fraim 2.0.352 → 2.0.354

package/dist/src/fraim/db-service.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FraimDbService = void 0;
 const mongodb_1 = require("mongodb");
+const node_crypto_1 = require("node:crypto");
+const current_license_1 = require("./current-license");
 const git_utils_1 = require("../core/utils/git-utils");
 const quality_evidence_1 = require("../core/quality-evidence");
 function sanitizeSessionRepoContext(repo) {
@@ -186,6 +188,10 @@ class FraimDbService {
         await this.sessionsCollection.createIndex({ sessionId: 1 }, { unique: true });
         await this.sessionsCollection.createIndex({ userId: 1 });
         await this.sessionsCollection.createIndex({ lastActive: -1 });
+        // Issue #2093 — getActiveSessionByApiKey no longer bounds its match by recency, so a
+        // long-lived user's full session history is a candidate. This compound index keeps that
+        // lookup an indexed scan with an ordered result instead of a fetch-then-sort in memory.
+        await this.sessionsCollection.createIndex({ userId: 1, lastActive: -1 });
         await this.signupsCollection.createIndex({ email: 1 }, { unique: true });
         await this.signupsCollection.createIndex({ timestamp: -1 });
         await this.salesCollection.createIndex({ email: 1 });
@@ -327,21 +333,36 @@ class FraimDbService {
     async verifyApiKey(key) {
         if (!this.keysCollection)
             throw new Error('DB not connected');
-        // Return the key regardless of isActive/status — the auth middleware
-        // is responsible for checking expiry and returning the right HTTP status.
-        return await this.keysCollection.findOne({ key });
+        const credential = await this.keysCollection.findOne({ key });
+        if (!credential || credential.revokedAt)
+            return null;
+        if (credential.isActive === false) {
+            // Legacy expired/suspended records still report their lifecycle, but never inherit access.
+            return credential.status === 'expired' || credential.status === 'suspended' ? credential : null;
+        }
+        // A suspended trial is an explicit restriction, not an upgrade candidate.
+        if (credential.tier === 'trial' && credential.status === 'suspended')
+            return credential;
+        const records = await this.keysCollection.find({ userId: credential.userId }).toArray();
+        const paid = (0, current_license_1.selectCurrentLicense)(records.filter(record => record.tier === 'paid-subscription' && (0, current_license_1.sameLicenseScope)(credential, record)));
+        // Preserve the stored credential and its history; auth checks the current entitlement.
+        return paid || credential;
     }
+    /**
+     * Most recently active session for the key's owner, at any age.
+     *
+     * Issue #2093 — a FRAIM work session has no lifetime. Elapsed time must never make an
+     * existing, owned session unresolvable, so this lookup filters on ownership only and
+     * leaves recency to the sort. Access is still bounded by `verifyApiKey`: an unknown,
+     * revoked or suspended credential resolves nothing.
+     */
     async getActiveSessionByApiKey(key) {
         if (!this.keysCollection || !this.sessionsCollection)
             throw new Error('DB not connected');
-        // 1. Get user for this key
         const apiKeyData = await this.verifyApiKey(key);
         if (!apiKeyData)
             return null;
-        // 2. Get latest session for this user (within last 24h)
-        const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000);
-        const session = await this.sessionsCollection.findOne({ userId: apiKeyData.userId, lastActive: { $gt: dayAgo } }, { sort: { lastActive: -1 } });
-        return session;
+        return this.sessionsCollection.findOne({ userId: apiKeyData.userId }, { sort: { lastActive: -1 } });
     }
     async getSessionByApiKeyAndSessionId(key, sessionId) {
         if (!this.keysCollection || !this.sessionsCollection)
@@ -349,13 +370,19 @@ class FraimDbService {
         const apiKeyData = await this.verifyApiKey(key);
         if (!apiKeyData)
             return null;
-        const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000);
-        const session = await this.sessionsCollection.findOne({
-            sessionId,
-            userId: apiKeyData.userId,
-            lastActive: { $gt: dayAgo }
-        });
-        return session;
+        return this.getSessionByUserIdAndSessionId(apiKeyData.userId, sessionId);
+    }
+    /**
+     * Exact session lookup scoped to its owner, at any age.
+     *
+     * Issue #2093 — resuming a session after days, months or years must return the original
+     * record so the run keeps its job, phase and review state. `userId` remains the only
+     * eligibility condition, so another account still cannot reach this session.
+     */
+    async getSessionByUserIdAndSessionId(userId, sessionId) {
+        if (!this.sessionsCollection)
+            throw new Error('DB not connected');
+        return this.sessionsCollection.findOne({ sessionId, userId });
     }
     async createAuthSession(input) {
         if (!this.authSessionsCollection)
@@ -468,8 +495,9 @@ class FraimDbService {
             key: newKey,
             createdAt: new Date(),
             isActive: true,
+            revokedAt: null,
         });
-        await this.keysCollection.updateOne({ key: currentKey }, { $set: { isActive: false, status: 'expired' } });
+        await this.keysCollection.updateOne({ key: currentKey }, { $set: { isActive: false, status: 'expired', revokedAt: new Date() } });
         return true;
     }
     async listApiKeys() {
@@ -489,7 +517,7 @@ class FraimDbService {
     async revokeApiKey(key) {
         if (!this.keysCollection)
             throw new Error('DB not connected');
-        const result = await this.keysCollection.updateOne({ key }, { $set: { isActive: false } });
+        const result = await this.keysCollection.updateOne({ key }, { $set: { isActive: false, revokedAt: new Date() } });
         return result.matchedCount > 0;
     }
     buildApiKeyTargetQuery(keys, userIds, labels = []) {
@@ -534,10 +562,11 @@ class FraimDbService {
             const status = record.status === 'suspended' ? 'suspended' : nextStatus;
             const update = {
                 expiresAt,
-                status
+                status,
+                manualAccessOverride: { until: expiresAt, grantedAt: new Date(), reason: 'admin' }
             };
-            if (record.tier === 'paid-subscription') {
-                update.currentPeriodEnd = expiresAt;
+            if (record.stripeSubscriptionId && record.billingReconciledAt) {
+                Object.assign(update, (0, current_license_1.subscriptionAccessPatch)({ ...record, ...update }));
             }
             await this.keysCollection.updateOne({ key: record.key }, { $set: update });
             updatedKeys.push(record.key);
@@ -681,15 +710,16 @@ class FraimDbService {
     async getApiKeyByUserId(userId, activeOnly = true) {
         if (!this.db)
             throw new Error('DB not connected');
-        const query = { userId };
-        if (activeOnly) {
-            // Match active status OR legacy isActive:true with no status field.
-            query.$or = [
-                { status: 'active' },
-                { status: { $exists: false }, isActive: true }
-            ];
-        }
-        return await this.db.collection('fraim_api_keys').findOne(query);
+        const records = await this.db.collection('fraim_api_keys')
+            .find({ userId: userId.trim().toLowerCase() }).toArray();
+        // Sort in memory: Cosmos Mongo does not support arbitrary compound order-by queries.
+        const current = (0, current_license_1.selectCurrentLicense)(records, activeOnly);
+        if (current || activeOnly || records.length === 0)
+            return current;
+        // Retain account identity for sign-in/recovery and prevent signup issuing a fresh trial
+        // when every credential was revoked. Revocation is never projected as usable access.
+        const revoked = [...records].sort((a, b) => a.key.localeCompare(b.key))[0];
+        return { ...revoked, status: 'expired' };
     }
     async createAccessToken(data) {
         if (!this.accessTokensCollection)
@@ -801,12 +831,145 @@ class FraimDbService {
     async getApiKeyByStripeSubscriptionId(subscriptionId) {
         if (!this.keysCollection)
             throw new Error('DB not connected');
-        return await this.keysCollection.findOne({ stripeSubscriptionId: subscriptionId });
+        const rows = await this.keysCollection.find({ stripeSubscriptionId: subscriptionId }).toArray();
+        this.assertSubscriptionScope(rows);
+        // Billing must retain revoked subscription history; a checkout replay must not mint a replacement.
+        return (0, current_license_1.selectCurrentLicense)(rows) || rows.sort((a, b) => a.key.localeCompare(b.key))[0] || null;
     }
     async getApiKeyByStripeCustomerId(customerId) {
         if (!this.keysCollection)
             throw new Error('DB not connected');
-        return await this.keysCollection.findOne({ stripeCustomerId: customerId });
+        return (0, current_license_1.selectCurrentLicense)(await this.keysCollection.find({ stripeCustomerId: customerId }).toArray());
+    }
+    assertSubscriptionScope(rows) {
+        if (rows.some(row => !(0, current_license_1.sameLicenseScope)(rows[0], row))) {
+            throw new Error('Subscription is associated with conflicting account identities');
+        }
+        if (new Set(rows.map(row => row.stripeCustomerId).filter(Boolean)).size > 1) {
+            throw new Error('Subscription is associated with conflicting customer identities');
+        }
+    }
+    /** Keep duplicate records of one subscription in agreement without deleting history or reviving revoked keys. */
+    async updateSubscriptionApiKeys(subscriptionId, update) {
+        if (!this.keysCollection)
+            throw new Error('DB not connected');
+        const rows = await this.keysCollection.find({ stripeSubscriptionId: subscriptionId }).toArray();
+        this.assertSubscriptionScope(rows);
+        if (update.stripeCustomerId && rows.some(row => row.stripeCustomerId && row.stripeCustomerId !== update.stripeCustomerId)) {
+            throw new Error('Subscription customer identity does not match');
+        }
+        for (const field of ['_id', 'key', 'userId', 'orgId', 'workspaceId', 'createdAt', 'isActive', 'revokedAt', 'stripeSubscriptionId']) {
+            if (field in update)
+                throw new Error('Subscription updates cannot change credential identity');
+        }
+        // Stripe terminal subscriptions cannot be resumed. Guard the write itself,
+        // since an active snapshot may have been fetched before cancellation won.
+        if (update.billingReconciledAt) {
+            let matched = false;
+            for (const original of rows) {
+                for (let attempt = 0; attempt < 4; attempt++) {
+                    const row = await this.keysCollection.findOne({ key: original.key });
+                    if (!row)
+                        break;
+                    if (row.stripeSubscriptionEndedAt && !update.stripeSubscriptionEndedAt)
+                        break;
+                    if (!update.stripeSubscriptionEndedAt && row.billingReconciledAt && row.billingReconciledAt > update.billingReconciledAt)
+                        break;
+                    const merged = this.mergeSubscriptionBilling(row, update);
+                    const result = await this.keysCollection.updateOne({
+                        key: row.key,
+                        billingReconciledAt: row.billingReconciledAt || null,
+                        stripeSubscriptionEndedAt: row.stripeSubscriptionEndedAt || null,
+                        manualAccessOverride: row.manualAccessOverride || null
+                    }, { $set: merged });
+                    if (result.matchedCount) {
+                        matched = true;
+                        break;
+                    }
+                    if (attempt === 3)
+                        throw new Error('Subscription billing update did not converge');
+                }
+            }
+            return matched;
+        }
+        const result = await this.keysCollection.updateMany({
+            stripeSubscriptionId: subscriptionId,
+            ...(!update.stripeSubscriptionEndedAt ? { stripeSubscriptionEndedAt: null } : {})
+        }, { $set: update });
+        return result.matchedCount > 0;
+    }
+    mergeSubscriptionBilling(row, update) {
+        const merged = { ...update };
+        if (row.stripeSubscriptionEndedAt && merged.stripeSubscriptionEndedAt
+            && row.stripeSubscriptionEndedAt < merged.stripeSubscriptionEndedAt) {
+            merged.stripeSubscriptionEndedAt = row.stripeSubscriptionEndedAt;
+        }
+        // Finite historical expiration edits may be support grants. Preserve their
+        // original deadline with explicit legacy provenance; never convert null
+        // subscription expirations into unlimited manual access.
+        if (!row.manualAccessOverride && !row.billingReconciledAt && row.expiresAt
+            && (row.tier === 'paid-subscription' || (row.createdAt
+                && row.expiresAt.getTime() > row.createdAt.getTime() + 14 * 86400000))) {
+            merged.manualAccessOverride = { until: row.expiresAt, grantedAt: new Date(), reason: 'legacy-expiration' };
+        }
+        if (row.paidThrough && (!merged.paidThrough || row.paidThrough > merged.paidThrough)) {
+            merged.paidThrough = row.paidThrough;
+            merged.paidPeriodStart = row.paidPeriodStart;
+            merged.paidInvoiceId = row.paidInvoiceId;
+        }
+        return { ...merged, ...(0, current_license_1.subscriptionAccessPatch)({ ...row, ...merged }) };
+    }
+    /** Reuse an expired trial in place. Subscription identity makes repeat/new-account provisioning idempotent. */
+    async provisionSubscriptionApiKey(userId, data) {
+        if (!this.keysCollection)
+            throw new Error('DB not connected');
+        const email = userId.trim().toLowerCase();
+        if (!email || !data.stripeSubscriptionId || !data.stripeCustomerId)
+            throw new Error('Subscription identity is required');
+        const patch = { ...data, tier: 'paid-subscription' };
+        for (let attempt = 0; attempt < 4; attempt++) {
+            const existing = await this.getApiKeyByStripeSubscriptionId(data.stripeSubscriptionId);
+            if (existing) {
+                if (existing.userId !== email || (existing.stripeCustomerId && existing.stripeCustomerId !== data.stripeCustomerId)) {
+                    throw new Error('Subscription does not belong to this account');
+                }
+                const { stripeSubscriptionId, ...lifecycle } = patch;
+                await this.updateSubscriptionApiKeys(stripeSubscriptionId, lifecycle);
+                return (await this.getApiKeyByStripeSubscriptionId(stripeSubscriptionId));
+            }
+            const records = await this.keysCollection.find({ userId: email }).toArray();
+            const eligible = records.filter(record => record.isActive !== false && !record.revokedAt);
+            // Another checkout/webhook may have promoted the trial after the first lookup.
+            if (eligible.some(record => record.stripeSubscriptionId === data.stripeSubscriptionId))
+                continue;
+            if (eligible.some(record => !(0, current_license_1.sameLicenseScope)(eligible[0], record))) {
+                throw new Error('Checkout account scope is ambiguous');
+            }
+            const trial = (0, current_license_1.selectCurrentLicense)(eligible.filter(record => record.tier === 'trial'
+                && record.status !== 'suspended' && !record.stripeSubscriptionId));
+            if (trial) {
+                const result = await this.keysCollection.updateOne({ key: trial.key, tier: 'trial', stripeSubscriptionId: null, isActive: { $ne: false }, status: { $ne: 'suspended' },
+                    expiresAt: trial.expiresAt, manualAccessOverride: trial.manualAccessOverride || null }, { $set: data.billingReconciledAt ? this.mergeSubscriptionBilling(trial, patch) : patch });
+                if (result.matchedCount)
+                    return (await this.getApiKeyByKey(trial.key));
+                continue;
+            }
+            const _id = new mongodb_1.ObjectId((0, node_crypto_1.createHash)('sha256').update(`fraim-subscription:${data.stripeSubscriptionId}`).digest('hex').slice(0, 24));
+            const prior = eligible[0];
+            try {
+                await this.keysCollection.updateOne({ _id }, { $setOnInsert: {
+                        _id, key: this.generateApiKey(email, prior?.orgId || 'default'), userId: email,
+                        orgId: prior?.orgId || 'default', workspaceId: prior?.workspaceId || null,
+                        createdAt: new Date(), isActive: true, apiCallCount: 0, lastUsedAt: null, ...patch
+                    } }, { upsert: true });
+            }
+            catch (error) {
+                if (error.code !== 11000)
+                    throw error;
+            }
+            // Re-read and validate the winner before applying lifecycle or returning a credential.
+        }
+        throw new Error('Subscription provisioning did not converge');
     }
     async getApiKeyByWorkspaceId(workspaceId, activeOnly = true) {
         if (!this.keysCollection)
@@ -866,6 +1029,63 @@ class FraimDbService {
     async upsertPersonaEntitlement(entitlement) {
         if (!this.personaEntitlementsCollection)
             throw new Error('DB not connected');
+        if (entitlement.hireMode === 'fulltime' && entitlement.stripeSubscriptionId && entitlement.purchaseSource !== 'manual') {
+            const identity = { workspaceId: entitlement.workspaceId, personaKey: entitlement.personaKey, hireMode: entitlement.hireMode };
+            for (let attempt = 0; attempt < 8; attempt++) {
+                const existing = await this.getPersonaEntitlement(identity.workspaceId, identity.personaKey, identity.hireMode);
+                if (existing && existing.stripeSubscriptionId !== entitlement.stripeSubscriptionId) {
+                    const incomingKey = await this.getApiKeyByStripeSubscriptionId(entitlement.stripeSubscriptionId);
+                    const existingKey = existing.stripeSubscriptionId
+                        ? await this.getApiKeyByStripeSubscriptionId(existing.stripeSubscriptionId) : null;
+                    const incomingCreated = incomingKey?.stripeSubscriptionCreatedAt?.getTime();
+                    const existingCreated = existingKey?.stripeSubscriptionCreatedAt?.getTime();
+                    // Cancellation affects its own subscription only. Credential
+                    // creation dates cannot order purchases: trials are reused.
+                    if (incomingKey?.stripeSubscriptionEndedAt || entitlement.status !== 'active')
+                        return existing;
+                    if (Number.isFinite(incomingCreated) && Number.isFinite(existingCreated)) {
+                        if (incomingCreated <= existingCreated)
+                            return existing;
+                    }
+                    else if (existingKey ? (0, current_license_1.hasUsableLicense)(existingKey)
+                        : existing.status === 'active' && (!existing.expiresAt || existing.expiresAt.getTime() > Date.now())) {
+                        // Unknown purchase chronology must not displace a valid
+                        // existing hire or an explicitly authorized manual grant.
+                        return existing;
+                    }
+                }
+                const now = new Date();
+                if (!existing) {
+                    try {
+                        const inserted = await this.personaEntitlementsCollection.updateOne(identity, {
+                            $setOnInsert: { ...entitlement, createdAt: now, updatedAt: now }
+                        }, { upsert: true });
+                        if (!inserted.upsertedCount)
+                            continue;
+                    }
+                    catch (error) {
+                        if (error.code === 11000)
+                            continue;
+                        throw error;
+                    }
+                }
+                else {
+                    const written = await this.personaEntitlementsCollection.updateOne({
+                        ...identity, stripeSubscriptionId: existing.stripeSubscriptionId || null,
+                        updatedAt: existing.updatedAt, status: existing.status, expiresAt: existing.expiresAt
+                    }, { $set: { ...entitlement, updatedAt: now,
+                            purchasedCount: (existing.purchasedCount || 0)
+                                + Number(existing.stripeSubscriptionId !== entitlement.stripeSubscriptionId)
+                        } });
+                    if (!written.matchedCount)
+                        continue;
+                }
+                const stored = await this.getPersonaEntitlement(identity.workspaceId, identity.personaKey, identity.hireMode);
+                if (stored)
+                    return stored;
+            }
+            throw new Error('Persona subscription ownership update did not converge');
+        }
         const now = new Date();
         await this.personaEntitlementsCollection.updateOne({
             workspaceId: entitlement.workspaceId,
@@ -894,7 +1114,8 @@ class FraimDbService {
             personaKey,
             hireMode: 'job',
             status: 'active',
-            jobCreditsRemaining: { $gt: 0 }
+            jobCreditsRemaining: { $gt: 0 },
+            $or: [{ expiresAt: null }, { expiresAt: { $gt: new Date() } }]
         }, {
             $inc: { jobCreditsRemaining: -1 },
             $set: { updatedAt: new Date() }
@@ -905,12 +1126,25 @@ class FraimDbService {
     async recordWebhookEvent(event) {
         if (!this.webhookEventsCollection)
             throw new Error('DB not connected');
+        const now = new Date();
         try {
-            await this.webhookEventsCollection.insertOne(event);
+            await this.webhookEventsCollection.insertOne({ ...event, processingStartedAt: now });
         }
         catch (error) {
             if (error.code === 11000) {
-                // Duplicate event ID - already processed
+                const reclaimed = await this.webhookEventsCollection.updateOne({
+                    eventId: event.eventId, processed: false,
+                    $or: [
+                        { lastError: { $type: 'string' } },
+                        { processingStartedAt: { $lt: new Date(now.getTime() - 5 * 60 * 1000) } },
+                        { processingStartedAt: { $exists: false } }
+                    ]
+                }, { $set: { lastError: null, processingStartedAt: now } });
+                if (reclaimed.matchedCount)
+                    return;
+                if (!await this.isWebhookEventProcessed(event.eventId)) {
+                    throw new Error('Webhook event is processing');
+                }
                 throw new Error('Webhook event already processed');
             }
             throw error;
@@ -928,7 +1162,9 @@ class FraimDbService {
         const result = await this.webhookEventsCollection.updateOne({ eventId }, {
             $set: {
                 processed: true,
-                processedAt: new Date()
+                processedAt: new Date(),
+                processingStartedAt: null,
+                lastError: null
             }
         });
         return result.matchedCount > 0;
@@ -938,7 +1174,8 @@ class FraimDbService {
             throw new Error('DB not connected');
         const result = await this.webhookEventsCollection.updateOne({ eventId }, {
             $set: {
-                lastError: error
+                lastError: error,
+                processingStartedAt: null
             },
             $inc: {
                 retryCount: 1

package/dist/src/fraim/license-presentation.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeLicenseLifecycle = serializeLicenseLifecycle;
+const current_license_1 = require("./current-license");
+function isoDate(value) {
+    if (!value)
+        return null;
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+/** Public billing metadata shared by account, session and manager responses. */
+function serializeLicenseLifecycle(key) {
+    if (key?.stripeSubscriptionId && key.billingReconciledAt) {
+        key = { ...key, ...(0, current_license_1.subscriptionAccessPatch)(key) };
+    }
+    const recurring = Boolean(key?.stripeSubscriptionId);
+    const effectiveExpiry = key ? (0, current_license_1.effectiveLicenseExpiry)(key) : null;
+    const expiryUnknown = recurring && effectiveExpiry?.getTime() === 0 && !key?.paidThrough && !key?.manualAccessOverride;
+    return {
+        status: key ? key.status ?? 'active' : null,
+        expiresAt: expiryUnknown ? null : isoDate(effectiveExpiry),
+        tier: key?.tier ?? null,
+        billingSource: recurring ? 'stripe' : key?.tier === 'trial' ? 'trial'
+            : key?.manualAccessOverride ? 'manual' : 'unverified',
+        paidThrough: isoDate(key?.paidThrough),
+        paidPeriodStart: isoDate(key?.paidPeriodStart),
+        subscriptionStatus: key?.subscriptionStatus ?? null,
+        paymentStatus: key?.paymentStatus ?? (recurring ? 'unverified' : null),
+        billingInterval: key?.billingInterval ?? null,
+        billingIntervalCount: key?.billingIntervalCount ?? null,
+        currentPeriodEnd: isoDate(key?.currentPeriodEnd),
+        cancelAt: isoDate(key?.cancelAt),
+        billingReconciledAt: isoDate(key?.billingReconciledAt),
+        manualAccessOverride: key?.manualAccessOverride ? {
+            until: key.manualAccessOverride.until === null ? null
+                : isoDate(key.manualAccessOverride.until) ?? 'unverified',
+            grantedAt: isoDate(key.manualAccessOverride.grantedAt),
+            reason: key.manualAccessOverride.reason,
+        } : null,
+    };
+}