vibecarbon 0.1.0

package/carbon/src/server/lib/env.ts

@@ -0,0 +1,112 @@
+import { z } from 'zod';
+
+const envSchema = z.object({
+  // Supabase (required)
+  SUPABASE_URL: z.string().url(),
+  SUPABASE_ANON_KEY: z.string().min(1),
+  SUPABASE_SERVICE_ROLE_KEY: z.string().min(1),
+
+  // Public site URL — used in CSP connectSrc so the client can reach Supabase
+  // via the public domain (Traefik → Kong). Defaults to empty string in dev
+  // (CSP is disabled in development).
+  SITE_URL: z.string().url().optional(),
+
+  // Server
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  PORT: z.coerce.number().default(3000),
+
+  // Port configuration (for running multiple projects)
+  DEV_PORT_OFFSET: z.coerce.number().default(0),
+  DEV_VITE_PORT: z.coerce.number().optional(),
+  DEV_API_PORT: z.coerce.number().optional(),
+  DEV_DB_PORT: z.coerce.number().optional(),
+  DEV_KONG_PORT: z.coerce.number().optional(),
+  DEV_TRAEFIK_PORT: z.coerce.number().optional(),
+  DEV_GRAFANA_PORT: z.coerce.number().optional(),
+  DEV_PROMETHEUS_PORT: z.coerce.number().optional(),
+  DEV_LOKI_PORT: z.coerce.number().optional(),
+
+  // OAuth (optional - configure in Supabase dashboard)
+  GOOGLE_ENABLED: z.coerce.boolean().default(false),
+  MICROSOFT_ENABLED: z.coerce.boolean().default(false),
+  GITHUB_ENABLED: z.coerce.boolean().default(false),
+  APPLE_ENABLED: z.coerce.boolean().default(false),
+  DISCORD_ENABLED: z.coerce.boolean().default(false),
+  MAGIC_LINK_ENABLED: z.coerce.boolean().default(true),
+
+  // SMTP (shared with Supabase Auth)
+  SMTP_HOST: z.string().optional(),
+  SMTP_PORT: z.coerce.number().optional(),
+  SMTP_USER: z.string().optional(),
+  SMTP_PASS: z.string().optional(),
+  SMTP_ADMIN_EMAIL: z.string().email().optional(),
+  SMTP_SENDER_NAME: z.string().optional(),
+
+  // Billing provider selection (defaults to stripe for backward compatibility)
+  BILLING_PROVIDER: z.enum(['stripe', 'paddle', 'polar']).default('stripe'),
+
+  // Stripe (optional)
+  STRIPE_SECRET_KEY: z.string().optional(),
+  STRIPE_WEBHOOK_SECRET: z.string().optional(),
+  STRIPE_PRICE_STARTER: z.string().optional(),
+  STRIPE_PRICE_PRO: z.string().optional(),
+
+  // Paddle (optional - alternative billing provider)
+  PADDLE_API_KEY: z.string().optional(),
+  PADDLE_WEBHOOK_SECRET: z.string().optional(),
+  PADDLE_ENVIRONMENT: z.enum(['sandbox', 'production']).default('sandbox'),
+  PADDLE_PRICE_STARTER: z.string().optional(),
+  PADDLE_PRICE_PRO: z.string().optional(),
+
+  // Polar (optional - alternative billing provider)
+  POLAR_ACCESS_TOKEN: z.string().optional(),
+  POLAR_WEBHOOK_SECRET: z.string().optional(),
+  POLAR_ORGANIZATION_ID: z.string().optional(),
+  POLAR_PRICE_STARTER: z.string().optional(),
+  POLAR_PRICE_PRO: z.string().optional(),
+
+  // License tier price IDs (for one-time license purchases)
+  DIAMOND_PRICE_ID: z.string().optional(),
+  FULLERENE_PRICE_ID: z.string().optional(),
+
+  // Redis (optional - for distributed rate limiting)
+  // Format: redis://[:password@]host:port or redis://[:password@]host:port/db
+  REDIS_URL: z.string().url().optional(),
+});
+
+// Apply port offset to localhost URLs in development
+// SUPABASE_URL and SITE_URL are hardcoded to default ports in .env but
+// DEV_PORT_OFFSET shifts Docker ports (Kong on 8000+offset, Vite on 5173+offset).
+const portOffset = Number.parseInt(process.env.DEV_PORT_OFFSET || '0', 10);
+if (process.env.NODE_ENV !== 'production' && portOffset !== 0) {
+  for (const key of ['SUPABASE_URL', 'SITE_URL'] as const) {
+    const raw = process.env[key];
+    if (!raw) continue;
+    try {
+      const url = new URL(raw);
+      if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+        url.port = String(Number.parseInt(url.port || '80', 10) + portOffset);
+        process.env[key] = url.toString().replace(/\/$/, '');
+      }
+    } catch {
+      // Leave invalid URLs for Zod to catch
+    }
+  }
+}
+
+// Validate environment variables
+const parsed = envSchema.safeParse(process.env);
+
+if (!parsed.success) {
+  // In production, don't expose which specific environment variables failed validation
+  // This prevents information disclosure about the application's configuration
+  if (process.env.NODE_ENV === 'production') {
+    console.error('Server configuration error. Please check environment variables.');
+  } else {
+    console.error('Invalid environment variables:');
+    console.error(parsed.error.flatten().fieldErrors);
+  }
+  process.exit(1);
+}
+
+export const env = parsed.data;

package/carbon/src/server/lib/errors.ts

@@ -0,0 +1,21 @@
+import { env } from './env';
+import { logger } from './logger';
+
+/**
+ * Sanitize error messages for API responses.
+ * In production, logs the full error and returns a generic message.
+ * In development, returns the actual error message for debugging.
+ */
+export function sanitizeError(error: unknown, fallback = 'An unexpected error occurred'): string {
+  if (env.NODE_ENV === 'production') {
+    // Log the full error for debugging
+    logger.error({ error }, 'API error');
+    return fallback;
+  }
+  // In development, return the actual error message
+  if (error instanceof Error) return error.message;
+  if (typeof error === 'object' && error !== null && 'message' in error) {
+    return String((error as { message: unknown }).message);
+  }
+  return fallback;
+}

package/carbon/src/server/lib/logger.ts

@@ -0,0 +1,17 @@
+import pino from 'pino';
+
+const isProduction = process.env.NODE_ENV === 'production';
+
+export const logger = pino({
+  level: isProduction ? 'info' : 'debug',
+  ...(isProduction
+    ? {}
+    : {
+        transport: {
+          target: 'pino-pretty',
+          options: {
+            colorize: true,
+          },
+        },
+      }),
+});

package/carbon/src/server/lib/rate-limiter.ts

@@ -0,0 +1,288 @@
+import type { Context, Next } from 'hono';
+import Redis from 'ioredis';
+import { env } from './env';
+import { logger } from './logger';
+
+// =============================================================================
+// RATE LIMIT STORE INTERFACE
+// =============================================================================
+
+interface RateLimitResult {
+  count: number;
+  resetTime: number;
+  allowed: boolean;
+}
+
+interface RateLimitStore {
+  increment(key: string, windowMs: number, max: number): Promise<RateLimitResult>;
+  isHealthy(): boolean;
+}
+
+// =============================================================================
+// IN-MEMORY STORE (fallback when Redis unavailable)
+// =============================================================================
+
+class InMemoryStore implements RateLimitStore {
+  private store: Map<string, { count: number; resetTime: number }> = new Map();
+
+  constructor() {
+    // Clean up old entries every minute
+    setInterval(() => {
+      const now = Date.now();
+      for (const [key, value] of this.store.entries()) {
+        if (value.resetTime < now) {
+          this.store.delete(key);
+        }
+      }
+    }, 60000);
+  }
+
+  async increment(key: string, windowMs: number, max: number): Promise<RateLimitResult> {
+    const now = Date.now();
+    const entry = this.store.get(key);
+
+    if (!entry || entry.resetTime < now) {
+      const resetTime = now + windowMs;
+      this.store.set(key, { count: 1, resetTime });
+      return { count: 1, resetTime, allowed: true };
+    }
+
+    entry.count++;
+    return {
+      count: entry.count,
+      resetTime: entry.resetTime,
+      allowed: entry.count <= max,
+    };
+  }
+
+  isHealthy(): boolean {
+    return true;
+  }
+}
+
+// =============================================================================
+// REDIS STORE (for distributed rate limiting)
+// =============================================================================
+
+class RedisStore implements RateLimitStore {
+  private client: Redis;
+  private healthy = false;
+
+  constructor(redisUrl: string) {
+    this.client = new Redis(redisUrl, {
+      maxRetriesPerRequest: 1,
+      retryStrategy: (times) => {
+        if (times > 3) {
+          logger.warn('Redis connection failed, rate limiting will use in-memory fallback');
+          return null; // Stop retrying
+        }
+        return Math.min(times * 100, 1000);
+      },
+      lazyConnect: true,
+    });
+
+    this.client.on('connect', () => {
+      this.healthy = true;
+      logger.info('Redis connected for rate limiting');
+    });
+
+    this.client.on('error', (err) => {
+      this.healthy = false;
+      logger.warn({ err: err.message }, 'Redis error');
+    });
+
+    this.client.on('close', () => {
+      this.healthy = false;
+    });
+
+    // Attempt connection
+    this.client.connect().catch(() => {
+      // Connection failed, will use fallback
+    });
+  }
+
+  async increment(key: string, windowMs: number, max: number): Promise<RateLimitResult> {
+    const now = Date.now();
+    const windowKey = `ratelimit:${key}:${Math.floor(now / windowMs)}`;
+    const resetTime = Math.ceil(now / windowMs) * windowMs + windowMs;
+
+    try {
+      // Use Redis MULTI for atomic increment and TTL set
+      const results = await this.client
+        .multi()
+        .incr(windowKey)
+        .pexpire(windowKey, windowMs + 1000) // Extra 1s buffer
+        .exec();
+
+      if (!results || results[0][0]) {
+        throw new Error('Redis transaction failed');
+      }
+
+      const count = results[0][1] as number;
+      return {
+        count,
+        resetTime,
+        allowed: count <= max,
+      };
+    } catch (err) {
+      // Redis operation failed, mark as unhealthy
+      this.healthy = false;
+      throw err;
+    }
+  }
+
+  isHealthy(): boolean {
+    return this.healthy;
+  }
+}
+
+// =============================================================================
+// HYBRID STORE (Redis with in-memory fallback)
+// =============================================================================
+
+class HybridStore implements RateLimitStore {
+  private redisStore: RedisStore | null = null;
+  private memoryStore: InMemoryStore;
+  private warnedAboutFallback = false;
+
+  constructor(redisUrl?: string) {
+    this.memoryStore = new InMemoryStore();
+
+    if (redisUrl) {
+      this.redisStore = new RedisStore(redisUrl);
+    } else if (env.NODE_ENV === 'production') {
+      logger.warn(
+        'REDIS_URL not configured. Rate limiting uses in-memory store which does not scale across multiple instances. ' +
+          'For production with multiple replicas, configure Redis: vibecarbon add redis'
+      );
+    }
+  }
+
+  async increment(key: string, windowMs: number, max: number): Promise<RateLimitResult> {
+    // Try Redis first if available
+    if (this.redisStore?.isHealthy()) {
+      try {
+        return await this.redisStore.increment(key, windowMs, max);
+      } catch {
+        // Fall through to memory store
+        if (!this.warnedAboutFallback) {
+          this.warnedAboutFallback = true;
+          logger.warn('Redis unavailable, falling back to in-memory rate limiting');
+        }
+      }
+    }
+
+    // Use in-memory fallback
+    return this.memoryStore.increment(key, windowMs, max);
+  }
+
+  isHealthy(): boolean {
+    return this.redisStore?.isHealthy() || this.memoryStore.isHealthy();
+  }
+}
+
+// =============================================================================
+// SINGLETON STORE INSTANCE
+// =============================================================================
+
+let store: HybridStore | null = null;
+
+function getStore(): HybridStore {
+  if (!store) {
+    store = new HybridStore(env.REDIS_URL);
+  }
+  return store;
+}
+
+// =============================================================================
+// IP EXTRACTION
+// =============================================================================
+
+// Track if we've warned about missing IP headers (log once per process)
+let warnedAboutMissingIP = false;
+
+/**
+ * Extract client IP from request headers
+ *
+ * Security note: Only trust x-forwarded-for when behind a trusted reverse proxy (Traefik).
+ * The leftmost IP in x-forwarded-for is the original client IP.
+ *
+ * Fallback behavior:
+ * - In development: Falls back to 'localhost' (expected when not behind proxy)
+ * - In production: Falls back to 'unknown' but logs a warning (indicates misconfiguration)
+ *
+ * When IP is 'unknown', all such requests share a rate limit bucket - this is intentional
+ * as it provides more restrictive rate limiting for requests that bypass proper headers.
+ */
+function getClientIP(c: Context): string {
+  // x-forwarded-for format: "client, proxy1, proxy2"
+  const xff = c.req.header('x-forwarded-for');
+  if (xff) {
+    // Take leftmost (original client) IP, trim whitespace
+    const clientIP = xff.split(',')[0].trim();
+    // Basic validation - must look like an IP (IPv4 or IPv6)
+    if (/^[\d.:a-fA-F]+$/.test(clientIP)) {
+      return clientIP;
+    }
+  }
+
+  // Fallback to x-real-ip (set by some proxies like nginx)
+  const realIP = c.req.header('x-real-ip');
+  if (realIP && /^[\d.:a-fA-F]+$/.test(realIP)) {
+    return realIP;
+  }
+
+  // Fallback to cf-connecting-ip (Cloudflare)
+  const cfIP = c.req.header('cf-connecting-ip');
+  if (cfIP && /^[\d.:a-fA-F]+$/.test(cfIP)) {
+    return cfIP;
+  }
+
+  // In development, localhost is expected
+  if (env.NODE_ENV === 'development') {
+    return 'localhost';
+  }
+
+  // In production, warn about missing IP headers (indicates proxy misconfiguration)
+  if (!warnedAboutMissingIP) {
+    warnedAboutMissingIP = true;
+    logger.warn(
+      'Could not determine client IP from request headers. ' +
+        'Ensure reverse proxy (Traefik) is configured to set X-Forwarded-For or X-Real-IP headers. ' +
+        'Requests without identifiable IPs will share a rate limit bucket.'
+    );
+  }
+
+  return 'unknown';
+}
+
+// =============================================================================
+// RATE LIMITER MIDDLEWARE
+// =============================================================================
+
+export function createRateLimiter(options: { windowMs: number; max: number }) {
+  return async (c: Context, next: Next) => {
+    const ip = getClientIP(c);
+    const key = `${ip}:${c.req.path}`;
+    const now = Date.now();
+
+    const result = await getStore().increment(key, options.windowMs, options.max);
+    const remaining = Math.max(0, options.max - result.count);
+    const reset = Math.ceil(result.resetTime / 1000);
+
+    c.res.headers.set('X-RateLimit-Limit', String(options.max));
+    c.res.headers.set('X-RateLimit-Remaining', String(remaining));
+    c.res.headers.set('X-RateLimit-Reset', String(reset));
+
+    if (!result.allowed) {
+      // Log rate limit violations for security monitoring
+      logger.warn({ ip, path: c.req.path, count: result.count }, 'Rate limit exceeded');
+      return c.json(
+        { error: 'Too many requests', retryAfter: Math.ceil((result.resetTime - now) / 1000) },
+        429
+      );
+    }
+
+    await next();
+  };
+}

package/carbon/src/server/lib/request.ts

@@ -0,0 +1,34 @@
+import { logger } from './logger';
+
+/**
+ * Extract client IP address from request headers.
+ * Checks common proxy headers (x-forwarded-for, x-real-ip, cf-connecting-ip).
+ */
+export function getClientIp(c: { req: { header: (name: string) => string | undefined } }): string {
+  // Cloudflare
+  const cfIp = c.req.header('cf-connecting-ip');
+  if (cfIp && isValidIp(cfIp)) return cfIp;
+
+  // Standard proxy headers
+  const forwarded = c.req.header('x-forwarded-for');
+  if (forwarded) {
+    const first = forwarded.split(',')[0].trim();
+    if (isValidIp(first)) return first;
+  }
+
+  const realIp = c.req.header('x-real-ip');
+  if (realIp && isValidIp(realIp)) return realIp;
+
+  logger.warn(
+    'Could not extract client IP from request headers (x-forwarded-for, x-real-ip, cf-connecting-ip). ' +
+      'Using fallback. Check proxy configuration if this happens frequently.'
+  );
+  return '127.0.0.1';
+}
+
+const ipv4Regex = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+const ipv6Regex = /^[a-fA-F0-9:]+$/;
+
+function isValidIp(ip: string): boolean {
+  return ipv4Regex.test(ip) || ipv6Regex.test(ip);
+}

package/carbon/src/server/lib/stripe.ts

@@ -0,0 +1,42 @@
+import Stripe from 'stripe';
+import { env } from './env';
+
+/**
+ * Stripe client instance.
+ * Only initialized if STRIPE_SECRET_KEY is configured.
+ */
+export const stripe = env.STRIPE_SECRET_KEY
+  ? new Stripe(env.STRIPE_SECRET_KEY, {
+      typescript: true,
+    })
+  : null;
+
+/**
+ * Get the Stripe client, throwing an error if not configured.
+ * Use this in routes that require Stripe to be configured.
+ */
+export function getStripe(): Stripe {
+  if (!stripe) {
+    throw new Error('Stripe is not configured. Set STRIPE_SECRET_KEY in your environment.');
+  }
+  return stripe;
+}
+
+/**
+ * Check if Stripe is configured.
+ */
+export function isStripeConfigured(): boolean {
+  return stripe !== null;
+}
+
+/**
+ * Verify Stripe webhook signature.
+ * Returns the event if valid, throws an error if invalid.
+ */
+export function verifyWebhookSignature(payload: string | Buffer, signature: string): Stripe.Event {
+  if (!env.STRIPE_WEBHOOK_SECRET) {
+    throw new Error('Stripe webhook secret is not configured');
+  }
+
+  return getStripe().webhooks.constructEvent(payload, signature, env.STRIPE_WEBHOOK_SECRET);
+}

package/carbon/src/server/lib/supabase.ts

@@ -0,0 +1,65 @@
+import { createClient, type SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from '../../shared/types';
+import { env } from './env';
+
+// Server-side Supabase client with service role key
+// This bypasses RLS - use only for admin operations
+export const supabaseAdmin: SupabaseClient<Database> = createClient<Database>(
+  env.SUPABASE_URL,
+  env.SUPABASE_SERVICE_ROLE_KEY,
+  {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+    },
+  }
+);
+
+// Create a client for a specific user's context (respects RLS)
+// Uses SERVICE_ROLE_KEY to pass Kong's ACL gate for PostgREST, but RLS is still
+// enforced because PostgREST reads the user's role from the Authorization JWT.
+export function createSupabaseClient(accessToken: string): SupabaseClient<Database> {
+  return createClient<Database>(env.SUPABASE_URL, env.SUPABASE_SERVICE_ROLE_KEY, {
+    global: {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    },
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+    },
+  });
+}
+
+// Create a fresh client for auth operations (signInWithPassword, etc.)
+// IMPORTANT: Never use supabaseAdmin for signInWithPassword — it stores the
+// user's session on the singleton, contaminating all subsequent admin queries
+// with the user's "authenticated" role instead of the "service_role" key.
+export function createAuthClient(): SupabaseClient<Database> {
+  return createClient<Database>(env.SUPABASE_URL, env.SUPABASE_SERVICE_ROLE_KEY, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+    },
+  });
+}
+
+// Helper to get Supabase client from request headers
+export function getSupabaseClient(authHeader: string | undefined): SupabaseClient<Database> {
+  if (!authHeader?.startsWith('Bearer ')) {
+    // No valid auth header — return an anon client so RLS is enforced.
+    // Routes must still reject unauthenticated requests via c.get('user'),
+    // but this ensures any accidental query falls under anon RLS policies
+    // rather than bypassing them entirely with the service role key.
+    return createClient<Database>(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
+      auth: {
+        autoRefreshToken: false,
+        persistSession: false,
+      },
+    });
+  }
+
+  const token = authHeader.replace('Bearer ', '');
+  return createSupabaseClient(token);
+}

package/carbon/src/server/middleware/requirePlan.ts

@@ -0,0 +1,80 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Context, Next } from 'hono';
+import type { PlanId } from '../../shared/pricing';
+import { planIdFromStripePriceId } from '../../shared/pricing';
+import { env } from '../lib/env';
+import { isStripeConfigured } from '../lib/stripe';
+import { supabaseAdmin } from '../lib/supabase';
+import type { HonoVariables } from '../types';
+
+// biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
+const adminDb = supabaseAdmin as SupabaseClient<any>;
+
+const planHierarchy: Record<PlanId, number> = {
+  free: 0,
+  starter: 1,
+  pro: 2,
+};
+
+/**
+ * Hono middleware that gates API routes behind a minimum plan.
+ *
+ * Usage:
+ *   myRoutes.use('/premium-endpoint', requirePlan('pro'));
+ *   myRoutes.get('/starter-feature', requirePlan('starter'), handler);
+ */
+export function requirePlan(minimumPlan: PlanId) {
+  return async (c: Context<{ Variables: HonoVariables }>, next: Next) => {
+    // If billing isn't configured, allow all requests (dev mode / self-hosted)
+    if (!isStripeConfigured()) {
+      await next();
+      return;
+    }
+
+    const user = c.get('user');
+    if (!user) {
+      return c.json({ error: 'Unauthorized' }, 401);
+    }
+
+    // Free plan requires no subscription check
+    if (minimumPlan === 'free') {
+      await next();
+      return;
+    }
+
+    // Find customer for this user
+    const { data: customer } = await adminDb
+      .from('customers')
+      .select('id')
+      .eq('user_id', user.id)
+      .is('organization_id', null)
+      .maybeSingle();
+
+    if (!customer) {
+      return c.json({ error: 'Upgrade required', requiredPlan: minimumPlan }, 403);
+    }
+
+    // Find active subscription
+    const { data: subscription } = await adminDb
+      .from('subscriptions')
+      .select('stripe_price_id, status')
+      .eq('customer_id', customer.id)
+      .in('status', ['active', 'trialing'])
+      .maybeSingle();
+
+    if (!subscription) {
+      return c.json({ error: 'Upgrade required', requiredPlan: minimumPlan }, 403);
+    }
+
+    const currentPlan = planIdFromStripePriceId(subscription.stripe_price_id, {
+      starter: env.STRIPE_PRICE_STARTER,
+      pro: env.STRIPE_PRICE_PRO,
+    });
+
+    if (planHierarchy[currentPlan] < planHierarchy[minimumPlan]) {
+      return c.json({ error: 'Upgrade required', requiredPlan: minimumPlan, currentPlan }, 403);
+    }
+
+    await next();
+  };
+}