crewly 1.2.3 → 1.2.6

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.d.ts

@@ -0,0 +1,47 @@
+/**
+ * JWT Auth Middleware
+ *
+ * Express middleware for authenticating requests using JWT tokens
+ * and gating features based on user plan (free vs pro).
+ *
+ * Extracts the Bearer token from the Authorization header, verifies
+ * it via AuthService, and attaches the decoded user info to the request.
+ *
+ * @module services/cloud/auth/jwt-auth.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+export type { AuthenticatedUser, AuthenticatedRequest } from './auth.utils.js';
+/**
+ * Express middleware that requires a valid JWT access token.
+ *
+ * Extracts the Bearer token, verifies it with AuthService, and
+ * attaches the user info to `req.user`. Responds with 401 if
+ * the token is missing, invalid, or expired.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireAuth, handler);
+ * // handler can access (req as AuthenticatedRequest).user
+ * ```
+ */
+export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireAuth, requirePlan('pro'), handler);
+ * ```
+ */
+export declare function requirePlan(requiredPlan: 'pro'): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=jwt-auth.middleware.d.ts.map

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/jwt-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAa/D,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAS/E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA2CjF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CA4B1G"}

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.js

@@ -0,0 +1,116 @@
+/**
+ * JWT Auth Middleware
+ *
+ * Express middleware for authenticating requests using JWT tokens
+ * and gating features based on user plan (free vs pro).
+ *
+ * Extracts the Bearer token from the Authorization header, verifies
+ * it via AuthService, and attaches the decoded user info to the request.
+ *
+ * @module services/cloud/auth/jwt-auth.middleware
+ */
+import { AuthService } from './auth.service.js';
+import { LoggerService } from '../../core/logger.service.js';
+const logger = LoggerService.getInstance().createComponentLogger('JwtAuthMiddleware');
+import { extractBearerToken } from './auth.utils.js';
+// ---------------------------------------------------------------------------
+// Middleware
+// ---------------------------------------------------------------------------
+/**
+ * Express middleware that requires a valid JWT access token.
+ *
+ * Extracts the Bearer token, verifies it with AuthService, and
+ * attaches the user info to `req.user`. Responds with 401 if
+ * the token is missing, invalid, or expired.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireAuth, handler);
+ * // handler can access (req as AuthenticatedRequest).user
+ * ```
+ */
+export function requireAuth(req, res, next) {
+    const token = extractBearerToken(req);
+    if (!token) {
+        res.status(401).json({
+            success: false,
+            error: 'Authentication required. Provide a Bearer token in the Authorization header.',
+        });
+        return;
+    }
+    let payload;
+    try {
+        const authService = AuthService.getInstance();
+        payload = authService.verifyToken(token);
+    }
+    catch (err) {
+        logger.warn('JWT verification failed', {
+            error: err instanceof Error ? err.message : String(err),
+            path: req.path,
+        });
+        res.status(401).json({
+            success: false,
+            error: err instanceof Error ? err.message : 'Invalid token',
+        });
+        return;
+    }
+    if (payload.type !== 'access') {
+        res.status(401).json({
+            success: false,
+            error: 'Invalid token type — expected access token',
+        });
+        return;
+    }
+    // Attach user info to request
+    req.user = {
+        userId: payload.sub,
+        email: payload.email,
+        plan: payload.plan,
+    };
+    next();
+}
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireAuth, requirePlan('pro'), handler);
+ * ```
+ */
+export function requirePlan(requiredPlan) {
+    return (req, res, next) => {
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({
+                success: false,
+                error: 'Authentication required',
+            });
+            return;
+        }
+        if (user.plan !== requiredPlan) {
+            logger.warn('Plan check failed', {
+                userId: user.userId,
+                currentPlan: user.plan,
+                requiredPlan,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: `This feature requires a "${requiredPlan}" plan. Current plan: "${user.plan}". Upgrade at https://crewly.dev/pricing.`,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=jwt-auth.middleware.js.map

package/dist/backend/backend/src/services/cloud/auth/jwt-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.middleware.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/jwt-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AAInF,MAAM,MAAM,GAAoB,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;AASvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8EAA8E;SACtF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4CAA4C;SACpD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,8BAA8B;IAC7B,GAA4B,CAAC,IAAI,GAAG;QACnC,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;IAEF,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,YAAmB;IAC7C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,IAAI,GAAI,GAA4B,CAAC,IAAI,CAAC;QAEhD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,YAAY,0BAA0B,IAAI,CAAC,IAAI,2CAA2C;aAC9H,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Supabase Auth Middleware
+ *
+ * Express middleware for authenticating requests using Supabase JWTs.
+ * Verifies tokens via the Supabase `auth.getUser()` API and resolves
+ * the user's plan from the `licenses` table for feature gating.
+ *
+ * This replaces the self-signed JWT middleware (`jwt-auth.middleware.ts`)
+ * so the frontend can authenticate directly with Supabase and send the
+ * Supabase access token as a Bearer token to protected endpoints.
+ *
+ * @module services/cloud/auth/supabase-auth.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Reset the shared Supabase client (for testing).
+ */
+export declare function resetSupabaseClient(): void;
+/**
+ * Clear the plan cache (for testing).
+ */
+export declare function clearPlanCache(): void;
+import type { AuthenticatedUser, AuthenticatedRequest } from './auth.utils.js';
+/** Supabase authenticated user (same shape as AuthenticatedUser). */
+export type SupabaseAuthenticatedUser = AuthenticatedUser;
+/** Supabase authenticated request (same shape as AuthenticatedRequest). */
+export type SupabaseAuthenticatedRequest = AuthenticatedRequest;
+/**
+ * Express middleware that requires a valid Supabase access token.
+ *
+ * Extracts the Bearer token, verifies it with Supabase `auth.getUser()`,
+ * resolves the user's plan from the `licenses` table, and attaches user
+ * info to `req.user`. Responds with 401 if the token is missing or invalid.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireSupabaseAuth, handler);
+ * // handler can access (req as SupabaseAuthenticatedRequest).user
+ * ```
+ */
+export declare function requireSupabaseAuth(req: Request, res: Response, next: NextFunction): Promise<void>;
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireSupabaseAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireSupabaseAuth, requireSupabasePlan('pro'), handler);
+ * ```
+ */
+export declare function requireSupabasePlan(requiredPlan: 'pro'): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=supabase-auth.middleware.d.ts.map

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-auth.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/supabase-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA4B/D;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAoBD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAOD,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AA0DhE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,KAAK,GAClB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CA4B3D"}

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.js

@@ -0,0 +1,203 @@
+/**
+ * Supabase Auth Middleware
+ *
+ * Express middleware for authenticating requests using Supabase JWTs.
+ * Verifies tokens via the Supabase `auth.getUser()` API and resolves
+ * the user's plan from the `licenses` table for feature gating.
+ *
+ * This replaces the self-signed JWT middleware (`jwt-auth.middleware.ts`)
+ * so the frontend can authenticate directly with Supabase and send the
+ * Supabase access token as a Bearer token to protected endpoints.
+ *
+ * @module services/cloud/auth/supabase-auth.middleware
+ */
+import { createClient } from '@supabase/supabase-js';
+import { LoggerService } from '../../core/logger.service.js';
+import { CLOUD_AUTH_CONSTANTS, AUTH_CONSTANTS } from '../../../constants.js';
+const logger = LoggerService.getInstance().createComponentLogger('SupabaseAuthMiddleware');
+// ---------------------------------------------------------------------------
+// Supabase client (shared, lightweight — only used for token verification)
+// ---------------------------------------------------------------------------
+let supabaseClient = null;
+/**
+ * Get or create the shared Supabase client for auth verification.
+ *
+ * @returns SupabaseClient instance
+ */
+function getSupabaseClient() {
+    if (!supabaseClient) {
+        supabaseClient = createClient(CLOUD_AUTH_CONSTANTS.SUPABASE.URL, CLOUD_AUTH_CONSTANTS.SUPABASE.ANON_KEY);
+    }
+    return supabaseClient;
+}
+/**
+ * Reset the shared Supabase client (for testing).
+ */
+export function resetSupabaseClient() {
+    supabaseClient = null;
+}
+/** How long plan lookups are cached (5 minutes). */
+const PLAN_CACHE_TTL_MS = 5 * 60 * 1000;
+/** In-memory cache: userId → plan info. */
+const planCache = new Map();
+/**
+ * Clear the plan cache (for testing).
+ */
+export function clearPlanCache() {
+    planCache.clear();
+}
+// ---------------------------------------------------------------------------
+// Types (re-exported for consumers — using shared AuthenticatedUser)
+// ---------------------------------------------------------------------------
+import { extractBearerToken } from './auth.utils.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the user's plan from the Supabase `licenses` table.
+ * Results are cached for PLAN_CACHE_TTL_MS to avoid repeated DB queries.
+ *
+ * @param userId - Supabase user ID
+ * @returns Resolved user plan ('free' if no active license)
+ */
+async function resolveUserPlan(userId) {
+    // Check cache first
+    const cached = planCache.get(userId);
+    if (cached && (Date.now() - cached.cachedAt) < PLAN_CACHE_TTL_MS) {
+        return cached.plan;
+    }
+    try {
+        const supabase = getSupabaseClient();
+        const { data, error } = await supabase
+            .from(CLOUD_AUTH_CONSTANTS.TABLES.LICENSES)
+            .select('plan, status, expires_at')
+            .eq('user_id', userId)
+            .eq('status', CLOUD_AUTH_CONSTANTS.LICENSE_STATUS.ACTIVE)
+            .order('created_at', { ascending: false })
+            .limit(1);
+        if (error || !data || data.length === 0) {
+            const plan = AUTH_CONSTANTS.PLANS.FREE;
+            planCache.set(userId, { plan, cachedAt: Date.now() });
+            return plan;
+        }
+        const license = data[0];
+        const isExpired = license.expires_at !== null && new Date(license.expires_at) < new Date();
+        const plan = isExpired
+            ? AUTH_CONSTANTS.PLANS.FREE
+            : (license.plan === 'pro' ? AUTH_CONSTANTS.PLANS.PRO : AUTH_CONSTANTS.PLANS.FREE);
+        planCache.set(userId, { plan, cachedAt: Date.now() });
+        return plan;
+    }
+    catch (err) {
+        logger.error('Failed to resolve user plan', {
+            userId,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return AUTH_CONSTANTS.PLANS.FREE;
+    }
+}
+// ---------------------------------------------------------------------------
+// Middleware
+// ---------------------------------------------------------------------------
+/**
+ * Express middleware that requires a valid Supabase access token.
+ *
+ * Extracts the Bearer token, verifies it with Supabase `auth.getUser()`,
+ * resolves the user's plan from the `licenses` table, and attaches user
+ * info to `req.user`. Responds with 401 if the token is missing or invalid.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/profile', requireSupabaseAuth, handler);
+ * // handler can access (req as SupabaseAuthenticatedRequest).user
+ * ```
+ */
+export async function requireSupabaseAuth(req, res, next) {
+    const token = extractBearerToken(req);
+    if (!token) {
+        res.status(401).json({
+            success: false,
+            error: 'Authentication required. Provide a Bearer token in the Authorization header.',
+        });
+        return;
+    }
+    try {
+        const supabase = getSupabaseClient();
+        const { data: { user }, error } = await supabase.auth.getUser(token);
+        if (error || !user) {
+            logger.warn('Supabase token verification failed', {
+                error: error?.message ?? 'No user returned',
+                path: req.path,
+            });
+            res.status(401).json({
+                success: false,
+                error: error?.message ?? 'Invalid or expired token',
+            });
+            return;
+        }
+        // Resolve plan from licenses table (cached)
+        const plan = await resolveUserPlan(user.id);
+        // Attach user info to request
+        req.user = {
+            userId: user.id,
+            email: user.email ?? '',
+            plan,
+        };
+        next();
+    }
+    catch (err) {
+        logger.error('Supabase auth middleware error', {
+            error: err instanceof Error ? err.message : String(err),
+            path: req.path,
+        });
+        res.status(401).json({
+            success: false,
+            error: 'Authentication failed',
+        });
+    }
+}
+/**
+ * Factory that returns middleware requiring a specific plan level.
+ *
+ * Must be used after requireSupabaseAuth (which sets req.user).
+ * Responds with 403 if the user's plan does not meet the requirement.
+ *
+ * @param requiredPlan - Minimum plan required ('pro')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/premium', requireSupabaseAuth, requireSupabasePlan('pro'), handler);
+ * ```
+ */
+export function requireSupabasePlan(requiredPlan) {
+    return (req, res, next) => {
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({
+                success: false,
+                error: 'Authentication required',
+            });
+            return;
+        }
+        if (user.plan !== requiredPlan) {
+            logger.warn('Plan check failed', {
+                userId: user.userId,
+                currentPlan: user.plan,
+                requiredPlan,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: `This feature requires a "${requiredPlan}" plan. Current plan: "${user.plan}". Upgrade at https://crewly.dev/pricing.`,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=supabase-auth.middleware.js.map

package/dist/backend/backend/src/services/cloud/auth/supabase-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-auth.middleware.js","sourceRoot":"","sources":["../../../../../../../backend/src/services/cloud/auth/supabase-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAwB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAiB,MAAM,uBAAuB,CAAC;AAE5F,MAAM,MAAM,GAAoB,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;AAE5G,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,YAAY,CAC3B,oBAAoB,CAAC,QAAQ,CAAC,GAAG,EACjC,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAcD,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,2CAA2C;AAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AASrD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,oBAAoB;IACpB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;aACnC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC1C,MAAM,CAAC,0BAA0B,CAAC;aAClC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,cAAc,CAAC,MAAM,CAAC;aACxD,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAa,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;YACjD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAgE,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAE3F,MAAM,IAAI,GAAa,SAAS;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;YAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEpF,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;YAC1C,MAAM;YACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACnC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8EAA8E;SACtF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErE,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB;gBAC3C,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,0BAA0B;aACpD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5C,8BAA8B;QAC7B,GAAoC,CAAC,IAAI,GAAG;YAC3C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI;SACL,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC7C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAmB;IAEnB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,IAAI,GAAI,GAAoC,CAAC,IAAI,CAAC;QAExD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,YAAY,0BAA0B,IAAI,CAAC,IAAI,2CAA2C;aAC9H,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Cloud Auth Middleware
+ *
+ * Express middleware for gating premium features behind an active
+ * CrewlyAI Cloud connection and subscription tier check.
+ *
+ * @module services/cloud/cloud-auth.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Check whether the local Crewly instance is connected to CrewlyAI Cloud.
+ *
+ * @returns true if CloudClientService reports a connected status
+ */
+export declare function isCloudConnected(): boolean;
+/**
+ * Express middleware that requires an active cloud connection.
+ *
+ * Responds with 403 if the instance is not connected.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/premium-data', requireCloudConnection, handler);
+ * ```
+ */
+export declare function requireCloudConnection(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Factory that returns Express middleware requiring a minimum subscription tier.
+ *
+ * The middleware first checks cloud connectivity, then verifies that the
+ * current subscription tier meets or exceeds the required level.
+ *
+ * @param tier - Minimum required tier ('pro' or 'enterprise')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/enterprise-report', requireTier('enterprise'), handler);
+ * ```
+ */
+export declare function requireTier(tier: 'pro' | 'enterprise'): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=cloud-auth.middleware.d.ts.map

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-auth.middleware.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAe/D;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAU5F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAgCjH"}

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.js

@@ -0,0 +1,95 @@
+/**
+ * Cloud Auth Middleware
+ *
+ * Express middleware for gating premium features behind an active
+ * CrewlyAI Cloud connection and subscription tier check.
+ *
+ * @module services/cloud/cloud-auth.middleware
+ */
+import { CloudClientService } from './cloud-client.service.js';
+import { LoggerService } from '../core/logger.service.js';
+import { CLOUD_CONSTANTS } from '../../constants.js';
+const logger = LoggerService.getInstance().createComponentLogger('CloudAuthMiddleware');
+/** Tier hierarchy for permission comparison (higher index = more permissive). */
+const TIER_HIERARCHY = [
+    CLOUD_CONSTANTS.TIERS.FREE,
+    CLOUD_CONSTANTS.TIERS.PRO,
+    CLOUD_CONSTANTS.TIERS.ENTERPRISE,
+];
+/**
+ * Check whether the local Crewly instance is connected to CrewlyAI Cloud.
+ *
+ * @returns true if CloudClientService reports a connected status
+ */
+export function isCloudConnected() {
+    return CloudClientService.getInstance().isConnected();
+}
+/**
+ * Express middleware that requires an active cloud connection.
+ *
+ * Responds with 403 if the instance is not connected.
+ *
+ * @param req - Express request
+ * @param res - Express response
+ * @param next - Next middleware
+ *
+ * @example
+ * ```ts
+ * router.get('/premium-data', requireCloudConnection, handler);
+ * ```
+ */
+export function requireCloudConnection(req, res, next) {
+    if (!isCloudConnected()) {
+        logger.warn('Cloud connection required but not connected', { path: req.path });
+        res.status(403).json({
+            success: false,
+            error: 'CrewlyAI Cloud connection required. Connect via POST /api/cloud/connect.',
+        });
+        return;
+    }
+    next();
+}
+/**
+ * Factory that returns Express middleware requiring a minimum subscription tier.
+ *
+ * The middleware first checks cloud connectivity, then verifies that the
+ * current subscription tier meets or exceeds the required level.
+ *
+ * @param tier - Minimum required tier ('pro' or 'enterprise')
+ * @returns Express middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/enterprise-report', requireTier('enterprise'), handler);
+ * ```
+ */
+export function requireTier(tier) {
+    return (req, res, next) => {
+        const client = CloudClientService.getInstance();
+        if (!client.isConnected()) {
+            logger.warn('Tier check failed: not connected', { requiredTier: tier, path: req.path });
+            res.status(403).json({
+                success: false,
+                error: 'CrewlyAI Cloud connection required. Connect via POST /api/cloud/connect.',
+            });
+            return;
+        }
+        const currentTier = client.getTier();
+        const currentIndex = TIER_HIERARCHY.indexOf(currentTier);
+        const requiredIndex = TIER_HIERARCHY.indexOf(tier);
+        if (currentIndex < requiredIndex) {
+            logger.warn('Tier check failed: insufficient tier', {
+                currentTier,
+                requiredTier: tier,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: `This feature requires a "${tier}" subscription. Current tier: "${currentTier}". Upgrade at https://crewly.dev/pricing.`,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=cloud-auth.middleware.js.map

package/dist/backend/backend/src/services/cloud/cloud-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-auth.middleware.js","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,GAAoB,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;AAEzG,iFAAiF;AACjF,MAAM,cAAc,GAAgB;IAClC,eAAe,CAAC,KAAK,CAAC,IAAI;IAC1B,eAAe,CAAC,KAAK,CAAC,GAAG;IACzB,eAAe,CAAC,KAAK,CAAC,UAAU;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACpF,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0EAA0E;SAClF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,IAA0B;IACpD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QAEhD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0EAA0E;aAClF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBAClD,WAAW;gBACX,YAAY,EAAE,IAAI;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,IAAI,kCAAkC,WAAW,2CAA2C;aAChI,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}