vibecarbon 0.1.0

package/carbon/src/server/routes/_internal/verify-role.ts

@@ -0,0 +1,185 @@
+import { Hono } from 'hono';
+import { logger } from '../../lib/logger';
+import { supabaseAdmin } from '../../lib/supabase';
+
+/**
+ * Validate and sanitize the SITE_URL for redirect.
+ * Prevents open redirect vulnerabilities by ensuring the URL is well-formed
+ * and has a valid protocol.
+ */
+function getValidatedSiteUrl(): string {
+  const siteUrl = process.env.SITE_URL || 'http://localhost:5173';
+
+  try {
+    const url = new URL(siteUrl);
+    // Only allow http and https protocols
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      logger.warn({ siteUrl }, 'Invalid SITE_URL protocol, falling back to localhost');
+      return 'http://localhost:5173';
+    }
+    return url.origin;
+  } catch {
+    logger.warn({ siteUrl }, 'Invalid SITE_URL format, falling back to localhost');
+    return 'http://localhost:5173';
+  }
+}
+
+/**
+ * Internal endpoint for Traefik ForwardAuth middleware.
+ * Verifies that the user is authenticated and has the required role.
+ *
+ * Usage:
+ *   GET /api/_internal/verify-role?role=admin
+ *   GET /api/_internal/verify-role?roles=admin,moderator (any of these)
+ *
+ * Authentication:
+ *   - Reads JWT from Authorization header (Bearer token)
+ *   - Or from sb-access-token cookie (for browser sessions)
+ *   - Or from X-Forwarded-Access-Token header (set by Traefik)
+ *
+ * Returns:
+ *   200 - User authenticated and has required role
+ *   401 - Not authenticated or invalid token
+ *   403 - Authenticated but missing required role
+ *
+ * Response headers (on success):
+ *   X-User-Id: The authenticated user's ID
+ *   X-User-Email: The authenticated user's email
+ *   X-User-Role: The user's role from app_metadata
+ */
+
+import type { HonoVariables } from '../../types';
+
+const verifyRoleRoutes = new Hono<{ Variables: HonoVariables }>();
+
+// Helper to extract JWT from various sources
+function extractToken(req: Request, cookieHeader: string | undefined): string | null {
+  // 1. Check Authorization header
+  const authHeader = req.headers.get('Authorization');
+  if (authHeader?.startsWith('Bearer ')) {
+    return authHeader.slice(7);
+  }
+
+  // 2. Check X-Forwarded-Access-Token (set by Traefik ForwardAuth)
+  const forwardedToken = req.headers.get('X-Forwarded-Access-Token');
+  if (forwardedToken) {
+    return forwardedToken;
+  }
+
+  // 3. Check cookies for Supabase auth token
+  if (cookieHeader) {
+    const cookies = cookieHeader.split(';').reduce(
+      (acc, cookie) => {
+        const [key, value] = cookie.trim().split('=');
+        if (key && value) {
+          acc[key] = value;
+        }
+        return acc;
+      },
+      {} as Record<string, string>
+    );
+
+    // Check for our custom cookie-based auth token first (sb-auth-token)
+    // Then fall back to standard Supabase cookie patterns
+    const supabaseToken =
+      cookies['sb-auth-token'] ||
+      cookies['sb-access-token'] ||
+      Object.entries(cookies).find(
+        ([key]) => key.startsWith('sb-') && key.endsWith('-auth-token')
+      )?.[1];
+
+    if (supabaseToken) {
+      // The cookie value is JSON-encoded, containing access_token
+      try {
+        const parsed = JSON.parse(decodeURIComponent(supabaseToken));
+        if (parsed.access_token) {
+          return parsed.access_token;
+        }
+      } catch {
+        // If it's not JSON, use as-is
+        return supabaseToken;
+      }
+    }
+  }
+
+  return null;
+}
+
+verifyRoleRoutes.all('/', async (c) => {
+  const requiredRole = c.req.query('role');
+  const requiredRolesParam = c.req.query('roles');
+  const requiredRoles = requiredRole
+    ? [requiredRole]
+    : requiredRolesParam
+      ? requiredRolesParam.split(',').map((r) => r.trim())
+      : [];
+
+  if (requiredRoles.length === 0) {
+    logger.warn('verify-role called without role parameter');
+    return c.text('Bad Request: role or roles parameter required', 400);
+  }
+
+  // Extract token from request
+  const token = extractToken(c.req.raw, c.req.header('Cookie'));
+
+  if (!token) {
+    logger.debug('verify-role: No token found');
+
+    // For browser requests, redirect to login page with full return URL
+    // so the user is sent back to the original service (e.g., n8n.localhost)
+    const acceptHeader = c.req.header('Accept') || '';
+    if (acceptHeader.includes('text/html')) {
+      const forwardedProto = c.req.header('X-Forwarded-Proto') || 'http';
+      const forwardedHost = c.req.header('X-Forwarded-Host');
+      const forwardedUri = c.req.header('X-Forwarded-Uri') || '/';
+
+      // Build full return URL from Traefik's forwarded headers
+      const returnUrl = forwardedHost
+        ? `${forwardedProto}://${forwardedHost}${forwardedUri}`
+        : forwardedUri;
+
+      const siteUrl = getValidatedSiteUrl();
+      return c.redirect(`${siteUrl}/login?redirect=${encodeURIComponent(returnUrl)}`);
+    }
+
+    return c.text('Unauthorized', 401);
+  }
+
+  try {
+    // Verify the JWT and get user info using Supabase Admin
+    const {
+      data: { user },
+      error,
+    } = await supabaseAdmin.auth.getUser(token);
+
+    if (error || !user) {
+      logger.debug({ error: error?.message }, 'verify-role: Invalid token');
+      return c.text('Unauthorized', 401);
+    }
+
+    // Check user's role in app_metadata
+    const userRole = user.app_metadata?.role as string | undefined;
+    const hasRequiredRole = requiredRoles.includes(userRole || '');
+
+    if (!hasRequiredRole) {
+      logger.info(
+        { userId: user.id, userRole, requiredRoles },
+        'verify-role: User lacks required role'
+      );
+      return c.text('Forbidden', 403);
+    }
+
+    // Success - set headers for downstream services
+    c.header('X-User-Id', user.id);
+    c.header('X-User-Email', user.email || '');
+    c.header('X-User-Role', userRole || '');
+
+    logger.debug({ userId: user.id, userRole }, 'verify-role: Access granted');
+    return c.text('OK', 200);
+  } catch (err) {
+    logger.error({ error: err }, 'verify-role: Unexpected error');
+    return c.text('Internal Server Error', 500);
+  }
+});
+
+export { verifyRoleRoutes };

package/carbon/src/server/routes/health.ts

@@ -0,0 +1,48 @@
+import { Hono } from 'hono';
+import { logger } from '../lib/logger';
+import { supabaseAdmin } from '../lib/supabase';
+import type { HonoVariables } from '../types';
+
+const healthRoutes = new Hono<{ Variables: HonoVariables }>();
+
+// Liveness probe: returns 200 if the server process is running.
+// No external dependency checks — if this handler executes, the server is alive.
+healthRoutes.get('/', (c) => {
+  return c.json({
+    status: 'ok',
+    timestamp: new Date().toISOString(),
+  });
+});
+
+// Readiness probe: returns 200 only when the app can serve traffic
+// (i.e., database/Supabase is reachable).
+healthRoutes.get('/ready', async (c) => {
+  try {
+    const { error } = await supabaseAdmin.from('organizations').select('id').limit(0);
+
+    if (error) {
+      throw error;
+    }
+
+    return c.json({
+      status: 'ready',
+      timestamp: new Date().toISOString(),
+      services: {
+        database: 'connected',
+        supabase: 'connected',
+      },
+    });
+  } catch (error) {
+    logger.error({ error }, 'Readiness check failed');
+
+    return c.json(
+      {
+        status: 'not_ready',
+        timestamp: new Date().toISOString(),
+      },
+      503
+    );
+  }
+});
+
+export { healthRoutes };

package/carbon/src/server/routes/v1/admin/contact.ts

@@ -0,0 +1,128 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { sanitizeError } from '../../../lib/errors';
+import { supabaseAdmin } from '../../../lib/supabase';
+import type { HonoVariables } from '../../../types';
+
+// biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
+const adminDb = supabaseAdmin as SupabaseClient<any>;
+
+const adminContactRoutes = new Hono<{ Variables: HonoVariables }>();
+
+/**
+ * Require super admin for all contact management endpoints
+ */
+adminContactRoutes.use('*', async (c, next) => {
+  const user = c.get('user');
+  if (!user) return c.json({ error: 'Unauthorized' }, 401);
+
+  const { data } = await adminDb
+    .from('auth.users')
+    .select('raw_app_meta_data')
+    .eq('id', user.id)
+    .single();
+
+  const role = data?.raw_app_meta_data?.role;
+  if (role !== 'super_admin') {
+    return c.json({ error: 'Forbidden' }, 403);
+  }
+
+  await next();
+});
+
+/**
+ * List contact submissions with pagination
+ */
+adminContactRoutes.get('/', async (c) => {
+  const page = Math.max(1, Number(c.req.query('page') || '1'));
+  const limit = Math.min(50, Math.max(1, Number(c.req.query('limit') || '20')));
+  const status = c.req.query('status');
+  const offset = (page - 1) * limit;
+
+  try {
+    let query = adminDb
+      .from('contact_submissions')
+      .select('*', { count: 'exact' })
+      .order('created_at', { ascending: false })
+      .range(offset, offset + limit - 1);
+
+    if (status) {
+      query = query.eq('status', status);
+    }
+
+    const { data, error, count } = await query;
+
+    if (error) {
+      return c.json({ error: sanitizeError(error, 'Failed to fetch submissions') }, 500);
+    }
+
+    return c.json({
+      submissions: data || [],
+      total: count || 0,
+      page,
+      limit,
+    });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to fetch submissions') }, 500);
+  }
+});
+
+/**
+ * Update submission status
+ */
+const updateStatusSchema = z.object({
+  status: z.enum(['unread', 'read', 'replied', 'archived']),
+});
+
+adminContactRoutes.patch('/:id', async (c) => {
+  const id = c.req.param('id');
+
+  let body: z.infer<typeof updateStatusSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = updateStatusSchema.safeParse(rawBody);
+    if (!result.success) {
+      return c.json({ error: result.error.issues.map((e) => e.message).join(', ') }, 400);
+    }
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  try {
+    const { error } = await adminDb
+      .from('contact_submissions')
+      .update({ status: body.status })
+      .eq('id', id);
+
+    if (error) {
+      return c.json({ error: sanitizeError(error, 'Failed to update submission') }, 500);
+    }
+
+    return c.json({ success: true });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to update submission') }, 500);
+  }
+});
+
+/**
+ * Delete a submission
+ */
+adminContactRoutes.delete('/:id', async (c) => {
+  const id = c.req.param('id');
+
+  try {
+    const { error } = await adminDb.from('contact_submissions').delete().eq('id', id);
+
+    if (error) {
+      return c.json({ error: sanitizeError(error, 'Failed to delete submission') }, 500);
+    }
+
+    return c.json({ success: true });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to delete submission') }, 500);
+  }
+});
+
+export { adminContactRoutes };

package/carbon/src/server/routes/v1/admin/jobs.ts

@@ -0,0 +1,171 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { sanitizeError } from '../../../lib/errors';
+import { supabaseAdmin } from '../../../lib/supabase';
+import type { HonoVariables } from '../../../types';
+
+// biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
+const adminDb = supabaseAdmin as SupabaseClient<any>;
+
+const jobsRoutes = new Hono<{ Variables: HonoVariables }>();
+
+/**
+ * Require super admin for all job management endpoints
+ */
+jobsRoutes.use('*', async (c, next) => {
+  const user = c.get('user');
+  if (!user) return c.json({ error: 'Unauthorized' }, 401);
+
+  const { data } = await adminDb
+    .from('auth.users')
+    .select('raw_app_meta_data')
+    .eq('id', user.id)
+    .single();
+
+  const role = data?.raw_app_meta_data?.role;
+  if (role !== 'super_admin') {
+    return c.json({ error: 'Forbidden' }, 403);
+  }
+
+  await next();
+});
+
+/**
+ * List all scheduled cron jobs
+ */
+jobsRoutes.get('/', async (c) => {
+  try {
+    // Query pg_cron's job table directly
+    const { data: jobs, error } = await adminDb.rpc('get_cron_jobs');
+
+    if (error) {
+      // Fallback: query cron.job directly via raw SQL isn't available via RPC,
+      // so we return the job history as a summary instead
+      const { data: history, error: historyError } = await adminDb
+        .from('cron_job_history')
+        .select('job_name, status, started_at, finished_at, duration_ms, result, error')
+        .order('started_at', { ascending: false })
+        .limit(100);
+
+      if (historyError) {
+        return c.json({ error: sanitizeError(historyError, 'Failed to fetch jobs') }, 500);
+      }
+
+      // Derive job list from history
+      const jobNames = [...new Set((history || []).map((h: { job_name: string }) => h.job_name))];
+      const jobSummaries = jobNames.map((name) => {
+        const jobHistory = (history || []).filter((h: { job_name: string }) => h.job_name === name);
+        const latest = jobHistory[0] as
+          | { status: string; started_at: string; result: string | null; error: string | null }
+          | undefined;
+        return {
+          name,
+          lastRun: latest?.started_at ?? null,
+          lastStatus: latest?.status ?? 'unknown',
+          lastResult: latest?.result ?? null,
+          lastError: latest?.error ?? null,
+          runCount: jobHistory.length,
+        };
+      });
+
+      return c.json({ jobs: jobSummaries, history: history || [] });
+    }
+
+    return c.json({ jobs: jobs || [], history: [] });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to fetch jobs') }, 500);
+  }
+});
+
+/**
+ * Get job execution history
+ */
+jobsRoutes.get('/history', async (c) => {
+  const jobName = c.req.query('jobName');
+  const limit = Math.min(Number(c.req.query('limit') || '50'), 200);
+
+  try {
+    let query = adminDb
+      .from('cron_job_history')
+      .select('*')
+      .order('started_at', { ascending: false })
+      .limit(limit);
+
+    if (jobName) {
+      query = query.eq('job_name', jobName);
+    }
+
+    const { data, error } = await query;
+
+    if (error) {
+      return c.json({ error: sanitizeError(error, 'Failed to fetch job history') }, 500);
+    }
+
+    return c.json({ history: data || [] });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to fetch job history') }, 500);
+  }
+});
+
+/**
+ * Manually trigger a job (run the cleanup function immediately)
+ */
+const triggerSchema = z.object({
+  jobName: z.string().min(1),
+});
+
+jobsRoutes.post('/trigger', async (c) => {
+  let body: z.infer<typeof triggerSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = triggerSchema.safeParse(rawBody);
+    if (!result.success) {
+      return c.json({ error: result.error.issues.map((e) => e.message).join(', ') }, 400);
+    }
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  try {
+    // Only allow triggering known safe jobs
+    const allowedJobs = [
+      'cleanup-login-attempts',
+      'cleanup-expired-notifications',
+      'cleanup-job-history',
+    ];
+
+    if (!allowedJobs.includes(body.jobName)) {
+      return c.json({ error: 'Unknown job name' }, 400);
+    }
+
+    // Execute the job's SQL directly
+    if (body.jobName === 'cleanup-login-attempts') {
+      await adminDb.rpc('cleanup_old_login_attempts', { p_retention_hours: 24 });
+    } else if (body.jobName === 'cleanup-expired-notifications') {
+      await adminDb
+        .from('notifications')
+        .delete()
+        .not('expires_at', 'is', null)
+        .lt('expires_at', new Date().toISOString());
+    } else if (body.jobName === 'cleanup-job-history') {
+      const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
+      await adminDb.from('cron_job_history').delete().lt('created_at', thirtyDaysAgo);
+    }
+
+    // Log the manual trigger
+    await adminDb.from('cron_job_history').insert({
+      job_name: body.jobName,
+      status: 'succeeded',
+      finished_at: new Date().toISOString(),
+      result: 'Manually triggered by admin',
+    });
+
+    return c.json({ success: true });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to trigger job') }, 500);
+  }
+});
+
+export { jobsRoutes };