notifkit 0.1.6 → 0.1.8

package/src/repositories/index.ts

@@ -1,4 +1,4 @@
-import { eq, and, sql as drizzleSql, inArray, desc } from "drizzle-orm";
+import { eq, and, or, sql as drizzleSql, inArray, desc } from "drizzle-orm";
 import type { Db } from "@/index.js";
 import type { Preferences, ContactChannel } from "@/contracts/index.js";
 import {
@@ -18,6 +18,7 @@ import {
   projectApiKeys,
   suppressions,
   messageLogs,
+  adminUsers,
 } from "@/db/schema.js";
 
 // ─── Domain types ───────────────────────────────────────────────────────────
@@ -1244,3 +1245,83 @@ export class SegmentRepository {
     return (rows as any[]).map((r) => r.segment);
   }
 }
+
+// ─── AdminUserRepository ───────────────────────────────────────────────────
+
+export interface AdminUserRecord {
+  id: string;
+  email: string;
+  username: string | null;
+  passwordHash: string;
+  role: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export class AdminUserRepository {
+  constructor(private readonly db: Db) {}
+
+  async findByEmailOrUsername(identifier: string): Promise<AdminUserRecord | null> {
+    const normalized = identifier.trim().toLowerCase();
+    const rows = await this.db
+      .select()
+      .from(adminUsers)
+      .where(or(eq(adminUsers.email, normalized), eq(adminUsers.username, identifier.trim())))
+      .limit(1);
+    return (rows[0] as AdminUserRecord) ?? null;
+  }
+
+  async findById(id: string): Promise<AdminUserRecord | null> {
+    const rows = await this.db.select().from(adminUsers).where(eq(adminUsers.id, id)).limit(1);
+    return (rows[0] as AdminUserRecord) ?? null;
+  }
+
+  async create(data: {
+    email: string;
+    username?: string | null;
+    passwordHash: string;
+    role?: string;
+  }): Promise<AdminUserRecord> {
+    const rows = await this.db
+      .insert(adminUsers)
+      .values({
+        email: data.email.trim().toLowerCase(),
+        username: data.username ? data.username.trim() : null,
+        passwordHash: data.passwordHash,
+        role: data.role || "admin",
+      })
+      .returning();
+    return rows[0] as AdminUserRecord;
+  }
+
+  async updatePassword(id: string, passwordHash: string): Promise<boolean> {
+    const rows = await this.db
+      .update(adminUsers)
+      .set({ passwordHash, updatedAt: new Date() })
+      .where(eq(adminUsers.id, id))
+      .returning();
+    return rows.length > 0;
+  }
+
+  async list(): Promise<Omit<AdminUserRecord, "passwordHash">[]> {
+    const rows = await this.db
+      .select({
+        id: adminUsers.id,
+        email: adminUsers.email,
+        username: adminUsers.username,
+        role: adminUsers.role,
+        createdAt: adminUsers.createdAt,
+        updatedAt: adminUsers.updatedAt,
+      })
+      .from(adminUsers)
+      .orderBy(adminUsers.createdAt);
+    return rows as Omit<AdminUserRecord, "passwordHash">[];
+  }
+
+  async count(): Promise<number> {
+    const rows = await this.db
+      .select({ count: drizzleSql<number>`count(*)::int` })
+      .from(adminUsers);
+    return rows[0]?.count ?? 0;
+  }
+}

package/src/services/api/admin-static.ts

@@ -0,0 +1,224 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { resolve, extname, join } from "node:path";
+import { existsSync, statSync, createReadStream } from "node:fs";
+import { request as httpRequest } from "node:http";
+
+const MIME_TYPES: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".webp": "image/webp",
+  ".txt": "text/plain; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+};
+
+// Possible output directories where built dashboard static files might reside
+const POSSIBLE_DASHBOARD_DIRS = [
+  resolve(process.cwd(), "dashboard", "dist"),
+  resolve(process.cwd(), "dashboard", "out"),
+  resolve(process.cwd(), "dist", "admin"),
+  resolve(process.cwd(), "dist", "dashboard"),
+];
+
+function getDashboardDir(): string | null {
+  for (const dir of POSSIBLE_DASHBOARD_DIRS) {
+    if (existsSync(dir) && existsSync(join(dir, "index.html"))) {
+      return dir;
+    }
+  }
+  return null;
+}
+
+/**
+ * Proxies request to frontend dev server if running.
+ */
+function proxyToDevServer(
+  req: IncomingMessage,
+  res: ServerResponse,
+  targetHost: string,
+  targetPort: number,
+): Promise<boolean> {
+  return new Promise((resolvePromise) => {
+    const proxyReq = httpRequest(
+      {
+        host: targetHost,
+        port: targetPort,
+        path: req.url,
+        method: req.method,
+        headers: req.headers,
+      },
+      (proxyRes) => {
+        res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+        proxyRes.pipe(res);
+        resolvePromise(true);
+      },
+    );
+
+    proxyReq.on("error", () => {
+      resolvePromise(false);
+    });
+
+    if (req.readable) {
+      req.pipe(proxyReq);
+    } else {
+      proxyReq.end();
+    }
+  });
+}
+
+/**
+ * Handles incoming HTTP requests for `/admin` and `/admin/*`.
+ * Serves static exported assets from Vite SPA build with index.html fallback,
+ * or proxies to Vite dev server if running in development mode.
+ */
+export async function handleAdminRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  url: URL,
+): Promise<boolean> {
+  if (url.pathname !== "/admin" && !url.pathname.startsWith("/admin/")) {
+    return false;
+  }
+
+  // Redirect /admin to /admin/
+  if (url.pathname === "/admin") {
+    res.writeHead(301, { Location: "/admin/" + (url.search || "") });
+    res.end();
+    return true;
+  }
+
+  // In development, attempt to proxy to local Vite dev server on port 5173 (or VITE_DEV_URL) if active
+  if (process.env.NODE_ENV !== "production") {
+    const devProxyUrl =
+      process.env.VITE_DEV_URL || process.env.ADMIN_DEV_URL || process.env.NEXT_DEV_URL;
+    const targetPort = devProxyUrl ? parseInt(new URL(devProxyUrl).port, 10) : 5173;
+    const targetHost = devProxyUrl ? new URL(devProxyUrl).hostname : "127.0.0.1";
+
+    const proxied = await proxyToDevServer(req, res, targetHost, targetPort);
+    if (proxied) {
+      return true;
+    }
+  }
+
+  const dashboardDir = getDashboardDir();
+  if (!dashboardDir) {
+    // If dashboard build not found, return friendly message
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(`
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+        <meta charset="utf-8">
+        <title>Notifkit Admin Dashboard</title>
+        <style>
+          body { font-family: system-ui, -apple-system, sans-serif; background: #09090b; color: #f4f4f5; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
+          .card { background: #18181b; border: 1px solid #27272a; padding: 2rem; border-radius: 0.75rem; max-width: 500px; text-align: center; }
+          h1 { margin-top: 0; color: #fafafa; }
+          code { background: #27272a; padding: 0.2rem 0.4rem; border-radius: 0.25rem; font-family: monospace; font-size: 0.9em; }
+        </style>
+      </head>
+      <body>
+        <div class="card">
+          <h1>Notifkit Admin Dashboard</h1>
+          <p>The dashboard static bundle has not been built yet.</p>
+          <p>Please build it by running:</p>
+          <p><code>npm run build:dashboard</code></p>
+          <p>or run the dev server with <code>npm --prefix dashboard run dev</code>.</p>
+        </div>
+      </body>
+      </html>
+    `);
+    return true;
+  }
+
+  // Strip /admin prefix to find relative path inside dashboardDir
+  let subPath = url.pathname.slice("/admin".length);
+  if (subPath.startsWith("/")) {
+    subPath = subPath.slice(1);
+  }
+  if (!subPath) {
+    subPath = "index.html";
+  }
+
+  const normalizedSubPath = subPath.replace(/\/$/, "");
+  let filePath = resolve(dashboardDir, subPath);
+
+  // Security check: ensure filePath is inside dashboardDir
+  if (!filePath.startsWith(dashboardDir)) {
+    res.writeHead(403, { "Content-Type": "text/plain" });
+    res.end("Forbidden");
+    return true;
+  }
+
+  // Check direct file
+  let stat: ReturnType<typeof statSync> | null = null;
+  if (existsSync(filePath)) {
+    stat = statSync(filePath);
+    if (stat.isDirectory()) {
+      filePath = join(filePath, "index.html");
+      stat = existsSync(filePath) ? statSync(filePath) : null;
+    }
+  }
+
+  // Check path.html if direct file not found
+  if (!stat) {
+    const htmlPath = resolve(dashboardDir, `${normalizedSubPath}.html`);
+    if (existsSync(htmlPath)) {
+      filePath = htmlPath;
+      stat = statSync(filePath);
+    }
+  }
+
+  // Check path/index.html
+  if (!stat) {
+    const dirIndexPath = resolve(dashboardDir, normalizedSubPath, "index.html");
+    if (existsSync(dirIndexPath)) {
+      filePath = dirIndexPath;
+      stat = statSync(filePath);
+    }
+  }
+
+  // Fallback to index.html for SPA client-side routing
+  if (!stat) {
+    filePath = resolve(dashboardDir, "index.html");
+    if (existsSync(filePath)) {
+      stat = statSync(filePath);
+    }
+  }
+
+  if (!stat) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not Found");
+    return true;
+  }
+
+  const ext = extname(filePath).toLowerCase();
+  const contentType = MIME_TYPES[ext] || "application/octet-stream";
+
+  // Cache static assets (_next/static) aggressively (immutable, 1 year), HTML files no-cache
+  const isImmutable = filePath.includes("_next") || ext === ".js" || ext === ".css";
+  const cacheControl = isImmutable
+    ? "public, max-age=31536000, immutable"
+    : "public, max-age=0, must-revalidate";
+
+  res.writeHead(200, {
+    "Content-Type": contentType,
+    "Content-Length": stat.size,
+    "Cache-Control": cacheControl,
+  });
+
+  const stream = createReadStream(filePath);
+  stream.pipe(res);
+  return true;
+}

package/src/services/api/handlers.ts

@@ -10,15 +10,24 @@ import type {
   ProjectRepository,
   WorkflowRepository,
   SegmentRepository,
+  AdminUserRepository,
 } from "@/repositories/index.js";
+import {
+  verifyPassword,
+  createAdminSession,
+  revokeAdminSession,
+  getAdminSession,
+} from "@/services/auth/index.js";
 import type { Preferences } from "@/contracts/index.js";
 import {
   AddUserSchema,
   UpdateUserSchema,
-  AddContactSchema,
+  BatchAddContactsSchema,
+  type UserContactInput,
   SyncTemplatesSchema,
   NotifyRequestSchema,
   ContactChannelSchema,
+  type ContactChannel,
   PreferencesSchema,
   type NotificationRequestedPayload,
   type NotificationTarget,
@@ -61,6 +70,7 @@ export interface Deps {
   projectRepo: ProjectRepository;
   workflowRepo: WorkflowRepository;
   segmentRepo: SegmentRepository;
+  adminUserRepo?: AdminUserRepository;
   db: Db;
 }
 
@@ -69,6 +79,7 @@ interface InlineUserLike {
   id: string;
   language?: string;
   timezone?: string;
+  contacts?: UserContactInput[];
   email?: string[];
   phone?: string[];
   pushToken?: string[];
@@ -76,25 +87,66 @@ interface InlineUserLike {
   preferences?: Preferences;
 }
 
-/** Map an inline user's contact arrays into (channel, target) pairs. */
-function contactsOf(user: InlineUserLike): { channel: "email" | "sms" | "push"; target: string }[] {
-  return [
-    ...(user.email ?? []).map((target) => ({ channel: "email" as const, target })),
-    ...(user.phone ?? []).map((target) => ({ channel: "sms" as const, target })),
-    ...(user.pushToken ?? []).map((target) => ({ channel: "push" as const, target })),
-  ];
+interface ResolvedContact {
+  channel: ContactChannel;
+  target: string;
+  label?: string;
+  isPrimary?: boolean;
+  enabled?: boolean;
+  preferences?: Preferences;
+}
+
+/** Map an inline or user input's contacts and legacy arrays into resolved contact records. */
+function contactsOf(user: InlineUserLike): ResolvedContact[] {
+  const list: ResolvedContact[] = [];
+
+  if (user.contacts && Array.isArray(user.contacts)) {
+    for (const c of user.contacts) {
+      list.push({
+        channel: c.channel,
+        target: c.target,
+        label: c.label,
+        isPrimary: c.isPrimary,
+        enabled: c.enabled,
+        preferences: c.preferences,
+      });
+    }
+  }
+
+  if (user.email) {
+    for (const target of user.email) {
+      list.push({ channel: "email", target });
+    }
+  }
+  if (user.phone) {
+    for (const target of user.phone) {
+      list.push({ channel: "sms", target });
+    }
+  }
+  if (user.pushToken) {
+    for (const target of user.pushToken) {
+      list.push({ channel: "push", target });
+    }
+  }
+
+  return list;
 }
 
 /** Persist user records + their contacts in bulk. Shared by addUser and inline notify. */
 async function persistUsers(deps: Deps, users: InlineUserLike[], projectId: string): Promise<void> {
-  const usersList = users.map((u) => ({
-    userId: u.id,
-    language: u.language ?? "en",
-    timezone: u.timezone ?? "UTC",
-    email: u.email?.[0] ?? null,
-    segments: u.segments ?? [],
-    preferences: u.preferences ?? {},
-  }));
+  const usersList = users.map((u) => {
+    const primaryEmail =
+      u.email?.[0] ?? u.contacts?.find((c) => c.channel === "email")?.target ?? null;
+
+    return {
+      userId: u.id,
+      language: u.language ?? "en",
+      timezone: u.timezone ?? "UTC",
+      email: primaryEmail,
+      segments: u.segments ?? [],
+      preferences: u.preferences ?? {},
+    };
+  });
 
   const contactsList: any[] = [];
   for (const u of users) {
@@ -103,7 +155,7 @@ async function persistUsers(deps: Deps, users: InlineUserLike[], projectId: stri
         userId: u.id,
         channel: c.channel,
         target: c.target,
-        preferences: {},
+        preferences: c.preferences ?? {},
       });
     }
   }
@@ -190,7 +242,7 @@ export function createHandlers(deps: Deps) {
     const updated = await deps.userRepo.updatePartial(ctx.projectId!, userId, {
       language: patch.language,
       timezone: patch.timezone,
-      email: patch.email?.[0],
+      email: patch.email?.[0] ?? patch.contacts?.find((c) => c.channel === "email")?.target,
       segments: patch.segments,
       preferences: patch.preferences,
     });
@@ -198,7 +250,11 @@ export function createHandlers(deps: Deps) {
 
     // New contact values in the patch are added (existing ones are kept).
     for (const c of contactsOf({ id: userId, ...patch })) {
-      await deps.contactRepo.upsert(ctx.projectId!, userId, c.channel, c.target);
+      if (c.preferences) {
+        await deps.contactRepo.upsert(ctx.projectId!, userId, c.channel, c.target, c.preferences);
+      } else {
+        await deps.contactRepo.upsert(ctx.projectId!, userId, c.channel, c.target);
+      }
     }
     logger.info({ userId }, "user updated");
     sendJson(res, 200, { id: userId });
@@ -217,28 +273,44 @@ export function createHandlers(deps: Deps) {
     sendNoContent(res);
   }
 
-  // ── POST /v1/users/:id/contacts — addUserContact ──────────────────────────
+  // ── POST /v1/users/:id/contacts — addUserContact / batch contacts ─────────
   async function addContact(
     req: IncomingMessage,
     res: ServerResponse,
     ctx: RouteContext,
   ): Promise<void> {
     const userId = ctx.params.id!;
-    const parsed = AddContactSchema.safeParse(await readJsonBody(req));
+    const body = await readJsonBody(req);
+    const parsed = BatchAddContactsSchema.safeParse(body);
     if (!parsed.success) return sendValidationError(res, parsed.error);
 
     const user = await deps.userRepo.findById(ctx.projectId!, userId);
     if (!user) return sendJson(res, 404, { error: "user_not_found", id: userId });
 
-    await deps.contactRepo.upsert(
-      ctx.projectId!,
-      userId,
-      parsed.data.channel,
-      parsed.data.target,
-      parsed.data.preferences ?? {},
-    );
-    logger.info({ userId, channel: parsed.data.channel }, "contact added");
-    sendJson(res, 201, { userId, channel: parsed.data.channel, target: parsed.data.target });
+    if (Array.isArray(parsed.data)) {
+      const contactsList = parsed.data.map((c) => ({
+        userId,
+        channel: c.channel,
+        target: c.target,
+        preferences: c.preferences ?? {},
+      }));
+      await deps.contactRepo.upsertMany(ctx.projectId!, contactsList);
+      logger.info({ userId, count: contactsList.length }, "contacts batch added");
+      sendJson(res, 201, {
+        userId,
+        contacts: contactsList.map((c) => ({ channel: c.channel, target: c.target })),
+      });
+    } else {
+      await deps.contactRepo.upsert(
+        ctx.projectId!,
+        userId,
+        parsed.data.channel,
+        parsed.data.target,
+        parsed.data.preferences ?? {},
+      );
+      logger.info({ userId, channel: parsed.data.channel }, "contact added");
+      sendJson(res, 201, { userId, channel: parsed.data.channel, target: parsed.data.target });
+    }
   }
 
   // ── DELETE /v1/users/:id/contacts/:channel/:target — deleteUserContact ────
@@ -1043,19 +1115,35 @@ export function createHandlers(deps: Deps) {
       }
     }
 
-    // Scoped to the caller's project: an unscoped count reports every tenant's
-    // traffic to whoever asks.
-    const totalTasksRes = await deps.db
-      .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
-      .from(messageLogs)
-      .where(eq(messageLogs.projectId, ctx.projectId!));
-    const deliveredTasksRes = await deps.db
-      .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
-      .from(messageLogs)
-      .where(and(eq(messageLogs.projectId, ctx.projectId!), eq(messageLogs.status, "delivered")));
+    // Scoped to the caller's project if provided, otherwise aggregate across all projects
+    let total = 0;
+    let delivered = 0;
+
+    if (ctx.projectId) {
+      const totalTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs)
+        .where(eq(messageLogs.projectId, ctx.projectId));
+      const deliveredTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs)
+        .where(and(eq(messageLogs.projectId, ctx.projectId), eq(messageLogs.status, "delivered")));
+
+      total = Number(totalTasksRes[0]?.count ?? 0);
+      delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+    } else {
+      const totalTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs);
+      const deliveredTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs)
+        .where(eq(messageLogs.status, "delivered"));
+
+      total = Number(totalTasksRes[0]?.count ?? 0);
+      delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+    }
 
-    const total = Number(totalTasksRes[0]?.count ?? 0);
-    const delivered = Number(deliveredTasksRes[0]?.count ?? 0);
     const failed = streamDepths.DEAD_LETTER || 0;
     const successRate = total > 0 ? Number(((delivered / total) * 100).toFixed(2)) : 100;
 
@@ -1683,7 +1771,100 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
     sendNoContent(res);
   }
 
+  // ── POST /v1/auth/login — login ───────────────────────────────────────────
+  async function login(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    if (!deps.adminUserRepo) {
+      sendJson(res, 500, {
+        error: "internal_error",
+        message: "Admin user repository not initialized",
+      });
+      return;
+    }
+
+    const body = await readJsonBody(req);
+    const parsed = z
+      .object({
+        identifier: z.string().min(1, "Identifier (email or username) is required"),
+        password: z.string().min(1, "Password is required"),
+      })
+      .safeParse(body);
+
+    if (!parsed.success) {
+      sendValidationError(res, parsed.error);
+      return;
+    }
+
+    const { identifier, password } = parsed.data;
+    const user = await deps.adminUserRepo.findByEmailOrUsername(identifier);
+    if (!user) {
+      sendJson(res, 401, { error: "unauthorized", message: "Invalid credentials" });
+      return;
+    }
+
+    const isValid = await verifyPassword(password, user.passwordHash);
+    if (!isValid) {
+      sendJson(res, 401, { error: "unauthorized", message: "Invalid credentials" });
+      return;
+    }
+
+    const session = await createAdminSession(deps.redis.native, user);
+    sendJson(res, 200, {
+      token: session.token,
+      user: {
+        id: user.id,
+        email: user.email,
+        username: user.username,
+        role: user.role,
+      },
+      expiresAt: session.expiresAt,
+    });
+  }
+
+  // ── POST /v1/auth/logout — logout ─────────────────────────────────────────
+  async function logout(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const authHeader = req.headers["authorization"];
+    let token: string | undefined;
+    if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) {
+      token = authHeader.slice(7).trim();
+    }
+    if (token) {
+      await revokeAdminSession(deps.redis.native, token);
+    }
+    sendJson(res, 200, { message: "Logged out successfully" });
+  }
+
+  // ── GET /v1/auth/me — getMe ───────────────────────────────────────────────
+  async function getMe(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const authHeader = req.headers["authorization"];
+    let token: string | undefined;
+    if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) {
+      token = authHeader.slice(7).trim();
+    }
+    if (!token) {
+      sendJson(res, 401, { error: "unauthorized", message: "Missing token" });
+      return;
+    }
+
+    const session = await getAdminSession(deps.redis.native, token);
+    if (!session) {
+      sendJson(res, 401, { error: "unauthorized", message: "Invalid or expired session" });
+      return;
+    }
+
+    sendJson(res, 200, {
+      user: {
+        id: session.adminId,
+        email: session.email,
+        username: session.username,
+        role: session.role,
+      },
+    });
+  }
+
   return {
+    login,
+    logout,
+    getMe,
     syncTemplates,
     addUser,
     updateUser,