notifkit 0.1.7 → 0.1.9

package/src/services/api/handlers.ts

@@ -10,7 +10,15 @@ import type {
   ProjectRepository,
   WorkflowRepository,
   SegmentRepository,
+  AdminUserRepository,
 } from "@/repositories/index.js";
+import {
+  verifyPassword,
+  createAdminSession,
+  revokeAdminSession,
+  getAdminSession,
+  DUMMY_PASSWORD_HASH,
+} from "@/services/auth/index.js";
 import type { Preferences } from "@/contracts/index.js";
 import {
   AddUserSchema,
@@ -34,7 +42,7 @@ import { readJsonBody, sendJson, sendNoContent, sendValidationError } from "./ht
 import type { RouteContext } from "./router.js";
 import { globalEmitter, getPriorityBucket, normaliseTarget } from "@/shared/index.js";
 import { metrics } from "@/metrics/index.js";
-import { eq, desc, and, lt, lte, gte, sql, like, or, isNotNull } from "drizzle-orm";
+import { eq, desc, and, lt, lte, gte, sql, like, or, isNotNull, inArray } from "drizzle-orm";
 import {
   messageLogs,
   workflowDefinitions,
@@ -42,6 +50,7 @@ import {
   suppressions,
   users as dbUsers,
   userTopicPreferences,
+  deliveryOutbox,
 } from "@/db/schema.js";
 import { readBaseConfig } from "@/config/index.js";
 import { verifyUnsubscribeToken } from "@/unsubscribe/index.js";
@@ -63,6 +72,7 @@ export interface Deps {
   projectRepo: ProjectRepository;
   workflowRepo: WorkflowRepository;
   segmentRepo: SegmentRepository;
+  adminUserRepo?: AdminUserRepository;
   db: Db;
 }
 
@@ -1098,29 +1108,49 @@ export function createHandlers(deps: Deps) {
     };
 
     const streamDepths: Record<string, number> = {};
-    for (const [key, realRedisKey] of Object.entries(streamMap)) {
-      try {
-        const len = await deps.redis.native.xlen(realRedisKey);
-        streamDepths[key] = len;
-      } catch {
-        streamDepths[key] = 0;
+    if (ctx.isAdmin !== false) {
+      for (const [key, realRedisKey] of Object.entries(streamMap)) {
+        try {
+          const len = await deps.redis.native.xlen(realRedisKey);
+          streamDepths[key] = len;
+        } catch {
+          streamDepths[key] = 0;
+        }
       }
     }
 
-    // Scoped to the caller's project: an unscoped count reports every tenant's
-    // traffic to whoever asks.
-    const totalTasksRes = await deps.db
-      .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
-      .from(messageLogs)
-      .where(eq(messageLogs.projectId, ctx.projectId!));
-    const deliveredTasksRes = await deps.db
-      .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
-      .from(messageLogs)
-      .where(and(eq(messageLogs.projectId, ctx.projectId!), eq(messageLogs.status, "delivered")));
+    // Scoped to the caller's project if provided, otherwise aggregate across all projects
+    let total = 0;
+    let delivered = 0;
+
+    if (ctx.projectId) {
+      const totalTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs)
+        .where(eq(messageLogs.projectId, ctx.projectId));
+      const deliveredTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs)
+        .where(and(eq(messageLogs.projectId, ctx.projectId), eq(messageLogs.status, "delivered")));
+
+      total = Number(totalTasksRes[0]?.count ?? 0);
+      delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+    } else {
+      const totalTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs);
+      const deliveredTasksRes = await deps.db
+        .select({ count: sql<number>`count(distinct ${messageLogs.taskId})` })
+        .from(messageLogs)
+        .where(eq(messageLogs.status, "delivered"));
+
+      total = Number(totalTasksRes[0]?.count ?? 0);
+      delivered = Number(deliveredTasksRes[0]?.count ?? 0);
+    }
 
-    const total = Number(totalTasksRes[0]?.count ?? 0);
-    const delivered = Number(deliveredTasksRes[0]?.count ?? 0);
-    const failed = streamDepths.DEAD_LETTER || 0;
+    // Project-scoped calls compute failure against their own task count;
+    // cluster-wide administrative calls read the global dead letter queue length.
+    const failed = ctx.projectId ? Math.max(0, total - delivered) : streamDepths.DEAD_LETTER || 0;
     const successRate = total > 0 ? Number(((delivered / total) * 100).toFixed(2)) : 100;
 
     sendJson(res, 200, {
@@ -1138,7 +1168,7 @@ export function createHandlers(deps: Deps) {
   async function getDLQMessages(
     _req: IncomingMessage,
     res: ServerResponse,
-    _ctx: RouteContext,
+    ctx: RouteContext,
   ): Promise<void> {
     try {
       const rawEntries = await deps.redis.native.xrevrange(
@@ -1146,22 +1176,38 @@ export function createHandlers(deps: Deps) {
         "+",
         "-",
         "COUNT",
-        "50",
+        "100",
       );
-      const messages = (rawEntries || []).map(([id, fields]: [string, string[]]) => {
+      const allMessages = (rawEntries || []).map(([id, fields]: [string, string[]]) => {
         const fieldMap: Record<string, string> = {};
         for (let i = 0; i < fields.length; i += 2) {
           fieldMap[fields[i]!] = fields[i + 1]!;
         }
+        let payload: any = fieldMap;
+        if (fieldMap.payload) {
+          try {
+            payload = JSON.parse(fieldMap.payload);
+          } catch {
+            payload = fieldMap.payload;
+          }
+        }
         return {
           id,
           eventType: fieldMap.eventType || fieldMap.event_type || "unknown",
-          payload: fieldMap.payload ? JSON.parse(fieldMap.payload) : fieldMap,
+          payload,
           error: fieldMap.error || fieldMap.reason || "Dead letter payload",
           timestamp: fieldMap.timestamp || new Date().toISOString(),
         };
       });
-      sendJson(res, 200, { messages });
+
+      const messages = ctx.projectId
+        ? allMessages.filter((m) => {
+            const pId = m.payload?.projectId ?? m.payload?.project_id ?? (m as any).projectId;
+            return pId === ctx.projectId;
+          })
+        : allMessages;
+
+      sendJson(res, 200, { messages: messages.slice(0, 50) });
     } catch {
       sendJson(res, 200, { messages: [] });
     }
@@ -1171,7 +1217,7 @@ export function createHandlers(deps: Deps) {
   async function replayDLQMessage(
     req: IncomingMessage,
     res: ServerResponse,
-    _ctx: RouteContext,
+    ctx: RouteContext,
   ): Promise<void> {
     const body = (await readJsonBody(req).catch(() => ({}))) as any;
     const messageId = body?.id;
@@ -1194,6 +1240,21 @@ export function createHandlers(deps: Deps) {
         fieldMap[fields[i]!] = fields[i + 1]!;
       }
 
+      let payload: any = null;
+      if (fieldMap.payload) {
+        try {
+          payload = JSON.parse(fieldMap.payload);
+        } catch {}
+      }
+
+      if (ctx.projectId) {
+        const pId = payload?.projectId ?? payload?.project_id ?? (fieldMap as any).projectId;
+        if (pId !== ctx.projectId) {
+          sendJson(res, 404, { error: "dlq_message_not_found" });
+          return;
+        }
+      }
+
       const priority = fieldMap.priority || "normal";
       const p = getPriorityBucket(priority);
       const targetStream =
@@ -1222,6 +1283,34 @@ export function createHandlers(deps: Deps) {
     if (!messageId) return sendJson(res, 400, { error: "missing_id" });
 
     try {
+      if (ctx.projectId) {
+        const rawEntries = await deps.redis.native.xrange(
+          STREAMS.DEAD_LETTER,
+          messageId,
+          messageId,
+        );
+        if (!rawEntries || rawEntries.length === 0 || !rawEntries[0]) {
+          sendJson(res, 404, { error: "dlq_message_not_found" });
+          return;
+        }
+        const fields = rawEntries[0][1];
+        const fieldMap: Record<string, string> = {};
+        for (let i = 0; i < fields.length; i += 2) {
+          fieldMap[fields[i]!] = fields[i + 1]!;
+        }
+        let payload: any = null;
+        if (fieldMap.payload) {
+          try {
+            payload = JSON.parse(fieldMap.payload);
+          } catch {}
+        }
+        const pId = payload?.projectId ?? payload?.project_id ?? (fieldMap as any).projectId;
+        if (pId !== ctx.projectId) {
+          sendJson(res, 404, { error: "dlq_message_not_found" });
+          return;
+        }
+      }
+
       await deps.redis.native.xdel(STREAMS.DEAD_LETTER, messageId);
       sendJson(res, 200, { success: true });
     } catch (err: any) {
@@ -1274,12 +1363,25 @@ export function createHandlers(deps: Deps) {
     if (!user) return sendJson(res, 404, { error: "user_not_found", id: userId });
 
     const contacts = await deps.contactRepo.findByUserId(ctx.projectId!, userId);
-    const logs = await deps.db
-      .select()
-      .from(messageLogs)
-      .where(eq(messageLogs.projectId, ctx.projectId!))
-      .orderBy(desc(messageLogs.timestamp))
-      .limit(50);
+    const contactTargets = contacts.map((c) => c.target);
+    let logs: any[] = [];
+    if (contactTargets.length > 0) {
+      const outboxRows = await deps.db
+        .select({ taskId: deliveryOutbox.taskId })
+        .from(deliveryOutbox)
+        .where(inArray(deliveryOutbox.destination, contactTargets));
+      const taskIds = Array.from(new Set(outboxRows.map((r: any) => r.taskId)));
+      if (taskIds.length > 0) {
+        logs = await deps.db
+          .select()
+          .from(messageLogs)
+          .where(
+            and(eq(messageLogs.projectId, ctx.projectId!), inArray(messageLogs.taskId, taskIds)),
+          )
+          .orderBy(desc(messageLogs.timestamp))
+          .limit(50);
+      }
+    }
 
     sendJson(res, 200, { ...user, contacts, logs });
   }
@@ -1740,14 +1842,103 @@ code{background:#f4f4f5;padding:.1rem .35rem;border-radius:4px}</style>
         and(
           eq(suppressions.projectId, ctx.projectId!),
           eq(suppressions.channel, channel as any),
-          eq(suppressions.target, normaliseTarget(decodeURIComponent(target))),
+          eq(suppressions.target, normaliseTarget(target)),
         ),
       );
 
     sendNoContent(res);
   }
 
+  // ── POST /v1/auth/login — login ───────────────────────────────────────────
+  async function login(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    if (!deps.adminUserRepo) {
+      sendJson(res, 500, {
+        error: "internal_error",
+        message: "Admin user repository not initialized",
+      });
+      return;
+    }
+
+    const body = await readJsonBody(req);
+    const parsed = z
+      .object({
+        identifier: z.string().min(1, "Identifier (email or username) is required"),
+        password: z.string().min(1, "Password is required"),
+      })
+      .safeParse(body);
+
+    if (!parsed.success) {
+      sendValidationError(res, parsed.error);
+      return;
+    }
+
+    const { identifier, password } = parsed.data;
+    const user = await deps.adminUserRepo.findByEmailOrUsername(identifier);
+    const targetHash = user ? user.passwordHash : DUMMY_PASSWORD_HASH;
+    const isValid = await verifyPassword(password, targetHash);
+    if (!user || !isValid) {
+      sendJson(res, 401, { error: "unauthorized", message: "Invalid credentials" });
+      return;
+    }
+
+    const session = await createAdminSession(deps.redis.native, user);
+    sendJson(res, 200, {
+      token: session.token,
+      user: {
+        id: user.id,
+        email: user.email,
+        username: user.username,
+        role: user.role,
+      },
+      expiresAt: session.expiresAt,
+    });
+  }
+
+  // ── POST /v1/auth/logout — logout ─────────────────────────────────────────
+  async function logout(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const authHeader = req.headers["authorization"];
+    let token: string | undefined;
+    if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) {
+      token = authHeader.slice(7).trim();
+    }
+    if (token) {
+      await revokeAdminSession(deps.redis.native, token);
+    }
+    sendJson(res, 200, { message: "Logged out successfully" });
+  }
+
+  // ── GET /v1/auth/me — getMe ───────────────────────────────────────────────
+  async function getMe(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    const authHeader = req.headers["authorization"];
+    let token: string | undefined;
+    if (typeof authHeader === "string" && authHeader.toLowerCase().startsWith("bearer ")) {
+      token = authHeader.slice(7).trim();
+    }
+    if (!token) {
+      sendJson(res, 401, { error: "unauthorized", message: "Missing token" });
+      return;
+    }
+
+    const session = await getAdminSession(deps.redis.native, token);
+    if (!session) {
+      sendJson(res, 401, { error: "unauthorized", message: "Invalid or expired session" });
+      return;
+    }
+
+    sendJson(res, 200, {
+      user: {
+        id: session.adminId,
+        email: session.email,
+        username: session.username,
+        role: session.role,
+      },
+    });
+  }
+
   return {
+    login,
+    logout,
+    getMe,
     syncTemplates,
     addUser,
     updateUser,