kasy-cli 1.2.1

package/templates/firebase/functions/src/llm_chat/index.ts

@@ -0,0 +1,181 @@
+/**
+ * Firebase Cloud Function: LLM Chat Proxy (streaming)
+ *
+ * Receives {message, history} from the Flutter app and streams the response
+ * back as Server-Sent Events (SSE). The API key never leaves the server.
+ *
+ * Secrets required (set via `firebase functions:secrets:set`):
+ *   - LLM_API_KEY: API key for OpenAI or Gemini
+ *
+ * Environment variables (set in functions/.env):
+ *   - LLM_PROVIDER: "openai" (default) or "gemini"
+ *   - LLM_SYSTEM_PROMPT: System prompt for the agent (optional)
+ *
+ * App dart-define:
+ *   - LLM_CHAT_ENDPOINT: URL of this function after deploy
+ *     Example: https://europe-west1-<project-id>.cloudfunctions.net/llmChat
+ *
+ * Deploy: kasy deploy  (or: firebase deploy --only functions:llmChat)
+ */
+
+import { onRequest } from "firebase-functions/v2/https";
+import { defineSecret } from "firebase-functions/params";
+import { getAuth } from "firebase-admin/auth";
+import type { Request, Response } from "express";
+
+const llmApiKey = defineSecret("LLM_API_KEY");
+
+interface ChatMessage {
+  role: "user" | "assistant";
+  content: string;
+}
+
+interface RequestBody {
+  message: string;
+  history?: ChatMessage[];
+}
+
+// Pipes the OpenAI SSE stream directly to the Express response.
+async function streamOpenAI(
+  res: Response,
+  apiKey: string,
+  systemPrompt: string,
+  message: string,
+  history: ChatMessage[]
+): Promise<void> {
+  const messages: { role: string; content: string }[] = [];
+  if (systemPrompt) messages.push({ role: "system", content: systemPrompt });
+  for (const m of history) messages.push(m);
+  messages.push({ role: "user", content: message });
+
+  const upstream = await fetch("https://api.openai.com/v1/chat/completions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ model: "gpt-4o-mini", messages, stream: true }),
+  });
+
+  if (!upstream.ok) {
+    throw new Error(`OpenAI ${upstream.status}: ${await upstream.text()}`);
+  }
+
+  const reader = upstream.body!.getReader();
+  res.on("close", () => reader.cancel());
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    res.write(value);
+  }
+}
+
+// Pipes the Gemini SSE stream directly to the Express response.
+async function streamGemini(
+  res: Response,
+  apiKey: string,
+  systemPrompt: string,
+  message: string,
+  history: ChatMessage[]
+): Promise<void> {
+  const contents = [
+    ...history.map((m) => ({
+      role: m.role === "assistant" ? "model" : "user",
+      parts: [{ text: m.content }],
+    })),
+    { role: "user", parts: [{ text: message }] },
+  ];
+
+  const body: Record<string, unknown> = { contents };
+  if (systemPrompt) {
+    body.systemInstruction = { parts: [{ text: systemPrompt }] };
+  }
+
+  // alt=sse makes Gemini return the same SSE format as OpenAI
+  const upstream = await fetch(
+    `https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:streamGenerateContent?key=${apiKey}&alt=sse`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    }
+  );
+
+  if (!upstream.ok) {
+    throw new Error(`Gemini ${upstream.status}: ${await upstream.text()}`);
+  }
+
+  const reader = upstream.body!.getReader();
+  res.on("close", () => reader.cancel());
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    res.write(value);
+  }
+}
+
+async function verifyFirebaseToken(req: Request, res: Response): Promise<string | null> {
+  const authHeader = req.headers.authorization ?? "";
+  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+  if (!token) {
+    res.status(401).json({ error: "Missing Authorization token" });
+    return null;
+  }
+  try {
+    const decoded = await getAuth().verifyIdToken(token);
+    return decoded.uid;
+  } catch {
+    res.status(401).json({ error: "Invalid or expired token" });
+    return null;
+  }
+}
+
+export const llmChat = onRequest(
+  { cors: true, secrets: [llmApiKey] },
+  async (req, res) => {
+    if (req.method !== "POST") {
+      res.status(405).json({ error: "Method not allowed" });
+      return;
+    }
+
+    const uid = await verifyFirebaseToken(req, res);
+    if (!uid) return;
+
+    const { message, history = [] }: RequestBody = req.body;
+    if (!message) {
+      res.status(400).json({ error: "Missing message" });
+      return;
+    }
+
+    const apiKey = llmApiKey.value();
+    if (!apiKey) {
+      res
+        .status(500)
+        .json({ error: "LLM_API_KEY not configured. Run: firebase functions:secrets:set LLM_API_KEY" });
+      return;
+    }
+
+    const provider = process.env.LLM_PROVIDER ?? "openai";
+    const systemPrompt = process.env.LLM_SYSTEM_PROMPT ?? "";
+
+    // SSE headers — must be set before any write
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("X-Accel-Buffering", "no"); // disable nginx proxy buffering
+    res.flushHeaders();
+
+    try {
+      if (provider === "gemini") {
+        await streamGemini(res, apiKey, systemPrompt, message, history);
+      } else {
+        await streamOpenAI(res, apiKey, systemPrompt, message, history);
+      }
+      res.end();
+    } catch (err) {
+      console.error("[llm-chat]", err);
+      // Send error as SSE event so the Flutter client can surface it
+      res.write(`data: ${JSON.stringify({ error: "LLM request failed" })}\n\n`);
+      res.end();
+    }
+  }
+);

package/templates/firebase/functions/src/notifications/admin_functions.ts

@@ -0,0 +1,91 @@
+import * as admin from "firebase-admin";
+import {onCall, HttpsError} from "firebase-functions/v2/https";
+import {NotificationEntity, NotificationTypes} from "../core/data/entities/notification_entity";
+import {notificationsRepository} from "../core/data/repositories/repositories";
+
+interface SendNotificationData {
+  title: string;
+  body: string;
+  imageUrl?: string;
+  route?: string;
+  targetEmails?: string[];
+  targetUserIds?: string[];
+  sendToAll?: boolean;
+}
+
+/**
+ * Callable function for the admin panel to send push notifications.
+ * Uses Admin SDK — bypasses Firestore security rules.
+ * Only authenticated users can call this; add custom claims check for stricter control.
+ */
+export const adminSendNotification = onCall(async (request) => {
+  if (!request.auth) {
+    throw new HttpsError("unauthenticated", "Login required.");
+  }
+
+  const data = request.data as SendNotificationData;
+  const {title, body, imageUrl, route, targetEmails, targetUserIds, sendToAll} = data;
+
+  if (!title || !body) {
+    throw new HttpsError("invalid-argument", "title and body are required.");
+  }
+
+  const entity = new NotificationEntity({
+    title,
+    body,
+    image_url: imageUrl ?? undefined,
+    type: NotificationTypes.OTHER,
+    creation_date: admin.firestore.Timestamp.now(),
+    notify_user: true,
+    data: route ? {route} : undefined,
+  });
+
+  if (sendToAll) {
+    // Use Auth listUsers (paginated, 1000/page) instead of a Firestore full scan.
+    // This avoids billing reads for every user doc and scales without timeout risk.
+    const userIds: string[] = [];
+    let pageToken: string | undefined;
+    do {
+      const result = await admin.auth().listUsers(1000, pageToken);
+      userIds.push(...result.users.map((u) => u.uid));
+      pageToken = result.pageToken;
+    } while (pageToken);
+    if (userIds.length > 0) {
+      await notificationsRepository.saveAll(userIds, entity);
+    }
+    return {sent: userIds.length};
+  }
+
+  // Resolve emails → userIds via Admin Auth (parallel)
+  const resolvedIds: string[] = [...(targetUserIds ?? [])];
+  const notFound: string[] = [];
+
+  const emailResults = await Promise.all(
+    (targetEmails ?? []).map(async (email) => {
+      try {
+        const userRecord = await admin.auth().getUserByEmail(email.trim());
+        return {uid: userRecord.uid, email: email.trim()};
+      } catch {
+        return {uid: null, email: email.trim()};
+      }
+    }),
+  );
+  for (const result of emailResults) {
+    if (result.uid) {
+      resolvedIds.push(result.uid);
+    } else {
+      notFound.push(result.email);
+    }
+  }
+
+  if (notFound.length > 0) {
+    throw new HttpsError("not-found", notFound.join(", "));
+  }
+
+  if (resolvedIds.length === 0) {
+    throw new HttpsError("invalid-argument", "Provide targetEmails, targetUserIds, or sendToAll.");
+  }
+
+  await notificationsRepository.saveAll(resolvedIds, entity);
+  return {sent: resolvedIds.length};
+});

package/templates/firebase/functions/src/notifications/models/notification.ts

@@ -0,0 +1,61 @@
+import {messaging} from "firebase-admin";
+import {NotificationType} from "../../core/data/entities/notification_entity";
+
+export type NotificationPayload = messaging.DataMessagePayload & NotificationType;
+
+export interface BasicNotificationParams {
+    title: string;
+    body: string;
+    type: NotificationType;
+}
+
+export interface SystemNotificationParams {
+    title: string;
+    body: string;
+    image_url?: string;
+    systemNotification: NotificationPayload;
+}
+
+export interface SystemOnlyNotificationParams {
+    systemNotification: NotificationPayload;
+}
+
+export type NotificationParams = BasicNotificationParams | SystemNotificationParams | SystemOnlyNotificationParams;
+
+
+function isNotificationParams(obj: unknown): obj is BasicNotificationParams {
+  if (obj !== null && typeof obj === "object") {
+    return "type" in obj;
+  }
+  return false;
+}
+
+function isSystemNotificationParams(obj: unknown): obj is SystemNotificationParams {
+  if (obj !== null && typeof obj === "object") {
+    return "systemNotification" in obj && "title" in obj;
+  }
+  return false;
+}
+
+function isSystemOnlyNotificationParams(obj: unknown): obj is SystemOnlyNotificationParams {
+  if (obj !== null && typeof obj === "object") {
+    return "systemNotification" in obj && !("title" in obj);
+  }
+  return false;
+}
+
+export function handleNotificationType(
+  params: BasicNotificationParams | SystemNotificationParams | SystemOnlyNotificationParams,
+  onBasicNotification?: (params: BasicNotificationParams) => void,
+  onSystemNotification?: (params: SystemNotificationParams) => void,
+  onSystemOnlyNotification?: (params: SystemOnlyNotificationParams) => void
+) {
+  if (isNotificationParams(params) && onBasicNotification) {
+    onBasicNotification(params);
+  } else if (isSystemNotificationParams(params) && onSystemNotification) {
+    onSystemNotification(params);
+  } else if (isSystemOnlyNotificationParams(params) && onSystemOnlyNotification) {
+    onSystemOnlyNotification(params);
+  }
+}
+

package/templates/firebase/functions/src/notifications/notifications_api.ts

@@ -0,0 +1,147 @@
+import * as admin from "firebase-admin";
+import {SystemNotificationParams} from "./models/notification";
+import {ApnsConfig, Message} from "firebase-admin/messaging";
+import {UserNotificationsRepository} from "../core/data/repositories/user_notifications_repository";
+import {NotificationEntity, NotificationTypes} from "../core/data/entities/notification_entity";
+import {notificationsRepository} from "../core/data/repositories/repositories";
+
+export class NotificationsApi {
+  constructor(
+        private messaging: admin.messaging.Messaging,
+        private userNotificationsRepository: UserNotificationsRepository,
+  ) {}
+
+  static create() {
+    return new NotificationsApi(
+      admin.messaging(),
+      notificationsRepository,
+    );
+  }
+
+  /**
+     * Creates a notification for the given users
+     * A document is added in the user's notifications collection
+     * This triggers a function that will call the sendSystemNotification function
+     *
+     * If you only want to send a system notification to the user,
+     * use the [sendSystemNotification] function
+     */
+  public async notify(
+    userIds: string[],
+    notificationParams: SystemNotificationParams,
+  ): Promise<void> {
+    let type = NotificationTypes.OTHER;
+    if (notificationParams.systemNotification) {
+      type = notificationParams.systemNotification.type;
+    }
+    await this.userNotificationsRepository.saveAll(
+      userIds,
+      new NotificationEntity({
+        title: notificationParams.title,
+        body: notificationParams.body,
+        image_url: notificationParams.image_url,
+        type: type,
+        creation_date: admin.firestore.Timestamp.now(),
+        notify_user: true,
+      })
+    );
+  }
+
+  /**
+     * Creates a notification for the given users
+     * A document is added in the user's notifications collection
+     * - This won't noty user with a system notification
+     *
+     * If you only want to send a system notification to the user,
+     * use the [sendSystemNotification] function
+     */
+  public async createNotificationOnly(
+    userIds: string[],
+    notificationParams: SystemNotificationParams,
+  ): Promise<void> {
+    for (const userId of userIds) {
+      await this.userNotificationsRepository.save(
+        userId,
+        new NotificationEntity({
+          title: notificationParams.title,
+          body: notificationParams.body,
+          type: notificationParams.systemNotification.type,
+          creation_date: admin.firestore.Timestamp.now(),
+          notify_user: false,
+        })
+      );
+    }
+  }
+
+
+  /**
+     * Sends a system notification to the given users (tokens)
+     * @param tokens
+     * @param notification
+     * @param data
+     * @param android
+     * @param apns
+     * @param webpush
+     */
+  async sendSystemNotification(
+    tokens: string[],
+    notification: admin.messaging.Notification,
+    data: { [key: string]: string } | null,
+    android: admin.messaging.AndroidConfig | null,
+    apns: admin.messaging.ApnsConfig | null,
+    webpush: admin.messaging.WebpushConfig | null
+  ) {
+    if (tokens.length === 0) {
+      return;
+    }
+    try {
+      if (tokens.length > 500) {
+        throw new Error("Too many tokens");
+      }
+      const messages = [];
+      for (const token of tokens) {
+        const msge = <Message>{
+          token: token,
+          data: data != null ? this.cleanNotStringData(data) : undefined,
+          notification: notification,
+          apns: <ApnsConfig>{
+            payload: {
+              aps: {
+                contentAvailable: true,
+              },
+            },
+          },
+        };
+        if (android) {
+          msge.android = android;
+        }
+        if (apns) {
+          msge.apns = apns;
+        }
+        if (webpush) {
+          msge.webpush = webpush;
+        }
+        messages.push(msge);
+      }
+      // Invalid/expired tokens are detected from the BatchResponse and removed by the caller.
+      // Rate limiting per user is enforced at the trigger level before this method is called.
+      return this.messaging.sendEach(messages);
+    } catch (err) {
+      throw new Error(`Error while sending notification: ${err}`);
+    }
+  }
+
+  private cleanNotStringData(
+    data: { [key: string]: string }
+  ): admin.messaging.DataMessagePayload {
+    for (const key of Object.keys(data)) {
+      if (typeof data[key] !== "string") {
+        delete data[key];
+      }
+    }
+    return data;
+  }
+}
+
+
+export const notificationsApi = NotificationsApi.create();

package/templates/firebase/functions/src/notifications/triggers.ts

@@ -0,0 +1,102 @@
+import {messaging} from "firebase-admin";
+import {NotificationsApi} from "./notifications_api";
+import {Logger} from "../core/logger/logger";
+import {NotificationEntity} from "../core/data/entities/notification_entity";
+import {userDevicesRepository} from "../core/data/repositories/repositories";
+import {onDocumentCreated} from "firebase-functions/v2/firestore";
+
+const kChannelId = "appfirebase";
+
+export const onNewNotificationRequest = onDocumentCreated(
+  "users/{userId}/notifications/{notificationId}",
+  async (event) => {
+    if (!event.data) {
+      return;
+    }
+    const logger = new Logger("onNewNotificationRequest");
+    try {
+      const notificationEntity = NotificationEntity.fromDocument(event.data);
+      const userId = event.params.userId;
+      if (!notificationEntity.notify_user) {
+        return;
+      }
+      // Do NOT set imageUrl on the cross-platform notification object.
+      // Setting notification.imageUrl makes FCM treat image delivery as
+      // "managed" for both platforms and can interfere with the iOS
+      // Notification Service Extension. Instead, specify per-platform:
+      // Android: android.notification.imageUrl
+      // iOS: apns.fcmOptions.imageUrl + apns.aps.mutableContent
+      const notification = <messaging.Notification>{
+        title: notificationEntity.title,
+        body: notificationEntity.body,
+      };
+      const data = <{ [key: string]: string }> {
+        type: notificationEntity.type,
+        title: notificationEntity.title,
+        body: notificationEntity.body,
+        ...(notificationEntity.image_url ? {imageUrl: notificationEntity.image_url} : {}),
+        ...notificationEntity.data,
+      };
+      const android = <messaging.AndroidConfig>{
+        notification: {
+          channelId: kChannelId,
+          ...(notificationEntity.image_url
+            ? {imageUrl: notificationEntity.image_url}
+            : {}),
+        },
+      };
+      const apns = <messaging.ApnsConfig>{
+        headers: {
+          "apns-push-type": "alert",
+          "apns-priority": "10",
+        },
+        payload: {
+          aps: {
+            sound: "default",
+            badge: 1,
+            ...(notificationEntity.image_url ? {mutableContent: true} : {}),
+          },
+        },
+        fcmOptions: notificationEntity.image_url
+          ? { imageUrl: notificationEntity.image_url }
+          : undefined,
+      };
+      const userDevices = await userDevicesRepository.getDevices([userId]);
+      const tokens = userDevices.map((userDevice) => userDevice.token);
+      if (tokens.length === 0) {
+        logger.info(`No device found for user ${userId}`);
+        return;
+      }
+      const notificationApi = NotificationsApi.create();
+      const notificationsResult = await notificationApi.sendSystemNotification(
+        tokens,
+        notification,
+        data,
+        android,
+        apns,
+        null
+      );
+
+      if (notificationsResult && notificationsResult.failureCount > 0) {
+        logger.error(`Error sending notification to user ${userId}: ${notificationsResult.failureCount} failed`);
+        for (let i = 0; i < notificationsResult.responses.length; i++) {
+          const response = notificationsResult.responses[i];
+          if (!response.success) {
+            const device = userDevices[i];
+            const errorCode = response.error?.code ?? "";
+            logger.error(`Failed token for user ${userId}, device ${device.id}: ${errorCode}`);
+            // Only remove tokens that are permanently invalid (app uninstalled or token revoked).
+            // Temporary errors (quota, server unavailable, internal) must NOT cause deletion.
+            const isPermanent =
+              errorCode === "messaging/registration-token-not-registered" ||
+              errorCode === "messaging/invalid-registration-token";
+            if (isPermanent && device.id) {
+              await userDevicesRepository.delete(userId, device.id);
+            }
+          }
+        }
+      }
+    } catch (e) {
+      logger.error(`Error onNewNotificationRequest users/${event.params.userId}/notifications/${event.id} : ${e}`);
+    }
+  });