spaps 0.4.3 → 0.5.0

package/README.md

@@ -199,11 +199,74 @@ npm install --save-dev spaps
 
 - 📖 **Full Documentation**: [sweetpotato.dev](https://sweetpotato.dev)
 - 🔧 **Production Setup**: See deployment guides
-- 💬 **Get Help**: [GitHub Issues](https://github.com/yourusername/sweet-potato/issues)
+- 💬 **Get Help**: [GitHub Issues](https://github.com/build000r/sweet-potato/issues)
 - 🚀 **Examples**: Check `/examples` directory
 
+## 🚀 Production Deployment
+
+Ready to go live? SPAPS supports seamless migration from local to production:
+
+### Local → Production Workflow
+
+1. **Export Local Data**:
+   ```bash
+   # Export your products, orders, and customers
+   curl http://localhost:3456/api/admin/export > spaps-data.json
+   ```
+
+2. **Set Up Production Server**:
+   ```bash
+   # Deploy to your server (DigitalOcean, AWS, etc.)
+   # Example production server: http://104.131.188.214:3000
+   git clone https://github.com/build000r/sweet-potato
+   cd sweet-potato
+   npm install
+   ```
+
+3. **Configure Environment**:
+   ```bash
+   # Set production environment variables
+   SUPABASE_URL=https://your-project.supabase.co
+   SUPABASE_SERVICE_KEY=eyJhb...your-service-key
+   STRIPE_SECRET_KEY=sk_live_... # Your live Stripe key
+   JWT_SECRET=your-32-char-secure-secret
+   ```
+
+4. **Sync Products to Production Stripe**:
+   ```bash
+   # Import your local products to production Stripe
+   curl -X POST http://104.131.188.214:3000/api/v1/admin/products/sync \
+        -H "Content-Type: application/json" \
+        -d @spaps-data.json
+   ```
+
+5. **Update Frontend Config**:
+   ```javascript
+   // Change from local to production endpoint
+   const SPAPS_URL = 'http://104.131.188.214:3000'; // Your production server
+   ```
+
+### Production Features
+
+The production SPAPS server includes:
+- ✅ **Real Supabase integration** with RLS policies
+- ✅ **Live Stripe webhooks** with signature verification
+- ✅ **Multi-wallet authentication** (Solana, Ethereum, Base, Bitcoin)
+- ✅ **JWT authentication** with refresh tokens
+- ✅ **Rate limiting** and security middleware
+- ✅ **Usage tracking** and analytics
+- ✅ **Multi-tenant support** for multiple client apps
+
+### Health Check
+
+Check if your production server is running:
+```bash
+curl http://104.131.188.214:3000/health
+# Returns: {"status":"healthy","mode":"production"}
+```
+
 ---
 
-**Current Version**: v0.3.9  
+**Current Version**: v0.4.3  
 **License**: MIT  
 **Node.js**: >=16.0.0 required

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "spaps",
-  "version": "0.4.3",
-  "description": "Sweet Potato Authentication & Payment Service CLI - Zero-config local development and project scaffolding",
-  "main": "bin/spaps.js",
+  "version": "0.5.0",
+  "description": "Sweet Potato Authentication & Payment Service CLI - Zero-config local development with built-in admin middleware and permission utilities",
+  "main": "src/index.js",
   "bin": {
     "spaps": "./bin/spaps.js"
   },
   "exports": {
-    ".": "./bin/spaps.js",
-    "./client": "./client.js"
+    ".": "./src/index.js",
+    "./cli": "./bin/spaps.js",
+    "./client": "./client.js",
+    "./middleware": "./src/middleware/admin.js"
   },
   "scripts": {
     "test": "echo \"No tests yet\""
@@ -30,10 +32,10 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/yourusername/sweet-potato"
+    "url": "https://github.com/build000r/sweet-potato"
   },
   "bugs": {
-    "url": "https://github.com/yourusername/sweet-potato/issues"
+    "url": "https://github.com/build000r/sweet-potato/issues"
   },
   "homepage": "https://sweetpotato.dev",
   "dependencies": {

package/src/index.js

@@ -0,0 +1,42 @@
+/**
+ * SPAPS Package Main Export
+ * Provides middleware, utilities, and client functionality
+ */
+
+const adminMiddleware = require('./middleware/admin');
+
+// Export admin middleware and utilities
+module.exports = {
+  // Admin middleware functions
+  requireAdmin: adminMiddleware.requireAdmin,
+  requirePermission: adminMiddleware.requirePermission,
+  
+  // Permission checking utilities
+  isAdminAccount: adminMiddleware.isAdminAccount,
+  getUserRole: adminMiddleware.getUserRole,
+  hasPermission: adminMiddleware.hasPermission,
+  getRoleAwareErrorMessage: adminMiddleware.getRoleAwareErrorMessage,
+  
+  // Constants
+  DEFAULT_ADMIN_ACCOUNTS: adminMiddleware.DEFAULT_ADMIN_ACCOUNTS,
+  
+  // Factory function for custom admin configurations
+  createPermissionChecker: adminMiddleware.createPermissionChecker,
+  
+  // Express middleware aliases for convenience
+  admin: adminMiddleware.requireAdmin,
+  permission: adminMiddleware.requirePermission,
+  
+  // Version and metadata
+  version: require('../package.json').version,
+  name: 'spaps'
+};
+
+// Named exports for ES6 compatibility
+module.exports.requireAdmin = adminMiddleware.requireAdmin;
+module.exports.requirePermission = adminMiddleware.requirePermission;
+module.exports.isAdminAccount = adminMiddleware.isAdminAccount;
+module.exports.getUserRole = adminMiddleware.getUserRole;
+module.exports.hasPermission = adminMiddleware.hasPermission;
+module.exports.getRoleAwareErrorMessage = adminMiddleware.getRoleAwareErrorMessage;
+module.exports.createPermissionChecker = adminMiddleware.createPermissionChecker;

package/src/middleware/admin.js

@@ -0,0 +1,238 @@
+const chalk = require('chalk');
+
+/**
+ * Admin middleware for SPAPS applications
+ * Provides built-in admin role checking and permission validation
+ */
+
+// Default admin configuration
+const DEFAULT_ADMIN_ACCOUNTS = {
+  email: 'buildooor@gmail.com',
+  wallets: {
+    ethereum: '0xa72bb7CeF1e4B2Cc144373d8dE0Add7CCc8DF4Ba',
+    solana: 'HVEbdiYU3Rr34NHBSgKs7q8cvdTeZLqNL77Z1FB2vjLy',
+  }
+};
+
+/**
+ * Check if an identifier (email/wallet) is an admin account
+ */
+function isAdminAccount(identifier, customAdmins = []) {
+  if (!identifier) return false;
+  
+  const normalized = identifier.toLowerCase();
+  
+  // Check default admin accounts
+  if (normalized === DEFAULT_ADMIN_ACCOUNTS.email.toLowerCase() ||
+      normalized === DEFAULT_ADMIN_ACCOUNTS.wallets.ethereum.toLowerCase() ||
+      normalized === DEFAULT_ADMIN_ACCOUNTS.wallets.solana.toLowerCase()) {
+    return true;
+  }
+  
+  // Check custom admin accounts
+  return customAdmins.some(admin => {
+    if (typeof admin === 'string') {
+      return admin.toLowerCase() === normalized;
+    }
+    if (admin.email && admin.email.toLowerCase() === normalized) {
+      return true;
+    }
+    if (admin.wallet_address && admin.wallet_address.toLowerCase() === normalized) {
+      return true;
+    }
+    return false;
+  });
+}
+
+/**
+ * Get user role based on identifier
+ */
+function getUserRole(identifier, customAdmins = []) {
+  if (isAdminAccount(identifier, customAdmins)) {
+    return 'admin';
+  }
+  return 'user';
+}
+
+/**
+ * Get role-aware error message
+ */
+function getRoleAwareErrorMessage(requiredRole, userRole, action = 'perform this action') {
+  const messages = {
+    admin: {
+      user: `🔒 Admin privileges required to ${action}. Please authenticate with an admin account.`,
+      guest: `🔐 Authentication required. Please sign in with an admin account to ${action}.`
+    },
+    user: {
+      guest: `🔐 Authentication required. Please sign in to ${action}.`
+    }
+  };
+
+  return messages[requiredRole]?.[userRole] || `Access denied. Required role: ${requiredRole}, current role: ${userRole}`;
+}
+
+/**
+ * Express middleware for admin authentication
+ */
+function requireAdmin(options = {}) {
+  const {
+    customAdmins = [],
+    errorMessage,
+    onUnauthorized,
+    allowLocalBypass = true
+  } = options;
+
+  return (req, res, next) => {
+    // Check if in local development mode
+    if (allowLocalBypass && req.isLocalMode) {
+      console.log(chalk.yellow('🏠 Local mode: Admin check bypassed'));
+      req.isAdmin = true;
+      req.userRole = 'admin';
+      return next();
+    }
+
+    // Extract user information from request
+    const userEmail = req.user?.email || req.body?.email;
+    const walletAddress = req.user?.wallet_address || req.body?.wallet_address;
+    const identifier = userEmail || walletAddress;
+
+    if (!identifier) {
+      const message = errorMessage || getRoleAwareErrorMessage('admin', 'guest');
+      
+      if (onUnauthorized) {
+        return onUnauthorized(req, res, { reason: 'no_identifier', message });
+      }
+
+      return res.status(401).json({
+        success: false,
+        error: {
+          code: 'AUTHENTICATION_REQUIRED',
+          message
+        }
+      });
+    }
+
+    const isAdmin = isAdminAccount(identifier, customAdmins);
+    const userRole = getUserRole(identifier, customAdmins);
+
+    if (!isAdmin) {
+      const message = errorMessage || getRoleAwareErrorMessage('admin', userRole);
+      
+      if (onUnauthorized) {
+        return onUnauthorized(req, res, { 
+          reason: 'insufficient_privileges', 
+          message, 
+          userRole,
+          identifier 
+        });
+      }
+
+      return res.status(403).json({
+        success: false,
+        error: {
+          code: 'INSUFFICIENT_PRIVILEGES',
+          message
+        }
+      });
+    }
+
+    // Add admin information to request
+    req.isAdmin = true;
+    req.userRole = userRole;
+    req.adminAccount = identifier;
+
+    console.log(chalk.green(`👑 Admin authenticated: ${identifier}`));
+    next();
+  };
+}
+
+/**
+ * Permission checking utility
+ */
+function hasPermission(user, requiredPermissions, customAdmins = []) {
+  if (!user) return false;
+  
+  const identifier = user.email || user.wallet_address;
+  const userRole = getUserRole(identifier, customAdmins);
+  
+  // Admins have all permissions
+  if (userRole === 'admin') {
+    return true;
+  }
+
+  // Check specific permissions
+  if (Array.isArray(requiredPermissions)) {
+    return requiredPermissions.every(permission => 
+      user.permissions?.includes(permission)
+    );
+  }
+
+  return user.permissions?.includes(requiredPermissions);
+}
+
+/**
+ * Express middleware for permission checking
+ */
+function requirePermission(permissions, options = {}) {
+  const {
+    customAdmins = [],
+    errorMessage,
+    onUnauthorized
+  } = options;
+
+  return (req, res, next) => {
+    const user = req.user;
+    const hasRequiredPermission = hasPermission(user, permissions, customAdmins);
+
+    if (!hasRequiredPermission) {
+      const userRole = user ? getUserRole(user.email || user.wallet_address, customAdmins) : 'guest';
+      const message = errorMessage || getRoleAwareErrorMessage('permission', userRole, `access this resource`);
+      
+      if (onUnauthorized) {
+        return onUnauthorized(req, res, { 
+          reason: 'insufficient_permissions', 
+          message,
+          requiredPermissions: permissions,
+          userPermissions: user?.permissions || []
+        });
+      }
+
+      return res.status(403).json({
+        success: false,
+        error: {
+          code: 'INSUFFICIENT_PERMISSIONS',
+          message,
+          details: {
+            required: permissions,
+            current: user?.permissions || []
+          }
+        }
+      });
+    }
+
+    next();
+  };
+}
+
+module.exports = {
+  // Middleware functions
+  requireAdmin,
+  requirePermission,
+  
+  // Utility functions
+  isAdminAccount,
+  getUserRole,
+  hasPermission,
+  getRoleAwareErrorMessage,
+  
+  // Constants
+  DEFAULT_ADMIN_ACCOUNTS,
+  
+  // Helper for client-side checking
+  createPermissionChecker: (customAdmins = []) => ({
+    isAdmin: (identifier) => isAdminAccount(identifier, customAdmins),
+    getRole: (identifier) => getUserRole(identifier, customAdmins),
+    hasPermission: (user, permissions) => hasPermission(user, permissions, customAdmins),
+    getErrorMessage: (requiredRole, userRole, action) => getRoleAwareErrorMessage(requiredRole, userRole, action)
+  })
+};