fraim-hub 2.0.204

package/dist/src/middleware/rate-limit.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sensitiveRateLimiter = exports.publicApiRateLimiter = void 0;
+exports.createRateLimiter = createRateLimiter;
+function createRateLimiter(options) {
+    const { windowMs, max, name } = options;
+    const buckets = new Map();
+    function cleanupExpired(now = Date.now()) {
+        let removed = 0;
+        for (const [key, bucket] of buckets) {
+            if (bucket.resetAt <= now) {
+                buckets.delete(key);
+                removed += 1;
+            }
+        }
+        return removed;
+    }
+    // Periodically sweep expired buckets so long-lived processes do not leak memory
+    // proportional to lifetime client-IP cardinality. unref() so the timer never holds
+    // the event loop open during shutdown.
+    let sweepTimer = null;
+    if (process.env.NODE_ENV !== 'test' || process.env.FRAIM_RATE_LIMIT_SWEEP === '1') {
+        sweepTimer = setInterval(() => {
+            const removed = cleanupExpired();
+            if (removed > 0) {
+                console.log(`[FRAIM RATE-LIMIT] ${name} swept ${removed} expired buckets (remaining=${buckets.size})`);
+            }
+        }, windowMs);
+        sweepTimer.unref();
+    }
+    const middleware = function rateLimitMiddleware(req, res, next) {
+        // Rate limits are skipped in test mode so the suite can run hundreds of requests
+        // against the same endpoint quickly. Production and dev still enforce them.
+        if (process.env.NODE_ENV === 'test' && process.env.FRAIM_TEST_RATE_LIMIT !== '1') {
+            return next();
+        }
+        const key = identifyClient(req);
+        const now = Date.now();
+        const bucket = buckets.get(key);
+        if (!bucket || bucket.resetAt <= now) {
+            buckets.set(key, { count: 1, resetAt: now + windowMs });
+            res.setHeader('X-RateLimit-Limit', String(max));
+            res.setHeader('X-RateLimit-Remaining', String(max - 1));
+            res.setHeader('X-RateLimit-Reset', String(Math.ceil((now + windowMs) / 1000)));
+            return next();
+        }
+        if (bucket.count >= max) {
+            const retryAfterSec = Math.max(1, Math.ceil((bucket.resetAt - now) / 1000));
+            res.setHeader('Retry-After', String(retryAfterSec));
+            res.setHeader('X-RateLimit-Limit', String(max));
+            res.setHeader('X-RateLimit-Remaining', '0');
+            res.setHeader('X-RateLimit-Reset', String(Math.ceil(bucket.resetAt / 1000)));
+            console.warn(`[FRAIM RATE-LIMIT] ${name} blocked ${key} on ${req.method} ${req.path}`);
+            return res.status(429).json({
+                error: 'Too many requests',
+                message: `Rate limit exceeded. Try again in ${retryAfterSec} seconds.`
+            });
+        }
+        bucket.count += 1;
+        res.setHeader('X-RateLimit-Limit', String(max));
+        res.setHeader('X-RateLimit-Remaining', String(max - bucket.count));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(bucket.resetAt / 1000)));
+        return next();
+    };
+    middleware.reset = () => buckets.clear();
+    middleware.cleanupExpired = cleanupExpired;
+    middleware.stopCleanup = () => {
+        if (sweepTimer) {
+            clearInterval(sweepTimer);
+            sweepTimer = null;
+        }
+    };
+    Object.defineProperty(middleware, 'bucketCount', {
+        get: () => buckets.size
+    });
+    return middleware;
+}
+/**
+ * Identify the client for rate-limit bucketing.
+ * Order: explicit Express-resolved req.ip → first X-Forwarded-For hop → socket address → 'unknown'.
+ */
+function identifyClient(req) {
+    if (req.ip)
+        return req.ip;
+    const xff = req.headers['x-forwarded-for'];
+    if (typeof xff === 'string' && xff.length > 0) {
+        const first = xff.split(',')[0].trim();
+        if (first)
+            return first;
+    }
+    else if (Array.isArray(xff) && xff.length > 0) {
+        const first = xff[0].split(',')[0].trim();
+        if (first)
+            return first;
+    }
+    return req.socket?.remoteAddress || 'unknown';
+}
+/**
+ * Standard public-API limiter: 60 requests per minute per IP.
+ * Suitable for read-only public endpoints (pricing config, session details).
+ */
+const publicApiRateLimiter = () => createRateLimiter({ windowMs: 60_000, max: 60, name: 'public-api' });
+exports.publicApiRateLimiter = publicApiRateLimiter;
+/**
+ * Sensitive-action limiter: 10 requests per minute per IP.
+ * Suitable for signup, contact, bypass, key-retrieval, and other endpoints
+ * whose abuse has direct cost or fraud impact.
+ */
+const sensitiveRateLimiter = () => createRateLimiter({ windowMs: 60_000, max: 10, name: 'sensitive' });
+exports.sensitiveRateLimiter = sensitiveRateLimiter;

package/dist/src/models/payment.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/routes/payment-routes.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPaymentRoutes = registerPaymentRoutes;
+exports.registerAdminPaymentRoutes = registerAdminPaymentRoutes;
+const create_session_1 = require("../api/payment/create-session");
+const session_details_1 = require("../api/payment/session-details");
+const dashboard_link_1 = require("../api/payment/dashboard-link");
+const webhook_1 = require("../api/payment/webhook");
+const contact_1 = require("../api/sales/contact");
+const payments_1 = require("../api/admin/payments");
+const sales_leads_1 = require("../api/admin/sales-leads");
+const get_config_1 = require("../api/pricing/get-config");
+const rate_limit_1 = require("../middleware/rate-limit");
+/**
+ * Register all payment-related routes
+ * These routes must be registered BEFORE auth middleware
+ */
+function registerPaymentRoutes(app, getPaymentRepo, dbService) {
+    // Per-route rate limiters. Webhooks are intentionally NOT rate-limited at
+    // the application layer because Stripe controls delivery and retry semantics.
+    const publicLimiter = (0, rate_limit_1.publicApiRateLimiter)();
+    const sensitiveLimiter = (0, rate_limit_1.sensitiveRateLimiter)();
+    // Pricing config endpoint (public, no auth required)
+    app.get('/api/pricing/config', publicLimiter, async (req, res) => {
+        await (0, get_config_1.getPricingConfig)(req, res);
+    });
+    // Payment API endpoints (public, no auth required)
+    app.post('/api/payment/create-session', sensitiveLimiter, async (req, res) => {
+        const paymentRepo = getPaymentRepo();
+        if (!paymentRepo) {
+            return res.status(500).json({ error: 'Payment system not initialized' });
+        }
+        await (0, create_session_1.createCheckoutSession)(req, res, paymentRepo, dbService);
+    });
+    // Payment success page — fetch Stripe session details by session_id
+    app.get('/api/payment/session-details', publicLimiter, async (req, res) => {
+        await (0, session_details_1.getSessionDetails)(req, res);
+    });
+    // Checkout success page: provide immediate dashboard URL (no email wait)
+    app.get('/api/payment/dashboard-link', publicLimiter, async (req, res) => {
+        await (0, dashboard_link_1.getDashboardLinkFromCheckoutSession)(req, res, dbService);
+    });
+    // Stripe webhook endpoint (raw body required for signature verification)
+    // Intentionally NOT rate-limited; Stripe handles its own delivery semantics.
+    app.post('/api/payment/webhook', async (req, res) => {
+        const paymentRepo = getPaymentRepo();
+        if (!paymentRepo) {
+            return res.status(500).json({ error: 'Payment system not initialized' });
+        }
+        await (0, webhook_1.handleStripeWebhook)(req, res, paymentRepo, dbService);
+    });
+    // Sales inquiry endpoint (public, no auth required)
+    app.post('/api/sales/contact', sensitiveLimiter, async (req, res) => {
+        await (0, contact_1.createSalesLead)(req, res, dbService);
+    });
+    // Payment bypass endpoint for non-production testing only.
+    // Two layers of defence:
+    //   1. Route returns 404 entirely when NODE_ENV === 'production'.
+    //   2. PAYMENT_BYPASS_CODE must be explicitly set in the environment; there is no
+    //      hardcoded fallback. If it is unset, the route returns 503.
+    app.post('/api/payment/bypass', sensitiveLimiter, async (req, res) => {
+        if (process.env.NODE_ENV === 'production') {
+            return res.status(404).json({ error: 'Not found' });
+        }
+        const BYPASS_CODE = process.env.PAYMENT_BYPASS_CODE;
+        if (!BYPASS_CODE) {
+            console.error('[FRAIM] /api/payment/bypass invoked but PAYMENT_BYPASS_CODE is not configured');
+            return res.status(503).json({ error: 'Payment bypass is not configured on this server' });
+        }
+        const { code, apiKey, daysUntilExpiry } = req.body;
+        if (code !== BYPASS_CODE) {
+            return res.status(403).json({ error: 'Invalid bypass code' });
+        }
+        if (!apiKey) {
+            return res.status(400).json({ error: 'apiKey is required' });
+        }
+        const existingKey = await dbService.getApiKeyByKey(apiKey);
+        if (!existingKey) {
+            return res.status(404).json({ error: 'API key not found' });
+        }
+        // Cap at 365 days. Defense in depth: even with the bypass code, do not let a
+        // request grant a multi-year subscription to an account.
+        const MAX_BYPASS_DAYS = 365;
+        const requestedDays = parseInt(daysUntilExpiry) || 30;
+        const days = Math.max(1, Math.min(requestedDays, MAX_BYPASS_DAYS));
+        const newExpiry = new Date(Date.now() + days * 24 * 60 * 60 * 1000);
+        await dbService.updateApiKey(apiKey, {
+            tier: 'paid-subscription',
+            status: 'active',
+            expiresAt: newExpiry,
+            currentPeriodEnd: newExpiry,
+            stripeCustomerId: 'bypass_test_customer',
+            stripeSubscriptionId: 'bypass_test_subscription'
+        });
+        console.log(`[FRAIM] payment_bypass activated`, { userId: existingKey.userId, expiresAt: newExpiry.toISOString() });
+        return res.json({
+            success: true,
+            message: `Key upgraded to paid-subscription, expires in ${days} days`,
+            expiresAt: newExpiry.toISOString(),
+            tier: 'paid-subscription'
+        });
+    });
+}
+/**
+ * Register admin payment routes
+ * These routes require auth middleware to be applied first
+ */
+function registerAdminPaymentRoutes(app, getPaymentRepo, dbService) {
+    // Admin endpoints (require auth)
+    app.get('/admin/payments', async (req, res) => {
+        const paymentRepo = getPaymentRepo();
+        if (!paymentRepo) {
+            return res.status(500).json({ error: 'Payment system not initialized' });
+        }
+        await (0, payments_1.listPayments)(req, res, paymentRepo);
+    });
+    app.get('/admin/sales-leads', async (req, res) => {
+        await (0, sales_leads_1.listSalesLeads)(req, res, dbService);
+    });
+    // ── Partner Discount CRUD ─────────────────────────────────────────────────
+    /** List all partner discount entries */
+    app.get('/admin/partner-discounts', async (req, res) => {
+        try {
+            const entries = await dbService.listPartnerDiscounts();
+            res.json(entries);
+        }
+        catch (error) {
+            res.status(500).json({ error: 'Failed to list partner discounts', details: error.message });
+        }
+    });
+    /** Create a new partner discount entry */
+    app.post('/admin/partner-discounts', async (req, res) => {
+        try {
+            const { type, match, couponId, company } = req.body;
+            if (!type || !['email', 'domain'].includes(type)) {
+                return res.status(400).json({ error: 'type must be "email" or "domain"' });
+            }
+            if (!match || typeof match !== 'string' || !match.trim()) {
+                return res.status(400).json({ error: 'match is required (email address or domain)' });
+            }
+            if (!couponId || typeof couponId !== 'string' || !couponId.trim()) {
+                return res.status(400).json({ error: 'couponId is required (Stripe coupon ID)' });
+            }
+            const entry = await dbService.createPartnerDiscount({
+                type,
+                match: match.trim().toLowerCase(),
+                couponId: couponId.trim(),
+                company: company?.trim() || undefined,
+                active: true,
+                createdAt: new Date(),
+                useCount: 0,
+            });
+            res.status(201).json(entry);
+        }
+        catch (error) {
+            if (error.code === 11000) {
+                return res.status(409).json({ error: 'A discount entry for that type+match already exists' });
+            }
+            res.status(500).json({ error: 'Failed to create partner discount', details: error.message });
+        }
+    });
+    /** Update an existing partner discount entry (active, couponId, company) */
+    app.patch('/admin/partner-discounts/:id', async (req, res) => {
+        try {
+            const id = req.params.id;
+            const { active, couponId, company } = req.body;
+            const update = {};
+            if (typeof active === 'boolean')
+                update.active = active;
+            if (typeof couponId === 'string' && couponId.trim())
+                update.couponId = couponId.trim();
+            if (typeof company === 'string')
+                update.company = company.trim() || undefined;
+            if (Object.keys(update).length === 0) {
+                return res.status(400).json({ error: 'No valid fields to update (active, couponId, company)' });
+            }
+            const updated = await dbService.updatePartnerDiscount(id, update);
+            if (!updated)
+                return res.status(404).json({ error: 'Partner discount not found' });
+            res.json({ success: true });
+        }
+        catch (error) {
+            res.status(500).json({ error: 'Failed to update partner discount', details: error.message });
+        }
+    });
+}

package/dist/src/routes/persona-catalog-routes.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * GET /api/personas/catalog
+ *
+ * Public, read-only endpoint that returns the full persona catalog for
+ * fraim-pro/index.html and fraim-pro/pricing.html to hydrate their grids.
+ *
+ * Auth: none — added to publicPrefixes in src/middleware/auth.ts.
+ *
+ * Response shape: PersonaCatalogResponse (see types below).
+ *
+ * Issue #545: centralizes emoji, gradient, blurb, and price display in
+ * PERSONA_HIRE_CATALOG so the HTML surfaces are derived views, not sources
+ * of truth.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatPrice = formatPrice;
+exports.buildPersonaCatalog = buildPersonaCatalog;
+exports.registerPersonaCatalogRoutes = registerPersonaCatalogRoutes;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const persona_hiring_1 = require("../config/persona-hiring");
+const persona_capability_bundles_1 = require("../config/persona-capability-bundles");
+const portfolio_slug_overrides_1 = require("../config/portfolio-slug-overrides");
+/**
+ * Format a cents integer to a dollar string, dropping trailing .00.
+ *
+ * Examples:
+ *   990  -> "$9.90"
+ *   4990 -> "$49.90"
+ *   24900 -> "$249"
+ *   100  -> "$1"
+ *
+ * Exported so persona-capability-bundles.ts can reuse the same function.
+ */
+function formatPrice(cents) {
+    return `$${(cents / 100).toFixed(2).replace(/\.00$/, '')}`;
+}
+/**
+ * Build the catalog array from PERSONA_HIRE_CATALOG + PERSONA_CAPABILITY_BUNDLES.
+ *
+ * Exported for unit testing without requiring an HTTP context.
+ */
+function buildPersonaCatalog() {
+    const ROOT = process.cwd();
+    return Object.entries(persona_hiring_1.PERSONA_HIRE_CATALOG).map(([key, persona]) => {
+        const hireKey = key;
+        const slug = portfolio_slug_overrides_1.PORTFOLIO_SLUG_OVERRIDES[key] ?? key;
+        const hasPortfolioPage = (0, fs_1.existsSync)((0, path_1.join)(ROOT, 'public', 'portfolio', slug + '.html'));
+        const bundle = persona_capability_bundles_1.PERSONA_CAPABILITY_BUNDLES[hireKey];
+        const sampleJobs = bundle?.catalogMetadata?.sampleJobs ?? [];
+        return {
+            key,
+            displayName: persona.displayName,
+            role: persona.role,
+            emoji: persona.emoji,
+            gradient: persona.gradient,
+            blurb: persona.blurb,
+            avatarUrl: (0, persona_hiring_1.buildPersonaAvatarUrl)(hireKey),
+            avatarBackgroundColor: persona_hiring_1.PERSONA_AVATAR_CATALOG[hireKey].bg,
+            jobPriceCents: persona.jobPriceCents,
+            fulltimePriceCents: persona.fulltimePriceCents,
+            portfolioSlug: slug,
+            hasPortfolioPage,
+            sampleJobs,
+        };
+    });
+}
+/**
+ * Register the persona catalog route.
+ * Must be called BEFORE auth middleware (it is public — no key required).
+ */
+function registerPersonaCatalogRoutes(app) {
+    app.get('/api/personas/catalog', (req, res) => {
+        try {
+            const personas = buildPersonaCatalog();
+            res.json({ personas });
+        }
+        catch (err) {
+            console.error('[persona-catalog] Error building catalog:', err);
+            res.status(500).json({ error: 'Failed to build persona catalog' });
+        }
+    });
+}

package/dist/src/services/dashboard-access.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDashboardAccessLink = createDashboardAccessLink;
+exports.createDashboardAccessUrl = createDashboardAccessUrl;
+const crypto_1 = require("crypto");
+async function createDashboardAccessLink(dbService, email, apiKey, tokenFactory = () => (0, crypto_1.randomBytes)(32).toString('hex')) {
+    const token = tokenFactory();
+    const expiresAt = new Date(Date.now() + 15 * 60 * 1000);
+    await dbService.createAccessToken({
+        token,
+        email,
+        key: apiKey,
+        expiresAt,
+        createdAt: new Date()
+    });
+    const baseUrl = (process.env.BASE_URL || 'https://fraimworks.ai').replace(/\/$/, '');
+    return {
+        token,
+        expiresAt,
+        dashboardUrl: `${baseUrl}/dashboard?token=${token}`,
+        redirectPath: `/dashboard?token=${token}`
+    };
+}
+async function createDashboardAccessUrl(dbService, email, apiKey, tokenFactory) {
+    const { dashboardUrl } = await createDashboardAccessLink(dbService, email, apiKey, tokenFactory);
+    return dashboardUrl;
+}