nolo-cli 0.1.23 → 0.1.29

package/auth/server/revenueSplitPolicy.ts

@@ -0,0 +1,119 @@
+export type RevenueSplitPolicySource =
+  | "explicit"
+  | "token_pay_map"
+  | "platform_default"
+  | "legacy";
+
+export type RevenueSplitPolicyRef = {
+  policyId: string;
+  policyVersion: number;
+  source: RevenueSplitPolicySource;
+  label: string;
+};
+
+export type RevenueSplitPolicyInput = {
+  pay?: unknown;
+  revenueSplitPolicy?: unknown;
+  splitPolicy?: unknown;
+};
+
+export const PLATFORM_DEFAULT_SPLIT_POLICY: RevenueSplitPolicyRef = {
+  policyId: "platform-default",
+  policyVersion: 1,
+  source: "platform_default",
+  label: "Platform default",
+};
+
+export const TOKEN_PAY_MAP_SPLIT_POLICY: RevenueSplitPolicyRef = {
+  policyId: "token-pay-map",
+  policyVersion: 1,
+  source: "token_pay_map",
+  label: "Token pay map",
+};
+
+export const LEGACY_REVENUE_SPLIT_POLICY: RevenueSplitPolicyRef = {
+  policyId: "legacy-unversioned",
+  policyVersion: 0,
+  source: "legacy",
+  label: "Legacy unversioned",
+};
+
+const normalizeString = (value: unknown): string | null => {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+};
+
+const normalizePolicyVersion = (value: unknown): number | null => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    return null;
+  }
+  return Math.trunc(value);
+};
+
+const isObjectRecord = (value: unknown): value is Record<string, unknown> =>
+  !!value && typeof value === "object" && !Array.isArray(value);
+
+const normalizeExplicitPolicy = (value: unknown): RevenueSplitPolicyRef | null => {
+  if (!isObjectRecord(value)) return null;
+  const policyId = normalizeString(value.policyId) ?? normalizeString(value.id);
+  if (!policyId) return null;
+  const policyVersion =
+    normalizePolicyVersion(value.policyVersion) ??
+    normalizePolicyVersion(value.version) ??
+    1;
+  return {
+    policyId,
+    policyVersion,
+    source: "explicit",
+    label:
+      normalizeString(value.label) ??
+      normalizeString(value.name) ??
+      policyId,
+  };
+};
+
+const hasCreatorPay = (pay: unknown, platformUserId: string): boolean => {
+  if (!isObjectRecord(pay)) return false;
+  return Object.entries(pay).some(
+    ([userId, amount]) =>
+      userId !== platformUserId &&
+      typeof amount === "number" &&
+      Number.isFinite(amount) &&
+      amount > 0,
+  );
+};
+
+export function resolveRevenueSplitPolicy(
+  input: RevenueSplitPolicyInput,
+  platformUserId: string,
+): RevenueSplitPolicyRef {
+  const explicit =
+    normalizeExplicitPolicy(input.revenueSplitPolicy) ??
+    normalizeExplicitPolicy(input.splitPolicy);
+  if (explicit) return explicit;
+  if (hasCreatorPay(input.pay, platformUserId)) return TOKEN_PAY_MAP_SPLIT_POLICY;
+  return PLATFORM_DEFAULT_SPLIT_POLICY;
+}
+
+export function normalizeRevenueSplitPolicyRef(
+  value: unknown,
+): RevenueSplitPolicyRef {
+  if (!isObjectRecord(value)) return LEGACY_REVENUE_SPLIT_POLICY;
+  const policyId = normalizeString(value.policyId);
+  const policyVersion = normalizePolicyVersion(value.policyVersion);
+  const source = normalizeString(value.source) as RevenueSplitPolicySource | null;
+  const label = normalizeString(value.label);
+  if (!policyId || policyVersion === null || !source || !label) {
+    return LEGACY_REVENUE_SPLIT_POLICY;
+  }
+  if (
+    source !== "explicit" &&
+    source !== "token_pay_map" &&
+    source !== "platform_default" &&
+    source !== "legacy"
+  ) {
+    return LEGACY_REVENUE_SPLIT_POLICY;
+  }
+  return { policyId, policyVersion, source, label };
+}

package/auth/server/revokeSessions.ts

@@ -0,0 +1,59 @@
+import { verifyToken } from "../token";
+import { getNextSessionTokenVersion } from "../sessionTokenVersion";
+import serverDb from "../../database/server/db";
+import { DB_PREFIX } from "../../database/keys";
+
+import {
+  createErrorResponse,
+  createSuccessResponse,
+  handleOptionsRequest,
+} from "./shared";
+
+export async function handleRevokeSessions(req: any) {
+  if (req.method === "OPTIONS") {
+    return handleOptionsRequest();
+  }
+
+  if (req.method !== "POST") {
+    return createErrorResponse("Method not allowed", 405);
+  }
+
+  const authedUserId = req.user?.userId;
+  if (!authedUserId) {
+    return createErrorResponse("Unauthorized", 401);
+  }
+
+  const verificationToken = req.body?.verificationToken;
+  if (typeof verificationToken !== "string" || !verificationToken) {
+    return createErrorResponse("verificationToken is required", 400);
+  }
+
+  const userKey = `${DB_PREFIX.USER}${authedUserId}`;
+  const user = await serverDb.get(userKey);
+  if (!user?.publicKey) {
+    return createErrorResponse("User not found", 404);
+  }
+
+  let verificationPayload: any;
+  try {
+    verificationPayload = verifyToken(verificationToken, user.publicKey);
+  } catch {
+    return createErrorResponse("Current password verification failed", 403);
+  }
+
+  if (verificationPayload?.userId !== authedUserId) {
+    return createErrorResponse("Current password verification failed", 403);
+  }
+
+  const nextTokenVersion = getNextSessionTokenVersion(user);
+  await serverDb.put(userKey, {
+    ...user,
+    tokenVersion: nextTokenVersion,
+    tokenVersionUpdatedAt: Date.now(),
+  });
+
+  return createSuccessResponse({
+    success: true,
+    tokenVersion: nextTokenVersion,
+  });
+}

package/auth/server/route.ts

@@ -0,0 +1,195 @@
+// auth/server/route.ts
+import { authRoutes, RouteParams, createPathMatcher } from "../routes";
+import { handleLogin } from "./login";
+import {
+  handleCliLoginAuthorize,
+  handleCliLoginPoll,
+  handleCliLoginStart,
+} from "./cliLogin";
+import { handleSignUp } from "./signup";
+import { handleDeleteUser } from "./delete";
+import { handleListUsers } from "./listusers";
+import { handleGetUser } from "./getUser";
+import { handleRevokeSessions } from "./revokeSessions";
+import { handleTransferUser } from "./transfer";
+import { handleDisableUser } from "./disable";
+import { handleEnableUser } from "./enable";
+import { handleSendEmail } from "./sendEmail";
+import {
+  handleGetEmailPreferences,
+  handleUpdateEmailPreferences,
+} from "./emailPreferences";
+import {
+  handleGetEmailReport,
+  handleReplayFailedAutomationEmails,
+  handleRunEmailRetry,
+} from "./emailReport";
+import {
+  handleGetEmailRuntimeConfig,
+  handleUpdateEmailRuntimeConfig,
+} from "./emailRuntimeConfig";
+import { handleGetRechargeHistory } from "./getRechargeHistory";
+
+const routeHandlers = [
+  {
+    ...authRoutes.login,
+    match: (path: string) => path === authRoutes.login.path,
+    handler: (req) => handleLogin(req),
+  },
+  {
+    ...authRoutes.signup,
+    match: (path: string) => path === authRoutes.signup.path,
+    handler: (req) => handleSignUp(req),
+  },
+  {
+    ...authRoutes.users.list,
+    match: (path: string) => path === authRoutes.users.list.path,
+    handler: (req) => handleListUsers(req),
+  },
+  {
+    ...authRoutes.users.sessionRevoke,
+    match: (path: string) => path === authRoutes.users.sessionRevoke.path,
+    handler: (req) => handleRevokeSessions(req),
+  },
+  {
+    ...authRoutes.users.cliLoginStart,
+    match: (path: string) => path === authRoutes.users.cliLoginStart.path,
+    handler: (req) => handleCliLoginStart(req),
+  },
+  {
+    ...authRoutes.users.cliLoginAuthorize,
+    match: (path: string) => path === authRoutes.users.cliLoginAuthorize.path,
+    handler: (req) => handleCliLoginAuthorize(req),
+  },
+  {
+    ...authRoutes.users.cliLoginPoll,
+    match: (path: string) => path === authRoutes.users.cliLoginPoll.path,
+    handler: (req) => handleCliLoginPoll(req),
+  },
+  {
+    ...authRoutes.users.transfer,
+    match: (path: string) => {
+      const matcher = createPathMatcher(authRoutes.users.transfer.path);
+      const match = path.match(matcher);
+      return match ? { userId: match[1] } : false;
+    },
+    handler: (req, params: RouteParams) =>
+      handleTransferUser(req, params.userId!),
+  },
+  {
+    ...authRoutes.users.detail,
+    match: (path: string) => {
+      const matcher = createPathMatcher(authRoutes.users.detail.path);
+      const match = path.match(matcher);
+      const reservedUserIdPaths = new Set([
+        "users",
+        "send-email",
+        "email-preferences",
+        "email-report",
+        "email-retry",
+        "email-replay-failures",
+        "email-config",
+        "session-revoke",
+      ]);
+      return match && !reservedUserIdPaths.has(match[1]) ? { userId: match[1] } : false;
+    },
+    handler: (req, params: RouteParams) => handleGetUser(req, params.userId!),
+  },
+  {
+    ...authRoutes.users.delete,
+    match: (path: string) => {
+      const matcher = createPathMatcher(authRoutes.users.delete.path);
+      const match = path.match(matcher);
+      return match ? { userId: match[1] } : false;
+    },
+    handler: (req, params: RouteParams) =>
+      handleDeleteUser(req, params.userId!),
+  },
+  {
+    ...authRoutes.users.disable,
+    match: (path: string) => {
+      const matcher = createPathMatcher(authRoutes.users.disable.path);
+      const match = path.match(matcher);
+      return match ? { userId: match[1] } : false;
+    },
+    handler: (req, params: RouteParams) =>
+      handleDisableUser(req, params.userId!),
+  },
+  {
+    ...authRoutes.users.enable,
+    match: (path: string) => {
+      const matcher = createPathMatcher(authRoutes.users.enable.path);
+      const match = path.match(matcher);
+      return match ? { userId: match[1] } : false;
+    },
+    handler: (req, params: RouteParams) =>
+      handleEnableUser(req, params.userId!),
+  },
+  {
+    ...authRoutes.users.sendEmail,
+    match: (path: string) => path === authRoutes.users.sendEmail.path,
+    handler: (req) => handleSendEmail(req),
+  },
+  {
+    ...authRoutes.users.emailPreferencesGet,
+    match: (path: string) => path === authRoutes.users.emailPreferencesGet.path,
+    handler: (req) => handleGetEmailPreferences(req),
+  },
+  {
+    ...authRoutes.users.emailPreferencesUpdate,
+    match: (path: string) => path === authRoutes.users.emailPreferencesUpdate.path,
+    handler: (req) => handleUpdateEmailPreferences(req),
+  },
+  {
+    ...authRoutes.users.emailReport,
+    match: (path: string) => path === authRoutes.users.emailReport.path,
+    handler: (req) => handleGetEmailReport(req),
+  },
+  {
+    ...authRoutes.users.emailRetryRun,
+    match: (path: string) => path === authRoutes.users.emailRetryRun.path,
+    handler: (req) => handleRunEmailRetry(req),
+  },
+  {
+    ...authRoutes.users.emailReplayFailures,
+    match: (path: string) => path === authRoutes.users.emailReplayFailures.path,
+    handler: (req) => handleReplayFailedAutomationEmails(req),
+  },
+  {
+    ...authRoutes.users.emailConfigGet,
+    match: (path: string) => path === authRoutes.users.emailConfigGet.path,
+    handler: (req) => handleGetEmailRuntimeConfig(req),
+  },
+  {
+    ...authRoutes.users.emailConfigUpdate,
+    match: (path: string) => path === authRoutes.users.emailConfigUpdate.path,
+    handler: (req) => handleUpdateEmailRuntimeConfig(req),
+  },
+  {
+    ...authRoutes.users.rechargeHistory,
+    match: (path: string) => {
+      const matcher = createPathMatcher(authRoutes.users.rechargeHistory.path);
+      const match = path.match(matcher);
+      return match ? { userId: match[1] } : false;
+    },
+    handler: (req, params: RouteParams) =>
+      handleGetRechargeHistory(req, params),
+  },
+];
+
+export const authServerRoutes = (req: Request) => {
+  const { url, method } = req;
+  const pathname = new URL(url).pathname; // Corrected URL parsing
+
+  const route = routeHandlers.find((route) => {
+    const matchResult = route.match(pathname);
+    return matchResult && route.method === method;
+  });
+
+  if (route) {
+    const params = route.match(pathname);
+    return route.handler(req, params);
+  }
+
+  return new Response("Not Found", { status: 404 });
+};

package/auth/server/sendEmail.ts

@@ -0,0 +1,176 @@
+import { DB_PREFIX } from "../../database/keys";
+import serverDb from "../../database/server/db";
+import {
+  checkAdminPermission,
+  createErrorResponse,
+  createSuccessResponse,
+  handleOptionsRequest,
+  logger,
+} from "../../auth/server/shared";
+import { sendManagedEmailBatch } from "./emailDelivery";
+import { canSendEmailToUser } from "./emailPolicy";
+
+interface SendEmailRequest {
+  subject: string;
+  body: string;
+  isHtml?: boolean;
+  userIds?: string[]; // Optional: if provided, only send to these users
+  tag?: string;
+}
+
+const parseNumber = (value: string | undefined, fallback: number, min = 1) => {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.max(min, Math.floor(parsed));
+};
+
+const getBroadcastConfig = () => ({
+  batchSize: Math.min(100, parseNumber(process.env.EMAIL_BROADCAST_BATCH_SIZE, 20, 1)),
+  batchDelayMs: parseNumber(process.env.EMAIL_BROADCAST_BATCH_DELAY_MS, 500, 0),
+});
+
+const sleep = (ms: number) =>
+  ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+
+export async function handleSendEmail(req: Request) {
+  if (req.method === "OPTIONS") {
+    return handleOptionsRequest();
+  }
+
+  const user = (req as any).user;
+  if (!user?.userId) {
+    return createErrorResponse("Unauthorized", 401);
+  }
+
+  const permissionError = checkAdminPermission(user.userId);
+  if (permissionError) return permissionError;
+
+  try {
+    const broadcastConfig = getBroadcastConfig();
+    const { subject, body, isHtml, userIds, tag } = ((req as any).body ||
+      {}) as SendEmailRequest;
+
+    if (!subject || !body) {
+      return createErrorResponse("Subject and Body are required", 400);
+    }
+
+    const emailTag = tag?.trim() || "admin-broadcast";
+    const prefix = DB_PREFIX.USER;
+    const recipients: { email: string; id: string }[] = [];
+    const skippedRecipients: { id: string; reason: string }[] = [];
+    const now = Date.now();
+
+    if (userIds && userIds.length > 0) {
+      const uniqueIds = [...new Set(userIds.map((id: string) => id.trim()).filter(Boolean))];
+      for (const id of uniqueIds) {
+        try {
+          const userData = await serverDb.get(prefix + id);
+          const decision = canSendEmailToUser(userData, emailTag, now);
+          if (decision.allowed) {
+            recipients.push({ email: String(userData.email), id });
+          } else {
+            skippedRecipients.push({ id, reason: decision.reason || "policy" });
+          }
+        } catch (error) {
+          logger.warn({ id, error }, "Failed to fetch user for email");
+        }
+      }
+    } else {
+      const iter = serverDb.iterator({
+        gt: prefix,
+        lt: prefix + "\xFF",
+      });
+      try {
+        for await (const [key, value] of iter) {
+          const decision = canSendEmailToUser(value, emailTag, now);
+          if (decision.allowed) {
+            recipients.push({
+              email: String(value.email),
+              id: key.slice(prefix.length),
+            });
+          } else {
+            skippedRecipients.push({
+              id: key.slice(prefix.length),
+              reason: decision.reason || "policy",
+            });
+          }
+        }
+      } finally {
+        await iter.close();
+      }
+    }
+
+    if (recipients.length === 0) {
+      return createSuccessResponse({
+        message: "No eligible recipients found (all skipped by policy)",
+        sentCount: 0,
+        failedCount: 0,
+        skippedCount: skippedRecipients.length,
+        skipped: skippedRecipients.slice(0, 100),
+      });
+    }
+
+    const sentIds = [];
+    const errors = [];
+
+    for (let start = 0; start < recipients.length; start += broadcastConfig.batchSize) {
+      const batch = recipients.slice(start, start + broadcastConfig.batchSize);
+      const batchResults = await sendManagedEmailBatch(
+        batch.map((recipient) => ({
+          userId: recipient.id,
+          to: recipient.email,
+          subject,
+          textBody: isHtml ? undefined : body,
+          htmlBody: isHtml ? body : undefined,
+          tag: emailTag,
+        }))
+      );
+
+      const queuedIds: string[] = [];
+      batchResults.forEach((result, index) => {
+        const recipient = batch[index];
+        if (result.suppressed) {
+          skippedRecipients.push({ id: recipient.id, reason: "frozen" });
+          return;
+        }
+        if (result.success || result.queued) {
+          sentIds.push(recipient.id);
+          if (result.queued) {
+            queuedIds.push(recipient.id);
+          }
+          return;
+        }
+        logger.error(
+          { recipientId: recipient.id, email: recipient.email, error: result.error },
+          "Failed to send admin email"
+        );
+        errors.push({ id: recipient.id, error: result.error || "Failed to send email" });
+      });
+
+      if (queuedIds.length > 0) {
+        logger.warn(
+          { queuedCount: queuedIds.length, queuedIds: queuedIds.slice(0, 20), emailTag },
+          "Some broadcast emails queued for retry"
+        );
+      }
+
+      if (start + broadcastConfig.batchSize < recipients.length) {
+        await sleep(broadcastConfig.batchDelayMs);
+      }
+    }
+
+    return createSuccessResponse({
+      message: `Attempted ${recipients.length} eligible emails (skipped ${skippedRecipients.length})`,
+      sentCount: sentIds.length,
+      failedCount: errors.length,
+      skippedCount: skippedRecipients.length,
+      skipped: skippedRecipients.slice(0, 100),
+      batchSize: broadcastConfig.batchSize,
+      batchDelayMs: broadcastConfig.batchDelayMs,
+      errors: errors.length > 0 ? errors : undefined,
+    });
+  } catch (error: any) {
+    logger.error({ error }, "Error in handleSendEmail");
+    return createErrorResponse(error.message || "Internal server error");
+  }
+}

package/auth/server/shared.ts

@@ -0,0 +1,51 @@
+// auth/server/shared.ts
+import { isSystemAdmin } from "../../core/init";
+import pino from "pino";
+
+export const logger = pino({
+  // transport: {
+  //   target: "pino-pretty",
+  //   options: {
+  //     colorize: true,
+  //     translateTime: "SYS:standard",
+  //     ignore: "pid,hostname",
+  //     messageFormat: "{msg}",
+  //     levelFirst: true,
+  //   },
+  // },
+  level: process.env.NODE_ENV === "production" ? "info" : "debug",
+});
+
+export const CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+  "Content-Type": "application/json",
+};
+
+export function createErrorResponse(error: string, status: number = 500) {
+  logger.error({ error, status }, "Error response created");
+
+  return new Response(JSON.stringify({ error }), {
+    status,
+    headers: CORS_HEADERS,
+  });
+}
+
+export function createSuccessResponse(data: any, status: number = 200) {
+  return new Response(JSON.stringify(data), { status, headers: CORS_HEADERS });
+}
+
+export function handleOptionsRequest() {
+  return new Response(null, {
+    status: 204,
+    headers: CORS_HEADERS,
+  });
+}
+
+export function checkAdminPermission(actionUserId?: string | null) {
+  if (!isSystemAdmin(actionUserId)) {
+    return createErrorResponse("Unauthorized: Admin access required", 403);
+  }
+  return null;
+}