elevenlabs-webhook-nodejs 1.0.0

package/src/modules/auth/auth.model.ts

@@ -0,0 +1,42 @@
+import mongoose, { Document, Schema } from 'mongoose';
+
+export type UserRole = 'superadmin' | 'admin' | 'manager' | 'viewer';
+
+export interface IUser extends Document {
+  tenant_id: mongoose.Types.ObjectId;
+  email: string;
+  password_hash: string;
+  role: UserRole;
+  name: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+const userSchema = new Schema<IUser>({
+  tenant_id: {
+    type: Schema.Types.ObjectId,
+    ref: 'Tenant',
+    required: true,
+    index: true
+  },
+  email: {
+    type: String,
+    required: true,
+    unique: true,
+    lowercase: true,
+    trim: true,
+    index: true
+  },
+  password_hash: { type: String, required: true },
+  role: {
+    type: String,
+    enum: ['superadmin', 'admin', 'manager', 'viewer'],
+    required: true,
+    default: 'viewer'
+  },
+  name: { type: String, required: true }
+}, {
+  timestamps: true
+});
+
+export default mongoose.model<IUser>('User', userSchema);

package/src/modules/auth/auth.routes.ts

@@ -0,0 +1,199 @@
+import { FastifyInstance } from 'fastify';
+import * as authService from './auth.service';
+import User from './auth.model';
+import Tenant from '../tenants/tenant.model';
+
+export default async function authRoutes(fastify: FastifyInstance): Promise<void> {
+  // POST /auth/register — Create first user + tenant
+  fastify.post('/register', async (request, reply) => {
+    const { email, password, name, tenant_name } = request.body as {
+      email: string;
+      password: string;
+      name: string;
+      tenant_name: string;
+    };
+
+    if (!email || !password || !name || !tenant_name) {
+      return reply.status(400).send({ error: 'email, password, name, and tenant_name are required' });
+    }
+
+    if (password.length < 8) {
+      return reply.status(400).send({ error: 'Password must be at least 8 characters' });
+    }
+
+    try {
+      const result = await authService.register(email, password, name, tenant_name);
+
+      return reply.status(201).send({
+        user: {
+          id: result.user._id,
+          email: result.user.email,
+          name: result.user.name,
+          role: result.user.role
+        },
+        tenant: {
+          id: result.tenant._id,
+          name: result.tenant.name,
+          plan: result.tenant.plan,
+          enabled_features: result.tenant.enabled_features
+        },
+        access_token: result.accessToken,
+        refresh_token: result.refreshToken
+      });
+    } catch (error) {
+      const err = error as { message: string; statusCode?: number };
+      return reply.status(err.statusCode || 500).send({ error: err.message });
+    }
+  });
+
+  // POST /auth/login — Returns JWT access + refresh tokens
+  fastify.post('/login', async (request, reply) => {
+    const { email, password } = request.body as {
+      email: string;
+      password: string;
+    };
+
+    if (!email || !password) {
+      return reply.status(400).send({ error: 'email and password are required' });
+    }
+
+    try {
+      const result = await authService.login(email, password);
+
+      return {
+        user: {
+          id: result.user._id,
+          email: result.user.email,
+          name: result.user.name,
+          role: result.user.role
+        },
+        tenant: {
+          id: result.tenant._id,
+          name: result.tenant.name,
+          plan: result.tenant.plan,
+          enabled_features: result.tenant.enabled_features
+        },
+        access_token: result.accessToken,
+        refresh_token: result.refreshToken
+      };
+    } catch (error) {
+      const err = error as { message: string; statusCode?: number };
+      return reply.status(err.statusCode || 500).send({ error: err.message });
+    }
+  });
+
+  // POST /auth/refresh — Refresh access token
+  fastify.post('/refresh', async (request, reply) => {
+    const { refresh_token } = request.body as { refresh_token: string };
+
+    if (!refresh_token) {
+      return reply.status(400).send({ error: 'refresh_token is required' });
+    }
+
+    try {
+      const result = await authService.refresh(refresh_token);
+
+      return {
+        access_token: result.accessToken,
+        refresh_token: result.refreshToken
+      };
+    } catch (error) {
+      const err = error as { message: string; statusCode?: number };
+      return reply.status(err.statusCode || 500).send({ error: err.message });
+    }
+  });
+
+  // POST /auth/logout — Invalidate refresh token
+  fastify.post('/logout', {
+    preHandler: [fastify.authenticate]
+  }, async (request, reply) => {
+    const { refresh_token } = request.body as { refresh_token?: string };
+
+    if (refresh_token) {
+      await authService.revokeRefreshToken(refresh_token);
+    } else {
+      // Revoke all tokens for this user
+      await authService.revokeAllUserTokens(request.user.id);
+    }
+
+    return { success: true };
+  });
+
+  // POST /auth/change-password — Change current user's password
+  fastify.post('/change-password', {
+    preHandler: [fastify.authenticate]
+  }, async (request, reply) => {
+    const { current_password, new_password } = request.body as {
+      current_password: string;
+      new_password: string;
+    };
+
+    if (!current_password || !new_password) {
+      return reply.status(400).send({ error: 'current_password and new_password are required' });
+    }
+
+    if (new_password.length < 8) {
+      return reply.status(400).send({ error: 'Yeni sifre en az 8 karakter olmali' });
+    }
+
+    const user = await User.findById(request.user.id);
+    if (!user) {
+      return reply.status(404).send({ error: 'User not found' });
+    }
+
+    const valid = await authService.comparePassword(current_password, user.password_hash);
+    if (!valid) {
+      return reply.status(401).send({ error: 'Mevcut sifre yanlis' });
+    }
+
+    user.password_hash = await authService.hashPassword(new_password);
+    await user.save();
+
+    // Issue new tokens for the current session
+    const tenant = await Tenant.findById(user.tenant_id);
+    if (!tenant) {
+      return reply.status(500).send({ error: 'Tenant not found' });
+    }
+
+    // Revoke all old refresh tokens (logs out other sessions)
+    await authService.revokeAllUserTokens(user._id.toString());
+
+    // Create fresh tokens for this session
+    const accessToken = authService.signAccessToken(user, tenant);
+    const refreshToken = authService.signRefreshToken(user);
+    await authService.storeRefreshToken(user._id.toString(), refreshToken);
+
+    return { success: true, access_token: accessToken, refresh_token: refreshToken };
+  });
+
+  // GET /auth/me — Current user profile + tenant features
+  fastify.get('/me', {
+    preHandler: [fastify.authenticate]
+  }, async (request, reply) => {
+    const user = await User.findById(request.user.id).select('-password_hash');
+    if (!user) {
+      return reply.status(404).send({ error: 'User not found' });
+    }
+
+    const tenant = await Tenant.findById(user.tenant_id);
+    if (!tenant) {
+      return reply.status(404).send({ error: 'Tenant not found' });
+    }
+
+    return {
+      user: {
+        id: user._id,
+        email: user.email,
+        name: user.name,
+        role: user.role
+      },
+      tenant: {
+        id: tenant._id,
+        name: tenant.name,
+        plan: tenant.plan,
+        enabled_features: tenant.enabled_features,
+        settings: tenant.settings
+      }
+    };
+  });
+}

package/src/modules/auth/auth.service.ts

@@ -0,0 +1,210 @@
+import bcrypt from 'bcrypt';
+import jwt, { SignOptions } from 'jsonwebtoken';
+import config from '../../config';
+import User, { IUser } from './auth.model';
+import Tenant, { ITenant } from '../tenants/tenant.model';
+import Plan from '../plans/plan.model';
+import RefreshToken from './refresh-token.model';
+import { JWTAccessPayload, JWTRefreshPayload } from '../../types';
+
+const SALT_ROUNDS = 12;
+
+export async function hashPassword(password: string): Promise<string> {
+  return bcrypt.hash(password, SALT_ROUNDS);
+}
+
+export async function comparePassword(password: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(password, hash);
+}
+
+export function signAccessToken(user: IUser, tenant: ITenant): string {
+  const payload: JWTAccessPayload = {
+    id: user._id.toString(),
+    tenant_id: tenant._id.toString(),
+    role: user.role,
+    enabled_features: tenant.enabled_features
+  };
+
+  return jwt.sign(payload, config.jwt.accessSecret, {
+    expiresIn: config.jwt.accessExpiry
+  } as SignOptions);
+}
+
+export function signRefreshToken(user: IUser): string {
+  const payload: JWTRefreshPayload = {
+    id: user._id.toString(),
+    type: 'refresh'
+  };
+
+  return jwt.sign(payload, config.jwt.refreshSecret, {
+    expiresIn: config.jwt.refreshExpiry
+  } as SignOptions);
+}
+
+export function verifyRefreshToken(token: string): JWTRefreshPayload {
+  return jwt.verify(token, config.jwt.refreshSecret) as JWTRefreshPayload;
+}
+
+function parseExpiryToMs(expiry: string): number {
+  const match = expiry.match(/^(\d+)([smhd])$/);
+  if (!match) return 7 * 24 * 60 * 60 * 1000; // default 7d
+  const value = parseInt(match[1]);
+  const unit = match[2];
+  const multipliers: Record<string, number> = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000
+  };
+  return value * (multipliers[unit] || 1000);
+}
+
+export async function storeRefreshToken(userId: string, token: string): Promise<void> {
+  const expiresAt = new Date(Date.now() + parseExpiryToMs(config.jwt.refreshExpiry));
+
+  await RefreshToken.create({
+    user_id: userId,
+    token,
+    expires_at: expiresAt
+  });
+}
+
+export async function revokeRefreshToken(token: string): Promise<boolean> {
+  const result = await RefreshToken.deleteOne({ token });
+  return result.deletedCount > 0;
+}
+
+export async function revokeAllUserTokens(userId: string): Promise<void> {
+  await RefreshToken.deleteMany({ user_id: userId });
+}
+
+export async function isRefreshTokenValid(token: string): Promise<boolean> {
+  const stored = await RefreshToken.findOne({ token });
+  if (!stored) return false;
+  if (stored.expires_at < new Date()) return false;
+  return true;
+}
+
+export async function register(
+  email: string,
+  password: string,
+  name: string,
+  tenantName: string
+): Promise<{ user: IUser; tenant: ITenant; accessToken: string; refreshToken: string }> {
+  const existing = await User.findOne({ email });
+  if (existing) {
+    throw Object.assign(new Error('Email already registered'), { statusCode: 409 });
+  }
+
+  // Ensure free plan exists in DB
+  await Plan.findOneAndUpdate(
+    { slug: 'free' },
+    {
+      $setOnInsert: {
+        name: 'Ucretsiz',
+        slug: 'free',
+        price: 0,
+        included_minutes: 30,
+        overage_rate: 0,
+        language_support: 'single',
+        is_active: true,
+        sort_order: 0,
+      }
+    },
+    { upsert: true }
+  );
+
+  const tenant = await Tenant.create({
+    name: tenantName,
+    plan: 'free',
+    enabled_features: ['inbound_agent', 'whatsapp_notifications', 'whatsapp_agent'],
+    settings: {
+      kvkk_consent: false,
+      notification_recipients: [],
+      default_language: 'tr'
+    }
+  });
+
+  const passwordHash = await hashPassword(password);
+
+  const user = await User.create({
+    tenant_id: tenant._id,
+    email,
+    password_hash: passwordHash,
+    role: 'admin',
+    name
+  });
+
+  const accessToken = signAccessToken(user, tenant);
+  const refreshToken = signRefreshToken(user);
+  await storeRefreshToken(user._id.toString(), refreshToken);
+
+  return { user, tenant, accessToken, refreshToken };
+}
+
+export async function login(
+  email: string,
+  password: string
+): Promise<{ user: IUser; tenant: ITenant; accessToken: string; refreshToken: string }> {
+  const user = await User.findOne({ email });
+  if (!user) {
+    throw Object.assign(new Error('Invalid email or password'), { statusCode: 401 });
+  }
+
+  const valid = await comparePassword(password, user.password_hash);
+  if (!valid) {
+    throw Object.assign(new Error('Invalid email or password'), { statusCode: 401 });
+  }
+
+  const tenant = await Tenant.findById(user.tenant_id);
+  if (!tenant) {
+    throw Object.assign(new Error('Tenant not found'), { statusCode: 500 });
+  }
+
+  const accessToken = signAccessToken(user, tenant);
+  const refreshToken = signRefreshToken(user);
+  await storeRefreshToken(user._id.toString(), refreshToken);
+
+  return { user, tenant, accessToken, refreshToken };
+}
+
+export async function refresh(
+  token: string
+): Promise<{ accessToken: string; refreshToken: string }> {
+  const isValid = await isRefreshTokenValid(token);
+  if (!isValid) {
+    throw Object.assign(new Error('Invalid or expired refresh token'), { statusCode: 401 });
+  }
+
+  let decoded: JWTRefreshPayload;
+  try {
+    decoded = verifyRefreshToken(token);
+  } catch {
+    await revokeRefreshToken(token);
+    throw Object.assign(new Error('Invalid refresh token'), { statusCode: 401 });
+  }
+
+  if (decoded.type !== 'refresh') {
+    throw Object.assign(new Error('Invalid token type'), { statusCode: 401 });
+  }
+
+  const user = await User.findById(decoded.id);
+  if (!user) {
+    await revokeRefreshToken(token);
+    throw Object.assign(new Error('User not found'), { statusCode: 401 });
+  }
+
+  const tenant = await Tenant.findById(user.tenant_id);
+  if (!tenant) {
+    throw Object.assign(new Error('Tenant not found'), { statusCode: 500 });
+  }
+
+  // Rotate: revoke old, issue new
+  await revokeRefreshToken(token);
+
+  const newAccessToken = signAccessToken(user, tenant);
+  const newRefreshToken = signRefreshToken(user);
+  await storeRefreshToken(user._id.toString(), newRefreshToken);
+
+  return { accessToken: newAccessToken, refreshToken: newRefreshToken };
+}

package/src/modules/auth/refresh-token.model.ts

@@ -0,0 +1,26 @@
+import mongoose, { Document, Schema } from 'mongoose';
+
+export interface IRefreshToken extends Document {
+  user_id: mongoose.Types.ObjectId;
+  token: string;
+  expires_at: Date;
+  createdAt: Date;
+}
+
+const refreshTokenSchema = new Schema<IRefreshToken>({
+  user_id: {
+    type: Schema.Types.ObjectId,
+    ref: 'User',
+    required: true,
+    index: true
+  },
+  token: { type: String, required: true, unique: true },
+  expires_at: { type: Date, required: true }
+}, {
+  timestamps: { createdAt: true, updatedAt: false }
+});
+
+// TTL index — MongoDB auto-deletes expired tokens
+refreshTokenSchema.index({ expires_at: 1 }, { expireAfterSeconds: 0 });
+
+export default mongoose.model<IRefreshToken>('RefreshToken', refreshTokenSchema);

package/src/modules/billing/billing-alert.model.ts

@@ -0,0 +1,28 @@
+import mongoose, { Document, Schema } from 'mongoose';
+
+export type AlertType = 'usage_75' | 'usage_90' | 'usage_100' | 'period_expiring';
+export type AlertService = 'inbound_minutes' | 'inbound_calls' | 'wa_chats' | 'billing_period';
+
+export interface IBillingAlert extends Document {
+  tenant_id: mongoose.Types.ObjectId;
+  alert_type: AlertType;
+  service: AlertService;
+  payment_id: mongoose.Types.ObjectId;
+  createdAt: Date;
+}
+
+const billingAlertSchema = new Schema<IBillingAlert>({
+  tenant_id: { type: Schema.Types.ObjectId, ref: 'Tenant', required: true },
+  alert_type: { type: String, enum: ['usage_75', 'usage_90', 'usage_100', 'period_expiring'], required: true },
+  service: { type: String, enum: ['inbound_minutes', 'inbound_calls', 'wa_chats', 'billing_period'], required: true },
+  payment_id: { type: Schema.Types.ObjectId, ref: 'Payment', required: true },
+}, {
+  timestamps: { createdAt: true, updatedAt: false },
+});
+
+billingAlertSchema.index(
+  { tenant_id: 1, alert_type: 1, service: 1, payment_id: 1 },
+  { unique: true },
+);
+
+export default mongoose.model<IBillingAlert>('BillingAlert', billingAlertSchema);

package/src/modules/billing/billing-period-snapshot.model.ts

@@ -0,0 +1,68 @@
+import mongoose, { Document, Schema } from 'mongoose';
+
+export interface IBillingPeriodSnapshot extends Document {
+  tenant_id: mongoose.Types.ObjectId;
+  payment_id: mongoose.Types.ObjectId;
+  period_start: Date;
+  period_end: Date;
+  plan_name: string;
+  plan_slug: string;
+  // Call metrics
+  total_calls: number;
+  inbound_calls: number;
+  inbound_minutes: number;
+  outbound_calls: number;
+  outbound_minutes: number;
+  total_charges: number;
+  // Plan quotas at time of snapshot
+  included_minutes: number;
+  included_inbound_minutes: number;
+  included_inbound_calls: number;
+  included_outbound_minutes: number;
+  included_outbound_calls: number;
+  included_wa_chats: number;
+  // WhatsApp metrics
+  wa_billable_chats: number;
+  wa_total_sessions: number;
+  wa_total_messages: number;
+  wa_ai_messages: number;
+  wa_elevenlabs_cost: number;
+  // STT metrics
+  wa_stt_count: number;
+  wa_stt_seconds: number;
+  createdAt: Date;
+}
+
+const billingPeriodSnapshotSchema = new Schema<IBillingPeriodSnapshot>({
+  tenant_id: { type: Schema.Types.ObjectId, ref: 'Tenant', required: true },
+  payment_id: { type: Schema.Types.ObjectId, ref: 'Payment', required: true },
+  period_start: { type: Date, required: true },
+  period_end: { type: Date, required: true },
+  plan_name: { type: String, default: '' },
+  plan_slug: { type: String, default: '' },
+  total_calls: { type: Number, default: 0 },
+  inbound_calls: { type: Number, default: 0 },
+  inbound_minutes: { type: Number, default: 0 },
+  outbound_calls: { type: Number, default: 0 },
+  outbound_minutes: { type: Number, default: 0 },
+  total_charges: { type: Number, default: 0 },
+  included_minutes: { type: Number, default: 0 },
+  included_inbound_minutes: { type: Number, default: 0 },
+  included_inbound_calls: { type: Number, default: 0 },
+  included_outbound_minutes: { type: Number, default: 0 },
+  included_outbound_calls: { type: Number, default: 0 },
+  included_wa_chats: { type: Number, default: 0 },
+  wa_billable_chats: { type: Number, default: 0 },
+  wa_total_sessions: { type: Number, default: 0 },
+  wa_total_messages: { type: Number, default: 0 },
+  wa_ai_messages: { type: Number, default: 0 },
+  wa_elevenlabs_cost: { type: Number, default: 0 },
+  wa_stt_count: { type: Number, default: 0 },
+  wa_stt_seconds: { type: Number, default: 0 },
+}, {
+  timestamps: { createdAt: true, updatedAt: false },
+});
+
+billingPeriodSnapshotSchema.index({ tenant_id: 1, period_start: -1 });
+
+export default mongoose.model<IBillingPeriodSnapshot>('BillingPeriodSnapshot', billingPeriodSnapshotSchema);

package/src/modules/billing/billing.model.ts

@@ -0,0 +1,42 @@
+import mongoose, { Document, Schema } from 'mongoose';
+
+export type BillingEventType = 'call_charge' | 'subscription' | 'top_up' | 'refund';
+
+export interface IBillingEvent extends Document {
+  tenant_id: mongoose.Types.ObjectId;
+  type: BillingEventType;
+  amount: number;
+  currency: string;
+  call_id: mongoose.Types.ObjectId | null;
+  param_transaction_id: string | null;
+  description: string;
+  createdAt: Date;
+}
+
+const billingEventSchema = new Schema<IBillingEvent>({
+  tenant_id: {
+    type: Schema.Types.ObjectId,
+    ref: 'Tenant',
+    required: true
+  },
+  type: {
+    type: String,
+    enum: ['call_charge', 'subscription', 'top_up', 'refund'],
+    required: true
+  },
+  amount: { type: Number, required: true },
+  currency: { type: String, default: 'TRY' },
+  call_id: {
+    type: Schema.Types.ObjectId,
+    ref: 'Call',
+    default: null
+  },
+  param_transaction_id: { type: String, default: null },
+  description: { type: String, default: '' }
+}, {
+  timestamps: { createdAt: true, updatedAt: false }
+});
+
+billingEventSchema.index({ tenant_id: 1, createdAt: -1 });
+
+export default mongoose.model<IBillingEvent>('BillingEvent', billingEventSchema);

package/src/modules/billing/billing.routes.ts

@@ -0,0 +1,67 @@
+import { FastifyInstance } from 'fastify';
+import BillingEvent from './billing.model';
+import BillingPeriodSnapshot from './billing-period-snapshot.model';
+import { getUsageSummary, getDailyTrend } from './billing.service';
+import { requireRole } from '../../plugins/rbac';
+
+export default async function billingRoutes(fastify: FastifyInstance): Promise<void> {
+  fastify.addHook('preHandler', fastify.authenticate);
+
+  // GET /billing/usage — current period usage summary
+  fastify.get('/usage', {
+    preHandler: [requireRole('admin')]
+  }, async (request) => {
+    const usage = await getUsageSummary(request.user.tenant_id);
+    return { usage };
+  });
+
+  // GET /billing/daily-trend — daily usage trend for active period
+  fastify.get('/daily-trend', {
+    preHandler: [requireRole('admin', 'manager', 'viewer')]
+  }, async (request) => {
+    const trend = await getDailyTrend(request.user.tenant_id);
+    return { trend };
+  });
+
+  // GET /billing/snapshots — past billing period summaries
+  fastify.get('/snapshots', {
+    preHandler: [requireRole('admin', 'manager', 'viewer')]
+  }, async (request) => {
+    const snapshots = await BillingPeriodSnapshot.find({ tenant_id: request.user.tenant_id })
+      .sort({ period_start: -1 })
+      .lean();
+    return { snapshots };
+  });
+
+  // GET /billing/history — billing event history
+  fastify.get<{
+    Querystring: { page?: string; type?: string };
+  }>('/history', {
+    preHandler: [requireRole('admin')]
+  }, async (request) => {
+    const page = parseInt(request.query.page || '1', 10);
+    const limit = 20;
+    const skip = (page - 1) * limit;
+
+    const filter: Record<string, unknown> = { tenant_id: request.user.tenant_id };
+    if (request.query.type) {
+      filter.type = request.query.type;
+    }
+
+    const [events, total] = await Promise.all([
+      BillingEvent.find(filter)
+        .sort({ createdAt: -1 })
+        .skip(skip)
+        .limit(limit)
+        .populate('call_id', 'caller_number duration_seconds direction'),
+      BillingEvent.countDocuments(filter)
+    ]);
+
+    return {
+      events,
+      total,
+      page,
+      totalPages: Math.ceil(total / limit)
+    };
+  });
+}