crewly 1.2.3 → 1.2.4

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.js

@@ -0,0 +1,203 @@
+/**
+ * Supabase Auth Middleware
+ *
+ * Express middleware for authenticating requests using Supabase JWTs.
+ * Verifies tokens via the Supabase `auth.getUser()` API and resolves
+ * the user's plan from the `licenses` table for feature gating.
+ *
+ * This replaces the self-signed JWT middleware (`jwt-auth.middleware.ts`)
+ * so the frontend can authenticate directly with Supabase and send the
+ * Supabase access token as a Bearer token to protected endpoints.
+ *
+ * @module services/cloud/auth/supabase-auth.middleware
+ */
+import { createClient } from '@supabase/supabase-js';
+import { LoggerService } from '../../core/logger.service.js';
+import { CLOUD_AUTH_CONSTANTS, AUTH_CONSTANTS } from '../../../constants.js';
+const logger = LoggerService.getInstance().createComponentLogger('SupabaseAuthMiddleware');
+// ---------------------------------------------------------------------------
+// Supabase client (shared, lightweight — only used for token verification)
+// ---------------------------------------------------------------------------
+let supabaseClient = null;
+/**
+ * Get or create the shared Supabase client for auth verification.
+ *
+ * @returns SupabaseClient instance
+ */
+function getSupabaseClient() {
+    if (!supabaseClient) {
+        supabaseClient = createClient(CLOUD_AUTH_CONSTANTS.SUPABASE.URL, CLOUD_AUTH_CONSTANTS.SUPABASE.ANON_KEY);
+    }
+    return supabaseClient;
+}
+/**
+ * Reset the shared Supabase client (for testing).
+ */
+export function resetSupabaseClient() {
+    supabaseClient = null;
+}
+/** How long plan lookups are cached (5 minutes). */
+const PLAN_CACHE_TTL_MS = 5 * 60 * 1000;
+/** In-memory cache: userId → plan info. */
+const planCache = new Map();
+/**
+ * Clear the plan cache (for testing).
+ */
+export function clearPlanCache() {
+    planCache.clear();
+}
+// ---------------------------------------------------------------------------
+// Types (re-exported for consumers — using shared AuthenticatedUser)
+// ---------------------------------------------------------------------------
+import { extractBearerToken } from './auth.utils.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the user's plan from the Supabase `licenses` table.
+ * Results are cached for PLAN_CACHE_TTL_MS to avoid repeated DB queries.
+ *
+ * @param userId - Supabase user ID
+ * @returns Resolved user plan ('free' if no active license)
+ */
+async function resolveUserPlan(userId) {
+    // Check cache first
+    const cached = planCache.get(userId);
+    if (cached && (Date.now() - cached.cachedAt) < PLAN_CACHE_TTL_MS) {
+        return cached.plan;
+    }
+    try {
+        const supabase = getSupabaseClient();
+        const { data, error } = await supabase
+            .from(CLOUD_AUTH_CONSTANTS.TABLES.LICENSES)
+            .select('plan, status, expires_at')
+            .eq('user_id', userId)
+            .eq('status', CLOUD_AUTH_CONSTANTS.LICENSE_STATUS.ACTIVE)
+            .order('created_at', { ascending: false })
+            .limit(1);
+        if (error || !data || data.length === 0) {
+            const plan = AUTH_CONSTANTS.PLANS.FREE;
+            planCache.set(userId, { plan, cachedAt: Date.now() });
+            return plan;
+        }
+        const license = data[0];
+        const isExpired = license.expires_at !== null && new Date(license.expires_at) < new Date();
+        const plan = isExpired
+            ? AUTH_CONSTANTS.PLANS.FREE
+            : (license.plan === 'pro' ? AUTH_CONSTANTS.PLANS.PRO : AUTH_CONSTANTS.PLANS.FREE);
+        planCache.set(userId, { plan, cachedAt: Date.now() });
+        return plan;
+    }
+    catch (err) {
+        logger.error('Failed to resolve user plan', {
+            userId,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return AUTH_CONSTANTS.PLANS.FREE;
+    }
+}
+// ---------------------------------------------------------------------------
+// Middleware
+// ---------------------------------------------------------------------------
+/**
+ * Express middleware that requires a valid Supabase access token.
+ *
+ * Extracts the Bearer token, verifies it with Supabase `auth.getUser()`,
+ * resolves the user's plan from the `licenses` table, and attaches user
+ * info to `req.user`. Responds with 401 if the token is missing or invalid.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireSupabaseAuth, handler);
+ * // handler can access (req as SupabaseAuthenticatedRequest).user
+ * ```
+ */
+export async function requireSupabaseAuth(req, res, next) {
+    const token = extractBearerToken(req);
+    if (!token) {
+        res.status(401).json({
+            success: false,
+            error: 'Authentication required. Provide a Bearer token in the Authorization header.',
+        });
+        return;
+    }
+    try {
+        const supabase = getSupabaseClient();
+        const { data: { user }, error } = await supabase.auth.getUser(token);
+        if (error || !user) {
+            logger.warn('Supabase token verification failed', {
+                error: error?.message ?? 'No user returned',
+                path: req.path,
+            });
+            res.status(401).json({
+                success: false,
+                error: error?.message ?? 'Invalid or expired token',
+            });
+            return;
+        }
+        // Resolve plan from licenses table (cached)
+        const plan = await resolveUserPlan(user.id);
+        // Attach user info to request
+        req.user = {
+            userId: user.id,
+            email: user.email ?? '',
+            plan,
+        };
+        next();
+    }
+    catch (err) {
+        logger.error('Supabase auth middleware error', {
+            error: err instanceof Error ? err.message : String(err),
+            path: req.path,
+        });
+        res.status(401).json({
+            success: false,
+            error: 'Authentication failed',
+        });
+    }
+}
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireSupabaseAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireSupabaseAuth, requireSupabasePlan('pro'), handler);
+ * ```
+ */
+export function requireSupabasePlan(requiredPlan) {
+    return (req, res, next) => {
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({
+                success: false,
+                error: 'Authentication required',
+            });
+            return;
+        }
+        if (user.plan !== requiredPlan) {
+            logger.warn('Plan check failed', {
+                userId: user.userId,
+                currentPlan: user.plan,
+                requiredPlan,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: `This feature requires a "${requiredPlan}" plan. Current plan: "${user.plan}". Upgrade at https://crewly.dev/pricing.`,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=supabase-auth.middleware.js.map

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-auth.middleware.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/supabase-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAiB,MAAM,uBAAuB,CAAC;AAE5F,MAAM,MAAM,GAAoB,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;AAE5G,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,YAAY,CAC3B,oBAAoB,CAAC,QAAQ,CAAC,GAAG,EACjC,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAcD,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,2CAA2C;AAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AASrD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,oBAAoB;IACpB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;aACnC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC1C,MAAM,CAAC,0BAA0B,CAAC;aAClC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,cAAc,CAAC,MAAM,CAAC;aACxD,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAa,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;YACjD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAgE,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAE3F,MAAM,IAAI,GAAa,SAAS;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;YAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEpF,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;YAC1C,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACnC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8EAA8E;SACtF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErE,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB;gBAC3C,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,0BAA0B;aACpD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5C,8BAA8B;QAC7B,GAAoC,CAAC,IAAI,GAAG;YAC3C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI;SACL,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC7C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAmB;IAEnB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,IAAI,GAAI,GAAoC,CAAC,IAAI,CAAC;QAExD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,YAAY,0BAA0B,IAAI,CAAC,IAAI,2CAA2C;aAC9H,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Cloud Auth Middleware
+ *
+ * Express middleware for gating premium features behind an active
+ * CrewlyAI Cloud connection and subscription tier check.
+ *
+ * @module services/cloud/cloud-auth.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Check whether the local Crewly instance is connected to CrewlyAI Cloud.
+ *
+ * @returns true if CloudClientService reports a connected status
+ */
+export declare function isCloudConnected(): boolean;
+/**
+ * Express middleware that requires an active cloud connection.
+ *
+ * Responds with 403 if the instance is not connected.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/premium-data', requireCloudConnection, handler);
+ * ```
+ */
+export declare function requireCloudConnection(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Factory that returns Express middleware requiring a minimum subscription tier.
+ *
+ * The middleware first checks cloud connectivity, then verifies that the
+ * current subscription tier meets or exceeds the required level.
+ *
+ * @param tier - Minimum required tier ('pro' or 'enterprise')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/enterprise-report', requireTier('enterprise'), handler);
+ * ```
+ */
+export declare function requireTier(tier: 'pro' | 'enterprise'): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=cloud-auth.middleware.d.ts.map

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-auth.middleware.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAe/D;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAU5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAgCjH"}

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.js

@@ -0,0 +1,95 @@
+/**
+ * Cloud Auth Middleware
+ *
+ * Express middleware for gating premium features behind an active
+ * CrewlyAI Cloud connection and subscription tier check.
+ *
+ * @module services/cloud/cloud-auth.middleware
+ */
+import { CloudClientService } from './cloud-client.service.js';
+import { LoggerService } from '../core/logger.service.js';
+import { CLOUD_CONSTANTS } from '../../constants.js';
+const logger = LoggerService.getInstance().createComponentLogger('CloudAuthMiddleware');
+/** Tier hierarchy for permission comparison (higher index = more permissive). */
+const TIER_HIERARCHY = [
+    CLOUD_CONSTANTS.TIERS.FREE,
+    CLOUD_CONSTANTS.TIERS.PRO,
+    CLOUD_CONSTANTS.TIERS.ENTERPRISE,
+];
+/**
+ * Check whether the local Crewly instance is connected to CrewlyAI Cloud.
+ *
+ * @returns true if CloudClientService reports a connected status
+ */
+export function isCloudConnected() {
+    return CloudClientService.getInstance().isConnected();
+}
+/**
+ * Express middleware that requires an active cloud connection.
+ *
+ * Responds with 403 if the instance is not connected.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/premium-data', requireCloudConnection, handler);
+ * ```
+ */
+export function requireCloudConnection(req, res, next) {
+    if (!isCloudConnected()) {
+        logger.warn('Cloud connection required but not connected', { path: req.path });
+        res.status(403).json({
+            success: false,
+            error: 'CrewlyAI Cloud connection required. Connect via POST /api/cloud/connect.',
+        });
+        return;
+    }
+    next();
+}
+/**
+ * Factory that returns Express middleware requiring a minimum subscription tier.
+ *
+ * The middleware first checks cloud connectivity, then verifies that the
+ * current subscription tier meets or exceeds the required level.
+ *
+ * @param tier - Minimum required tier ('pro' or 'enterprise')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/enterprise-report', requireTier('enterprise'), handler);
+ * ```
+ */
+export function requireTier(tier) {
+    return (req, res, next) => {
+        const client = CloudClientService.getInstance();
+        if (!client.isConnected()) {
+            logger.warn('Tier check failed: not connected', { requiredTier: tier, path: req.path });
+            res.status(403).json({
+                success: false,
+                error: 'CrewlyAI Cloud connection required. Connect via POST /api/cloud/connect.',
+            });
+            return;
+        }
+        const currentTier = client.getTier();
+        const currentIndex = TIER_HIERARCHY.indexOf(currentTier);
+        const requiredIndex = TIER_HIERARCHY.indexOf(tier);
+        if (currentIndex < requiredIndex) {
+            logger.warn('Tier check failed: insufficient tier', {
+                currentTier,
+                requiredTier: tier,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: `This feature requires a "${tier}" subscription. Current tier: "${currentTier}". Upgrade at https://crewly.dev/pricing.`,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=cloud-auth.middleware.js.map

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-auth.middleware.js","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,GAAoB,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;AAEzG,iFAAiF;AACjF,MAAM,cAAc,GAAgB;IAClC,eAAe,CAAC,KAAK,CAAC,IAAI;IAC1B,eAAe,CAAC,KAAK,CAAC,GAAG;IACzB,eAAe,CAAC,KAAK,CAAC,UAAU;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACpF,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0EAA0E;SAClF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAA0B;IACpD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QAEhD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0EAA0E;aAClF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBAClD,WAAW;gBACX,YAAY,EAAE,IAAI;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,IAAI,kCAAkC,WAAW,2CAA2C;aAChI,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/cloud/cloud-auth.service.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Cloud Auth Service (Supabase-backed)
+ *
+ * Provides user authentication and license verification using
+ * the Supabase JS SDK. Unlike the local AuthService (which stores
+ * data on disk), this service delegates all auth state to Supabase Auth
+ * and queries the `licenses` table for plan-based feature gating.
+ *
+ * @module services/cloud/cloud-auth.service
+ */
+/** Row shape returned from the Supabase `licenses` table. */
+export interface LicenseRow {
+    /** License primary key */
+    id: string;
+    /** Owner user ID (Supabase auth.users.id) */
+    user_id: string;
+    /** Plan tier (e.g. "free", "pro") */
+    plan: string;
+    /** Whether the license is currently active */
+    status: string;
+    /** ISO timestamp of license creation */
+    created_at: string;
+    /** ISO timestamp when the license expires (nullable) */
+    expires_at: string | null;
+}
+/** Aggregated license status returned to callers. */
+export interface CloudLicenseInfo {
+    /** Whether the user holds a valid license */
+    valid: boolean;
+    /** Plan tier ("free" if no active license found) */
+    plan: string;
+    /** License status string */
+    status: string;
+    /** Expiration date (null if no expiry) */
+    expiresAt: string | null;
+}
+/** Session info returned by getSession / refreshToken. */
+export interface CloudSessionInfo {
+    /** Whether a session is currently active */
+    active: boolean;
+    /** Supabase user ID */
+    userId: string | null;
+    /** User email */
+    email: string | null;
+    /** Access token */
+    accessToken: string | null;
+    /** Refresh token */
+    refreshToken: string | null;
+    /** Token expiry (epoch seconds) */
+    expiresAt: number | null;
+}
+/** Auth result returned by signUp / signIn. */
+export interface CloudAuthResult {
+    /** Whether the operation succeeded */
+    success: boolean;
+    /** Session info (null on failure) */
+    session: CloudSessionInfo | null;
+    /** Error message (null on success) */
+    error: string | null;
+}
+/**
+ * CloudAuthService singleton.
+ *
+ * Wraps the Supabase JS SDK to provide signUp, signIn, signOut,
+ * getSession, refreshToken, and checkLicense operations.
+ */
+export declare class CloudAuthService {
+    private static instance;
+    private readonly logger;
+    private readonly supabase;
+    private constructor();
+    /**
+     * Get the singleton instance.
+     *
+     * @returns CloudAuthService instance
+     */
+    static getInstance(): CloudAuthService;
+    /**
+     * Reset the singleton (for testing).
+     */
+    static resetInstance(): void;
+    /**
+     * Register a new user via Supabase Auth.
+     *
+     * @param email - User email address
+     * @param password - User password
+     * @returns Auth result with session info
+     */
+    signUp(email: string, password: string): Promise<CloudAuthResult>;
+    /**
+     * Sign in an existing user via Supabase Auth.
+     *
+     * @param email - User email address
+     * @param password - User password
+     * @returns Auth result with session info
+     */
+    signIn(email: string, password: string): Promise<CloudAuthResult>;
+    /**
+     * Sign out the current user session.
+     *
+     * @returns Object indicating success or failure
+     */
+    signOut(): Promise<{
+        success: boolean;
+        error: string | null;
+    }>;
+    /**
+     * Get the current session from Supabase Auth.
+     *
+     * @returns Session info (active: false if no session)
+     */
+    getSession(): Promise<CloudSessionInfo>;
+    /**
+     * Refresh the current session using a refresh token.
+     *
+     * @param refreshToken - Refresh token string
+     * @returns Auth result with new session info
+     */
+    refreshToken(refreshToken: string): Promise<CloudAuthResult>;
+    /**
+     * Check the license status for a given user by querying the
+     * Supabase `licenses` table.
+     *
+     * @param userId - Supabase auth user ID
+     * @returns License info with plan and status
+     */
+    checkLicense(userId: string): Promise<CloudLicenseInfo>;
+    /**
+     * Convert a Supabase Session (or null) to CloudSessionInfo.
+     *
+     * @param session - Supabase session object
+     * @returns Normalized session info
+     */
+    private toSessionInfo;
+}
+//# sourceMappingURL=cloud-auth.service.d.ts.map

package/dist/backend/backend/src/services/cloud/cloud-auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-auth.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,uBAAuB;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iBAAiB;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mCAAmC;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,qCAAqC;IACrC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,sCAAsC;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAE1C,OAAO;IAQP;;;;OAIG;IACH,MAAM,CAAC,WAAW,IAAI,gBAAgB;IAOtC;;OAEG;IACH,MAAM,CAAC,aAAa,IAAI,IAAI;IAQ5B;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAkBvE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAkBvE;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAiBpE;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAW7C;;;;;OAKG;IACG,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBlE;;;;;;OAMG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuC7D;;;;;OAKG;IACH,OAAO,CAAC,aAAa;CActB"}