);
+    }
+    catch (err) {
+        logger.warn('JWT verification failed', {
+            error: err instanceof Error ? err.message : String(err),
+            path: req.path,
+        });
+        res.status(401).json({
+            success: false,
+            error: err instanceof Error ? err.message : 'Invalid token',
+        });
+        return;
+    }
+    if (payload.type !== 'access') {
+        res.status(401).json({
+            success: false,
+            error: 'Invalid token type — expected access token',
+        });
+        return;
+    }
+    // Attach user info to request
+    req.user = {
+        userId: payload.sub,
+        email: payload.email,
+        plan: payload.plan,
+    };
+    next();
+}
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireAuth, requirePlan('pro'), handler);
+ * ```
+ */
+export function requirePlan(requiredPlan) {
+    return (req, res, next) => {
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({
+                success: false,
+                error: 'Authentication required',
+            });
+            return;
+        }
+        if (user.plan !== requiredPlan) {
+            logger.warn('Plan check failed', {
+                userId: user.userId,
+                currentPlan: user.plan,
+                requiredPlan,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: `This feature requires a "${requiredPlan}" plan. Current plan: "${user.plan}". Upgrade at https://crewly.dev/pricing.`,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=jwt-auth.middleware.js.map

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.middleware.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/jwt-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AAInF,MAAM,MAAM,GAAoB,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;AASvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8EAA8E;SACtF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4CAA4C;SACpD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,8BAA8B;IAC7B,GAA4B,CAAC,IAAI,GAAG;QACnC,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;IAEF,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,YAAmB;IAC7C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,IAAI,GAAI,GAA4B,CAAC,IAAI,CAAC;QAEhD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,YAAY,0BAA0B,IAAI,CAAC,IAAI,2CAA2C;aAC9H,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Supabase Auth Middleware
+ *
+ * Express middleware for authenticating requests using Supabase JWTs.
+ * Verifies tokens via the Supabase `auth.getUser()` API and resolves
+ * the user's plan from the `licenses` table for feature gating.
+ *
+ * This replaces the self-signed JWT middleware (`jwt-auth.middleware.ts`)
+ * so the frontend can authenticate directly with Supabase and send the
+ * Supabase access token as a Bearer token to protected endpoints.
+ *
+ * @module services/cloud/auth/supabase-auth.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Reset the shared Supabase client (for testing).
+ */
+export declare function resetSupabaseClient(): void;
+/**
+ * Clear the plan cache (for testing).
+ */
+export declare function clearPlanCache(): void;
+import type { AuthenticatedUser, AuthenticatedRequest } from './auth.utils.js';
+/** Supabase authenticated user (same shape as AuthenticatedUser). */
+export type SupabaseAuthenticatedUser = AuthenticatedUser;
+/** Supabase authenticated request (same shape as AuthenticatedRequest). */
+export type SupabaseAuthenticatedRequest = AuthenticatedRequest;
+/**
+ * Express middleware that requires a valid Supabase access token.
+ *
+ * Extracts the Bearer token, verifies it with Supabase `auth.getUser()`,
+ * resolves the user's plan from the `licenses` table, and attaches user
+ * info to `req.user`. Responds with 401 if the token is missing or invalid.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireSupabaseAuth, handler);
+ * // handler can access (req as SupabaseAuthenticatedRequest).user
+ * ```
+ */
+export declare function requireSupabaseAuth(req: Request, res: Response, next: NextFunction): Promise<void>;
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireSupabaseAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireSupabaseAuth, requireSupabasePlan('pro'), handler);
+ * ```
+ */
+export declare function requireSupabasePlan(requiredPlan: 'pro'): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=supabase-auth.middleware.d.ts.map

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-auth.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/supabase-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA4B/D;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAoBD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAOD,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AA0DhE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,KAAK,GAClB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CA4B3D"}