vibecarbon 0.1.0

package/carbon/src/server/routes/v1/billing.ts

@@ -0,0 +1,718 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { planIdFromPriceId, plans } from '../../../shared/pricing';
+import { getBillingProvider, getProviderPriceIds, isBillingConfigured } from '../../billing';
+import { env } from '../../lib/env';
+import { sanitizeError } from '../../lib/errors';
+import { supabaseAdmin } from '../../lib/supabase';
+import type { HonoVariables } from '../../types';
+
+// Helper to access tables not yet in generated types
+// biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
+const adminDb = supabaseAdmin as SupabaseClient<any>;
+
+const billingRoutes = new Hono<{ Variables: HonoVariables }>();
+
+// ============================================================================
+// VALIDATION SCHEMAS
+// ============================================================================
+
+const checkoutSchema = z.object({
+  priceId: z.string().min(1, 'Price ID is required'),
+  type: z.enum(['user', 'organization']),
+  organizationId: z.string().uuid().optional(),
+  successUrl: z.string().url().optional(),
+  cancelUrl: z.string().url().optional(),
+});
+
+const portalSchema = z.object({
+  type: z.enum(['user', 'organization']),
+  organizationId: z.string().uuid().optional(),
+  returnUrl: z.string().url().optional(),
+});
+
+// ============================================================================
+// HELPER FUNCTIONS
+// ============================================================================
+
+/**
+ * Validate that a redirect URL is same-origin to prevent open redirects.
+ * Returns the URL if valid, or null if it's external.
+ */
+function validateRedirectUrl(url: string, baseUrl: string): string | null {
+  try {
+    const parsed = new URL(url);
+    const base = new URL(baseUrl);
+    if (parsed.origin === base.origin) return url;
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Get or create a billing customer for a user or organization.
+ *
+ * Uses the active billing provider to create the customer in the external
+ * system, then stores the provider's customer ID in the `stripe_customer_id`
+ * column (which holds any provider's customer ID despite its name).
+ */
+async function getOrCreateCustomer(
+  type: 'user' | 'organization',
+  userId: string,
+  email: string,
+  organizationId?: string
+): Promise<{ customerId: string; providerCustomerId: string }> {
+  const provider = getBillingProvider();
+
+  // Build query based on type
+  const query = adminDb.from('customers').select('id, stripe_customer_id');
+
+  if (type === 'user') {
+    query.eq('user_id', userId).is('organization_id', null);
+  } else {
+    if (!organizationId) {
+      throw new Error('Organization ID is required for organization billing');
+    }
+    query.eq('organization_id', organizationId).is('user_id', null);
+  }
+
+  const { data: existingCustomer, error: fetchError } = await query.maybeSingle();
+
+  if (fetchError) {
+    throw new Error(`Failed to fetch customer: ${fetchError.message}`);
+  }
+
+  // Return existing customer if found
+  if (existingCustomer) {
+    return {
+      customerId: existingCustomer.id,
+      providerCustomerId: existingCustomer.stripe_customer_id,
+    };
+  }
+
+  // Get organization name if applicable
+  let customerName = email;
+  if (type === 'organization' && organizationId) {
+    const { data: org } = await adminDb
+      .from('organizations')
+      .select('name')
+      .eq('id', organizationId)
+      .single();
+    if (org) {
+      customerName = org.name;
+    }
+  }
+
+  // Create customer in the billing provider
+  const providerCustomerId = await provider.createCustomer({
+    email,
+    name: customerName,
+    metadata: {
+      type,
+      user_id: userId,
+      organization_id: organizationId || '',
+    },
+  });
+
+  // Create database record
+  // NOTE: stripe_customer_id column stores the provider's customer ID regardless
+  // of which provider is active. The column name is kept for backward compatibility.
+  const insertData =
+    type === 'user'
+      ? { user_id: userId, stripe_customer_id: providerCustomerId, email }
+      : { organization_id: organizationId, stripe_customer_id: providerCustomerId, email };
+
+  const { data: newCustomer, error: insertError } = await adminDb
+    .from('customers')
+    .insert(insertData)
+    .select('id, stripe_customer_id')
+    .single();
+
+  if (insertError) {
+    // Clean up provider customer if DB insert fails
+    try {
+      await provider.deleteCustomer(providerCustomerId);
+    } catch {
+      // Best-effort cleanup; the orphaned customer can be cleaned up manually
+    }
+    throw new Error(`Failed to create customer record: ${insertError.message}`);
+  }
+
+  return {
+    customerId: newCustomer.id,
+    providerCustomerId: newCustomer.stripe_customer_id,
+  };
+}
+
+// ============================================================================
+// STRIPE PRICE CACHE (kept for backward compatibility with Stripe subscriptions)
+// ============================================================================
+
+const priceCache = new Map<string, { data: unknown; expiresAt: number }>();
+const PRICE_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour (prices rarely change)
+
+async function getCachedPrice(priceId: string): Promise<unknown> {
+  const cached = priceCache.get(priceId);
+  if (cached && Date.now() < cached.expiresAt) {
+    return cached.data;
+  }
+
+  // Price caching via direct Stripe API is only available for the Stripe provider.
+  // For other providers, the subscription endpoint uses getSubscription() instead.
+  const provider = getBillingProvider();
+  if (provider.type !== 'stripe') {
+    return null;
+  }
+
+  // Dynamic import to avoid loading stripe module when not needed
+  const { getStripe } = await import('../../lib/stripe');
+  const stripe = getStripe();
+  const price = await stripe.prices.retrieve(priceId, { expand: ['product'] });
+  priceCache.set(priceId, { data: price, expiresAt: Date.now() + PRICE_CACHE_TTL_MS });
+  return price;
+}
+
+// ============================================================================
+// BILLING STATUS
+// ============================================================================
+
+/**
+ * Check if billing is configured
+ */
+billingRoutes.get('/status', (c) => {
+  return c.json({
+    configured: isBillingConfigured(),
+    provider: env.BILLING_PROVIDER,
+  });
+});
+
+// ============================================================================
+// PRICES ENDPOINT
+// ============================================================================
+
+/**
+ * Get available plans and their price IDs for the active provider
+ */
+billingRoutes.get('/prices', (c) => {
+  const configured = isBillingConfigured();
+  const priceIds = getProviderPriceIds();
+  const priceMap: Record<string, { monthly?: string }> = {};
+
+  if (configured) {
+    if (priceIds.starter) {
+      priceMap.starter = { monthly: priceIds.starter };
+    }
+    if (priceIds.pro) {
+      priceMap.pro = { monthly: priceIds.pro };
+    }
+  }
+
+  return c.json({
+    configured,
+    provider: env.BILLING_PROVIDER,
+    plans: plans.map((plan) => ({
+      ...plan,
+      // Keep stripePriceIds key for backward compatibility with existing clients
+      stripePriceIds: priceMap[plan.id] ?? null,
+      priceIds: priceMap[plan.id] ?? null,
+    })),
+  });
+});
+
+// ============================================================================
+// SUBSCRIPTION ENDPOINTS
+// ============================================================================
+
+/**
+ * Get current subscription for user or organization
+ */
+billingRoutes.get('/subscription', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isBillingConfigured()) {
+    return c.json({ error: 'Billing is not configured' }, 503);
+  }
+
+  const type = c.req.query('type') || 'user';
+  const organizationId = c.req.query('organizationId');
+
+  try {
+    // Build customer query
+    let customerQuery = adminDb.from('customers').select('id, stripe_customer_id');
+
+    if (type === 'user') {
+      customerQuery = customerQuery.eq('user_id', user.id).is('organization_id', null);
+    } else {
+      if (!organizationId) {
+        return c.json({ error: 'Organization ID is required' }, 400);
+      }
+      customerQuery = customerQuery.eq('organization_id', organizationId).is('user_id', null);
+    }
+
+    const { data: customer } = await customerQuery.maybeSingle();
+
+    if (!customer) {
+      return c.json({
+        subscription: null,
+        status: 'none',
+      });
+    }
+
+    // Get subscription from database
+    const { data: subscription } = await adminDb
+      .from('subscriptions')
+      .select('*')
+      .eq('customer_id', customer.id)
+      .eq('status', 'active')
+      .maybeSingle();
+
+    if (!subscription) {
+      return c.json({
+        subscription: null,
+        status: 'none',
+      });
+    }
+
+    const providerPriceIds = getProviderPriceIds();
+
+    // Try to get price details from provider or use cached Stripe price
+    const provider = getBillingProvider();
+    let priceInfo: { unitAmount: number; currency: string; interval: string } | null = null;
+    let productInfo: { id: string; name: string } | null = null;
+
+    if (provider.type === 'stripe') {
+      // Use the existing Stripe price cache for backward compatibility
+      const price = (await getCachedPrice(subscription.stripe_price_id)) as {
+        id: string;
+        unit_amount: number | null;
+        currency: string;
+        recurring: { interval: string } | null;
+        product: unknown;
+      } | null;
+
+      if (price) {
+        priceInfo = {
+          unitAmount: price.unit_amount ?? 0,
+          currency: price.currency,
+          interval: price.recurring?.interval ?? 'month',
+        };
+        const product = price.product as { id: string; name: string } | undefined;
+        productInfo = product ? { id: product.id, name: product.name } : null;
+      }
+    } else {
+      // For Paddle/Polar, fetch subscription details from the provider API
+      try {
+        const subInfo = await provider.getSubscription({
+          customerId: customer.stripe_customer_id,
+          subscriptionId: subscription.stripe_subscription_id,
+        });
+        if (subInfo) {
+          priceInfo = subInfo.price;
+          productInfo = subInfo.product;
+        }
+      } catch {
+        // Fall back to database data if provider API is unreachable
+      }
+    }
+
+    const resolvedPlanId = planIdFromPriceId(subscription.stripe_price_id, providerPriceIds);
+
+    return c.json({
+      subscription: {
+        id: subscription.id,
+        status: subscription.status,
+        priceId: subscription.stripe_price_id,
+        planId: resolvedPlanId,
+        currentPeriodEnd: subscription.current_period_end,
+        cancelAtPeriodEnd: subscription.cancel_at_period_end,
+        product: productInfo,
+        price: priceInfo
+          ? {
+              id: subscription.stripe_price_id,
+              unitAmount: priceInfo.unitAmount,
+              currency: priceInfo.currency,
+              interval: priceInfo.interval,
+            }
+          : null,
+      },
+      status: subscription.status,
+    });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to fetch subscription') }, 500);
+  }
+});
+
+// ============================================================================
+// CHECKOUT
+// ============================================================================
+
+/**
+ * Create a checkout session via the active billing provider
+ */
+billingRoutes.post('/checkout', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isBillingConfigured()) {
+    return c.json({ error: 'Billing is not configured' }, 503);
+  }
+
+  // Parse and validate request body
+  let body: z.infer<typeof checkoutSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = checkoutSchema.safeParse(rawBody);
+
+    if (!result.success) {
+      const errors = result.error.issues.map((e: { message: string }) => e.message).join(', ');
+      return c.json({ error: errors }, 400);
+    }
+
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  // Validate organization access if billing for organization
+  if (body.type === 'organization') {
+    if (!body.organizationId) {
+      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
+    }
+
+    // Check user is admin/owner of organization
+    const supabase = c.get('supabase');
+    const { data: membership } = await supabase
+      .from('memberships')
+      .select('role')
+      .eq('user_id', user.id)
+      .eq('organization_id', body.organizationId)
+      .single();
+
+    if (!membership || !['OWNER', 'ADMIN'].includes(membership.role)) {
+      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
+    }
+  }
+
+  try {
+    const provider = getBillingProvider();
+
+    // Get or create customer (user.email guaranteed for authenticated users)
+    const { providerCustomerId } = await getOrCreateCustomer(
+      body.type,
+      user.id,
+      user.email ?? '',
+      body.organizationId
+    );
+
+    // Default URLs - validate user-supplied URLs are same-origin to prevent open redirects
+    const baseUrl = env.NODE_ENV === 'production' ? process.env.SITE_URL : 'http://localhost:5173';
+    const defaultSuccessUrl = `${baseUrl}/settings/billing?success=true`;
+    const defaultCancelUrl = `${baseUrl}/settings/billing?canceled=true`;
+    const successUrl =
+      (body.successUrl && baseUrl ? validateRedirectUrl(body.successUrl, baseUrl) : null) ||
+      defaultSuccessUrl;
+    const cancelUrl =
+      (body.cancelUrl && baseUrl ? validateRedirectUrl(body.cancelUrl, baseUrl) : null) ||
+      defaultCancelUrl;
+
+    // Create checkout session via the provider
+    const result = await provider.createCheckout({
+      customerId: providerCustomerId,
+      priceId: body.priceId,
+      successUrl,
+      cancelUrl,
+      metadata: {
+        type: body.type,
+        user_id: user.id,
+        organization_id: body.organizationId || '',
+      },
+    });
+
+    return c.json({
+      sessionId: result.sessionId,
+      url: result.url,
+    });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to create checkout session') }, 500);
+  }
+});
+
+// ============================================================================
+// SETUP (add payment method without subscribing — Stripe-only feature)
+// ============================================================================
+
+const setupSchema = z.object({
+  type: z.enum(['user', 'organization']),
+  organizationId: z.string().uuid().optional(),
+});
+
+/**
+ * Create a Stripe Checkout session in setup mode to collect a payment method.
+ *
+ * NOTE: This endpoint is Stripe-specific. Paddle and Polar handle payment
+ * method collection differently (during checkout or via their portal).
+ * For non-Stripe providers, this endpoint returns 501.
+ */
+billingRoutes.post('/setup', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isBillingConfigured()) {
+    return c.json({ error: 'Billing is not configured' }, 503);
+  }
+
+  // Setup mode is only supported by Stripe
+  const provider = getBillingProvider();
+  if (provider.type !== 'stripe') {
+    return c.json(
+      { error: 'Setup mode is only supported with Stripe. Use the customer portal instead.' },
+      501
+    );
+  }
+
+  let body: z.infer<typeof setupSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = setupSchema.safeParse(rawBody);
+
+    if (!result.success) {
+      const errors = result.error.issues.map((e: { message: string }) => e.message).join(', ');
+      return c.json({ error: errors }, 400);
+    }
+
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  if (body.type === 'organization') {
+    if (!body.organizationId) {
+      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
+    }
+
+    const supabase = c.get('supabase');
+    const { data: membership } = await supabase
+      .from('memberships')
+      .select('role')
+      .eq('user_id', user.id)
+      .eq('organization_id', body.organizationId)
+      .single();
+
+    if (!membership || !['OWNER', 'ADMIN'].includes(membership.role)) {
+      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
+    }
+  }
+
+  try {
+    // Import Stripe directly for setup mode (Stripe-specific feature)
+    const { getStripe } = await import('../../lib/stripe');
+    const stripe = getStripe();
+
+    const { providerCustomerId } = await getOrCreateCustomer(
+      body.type,
+      user.id,
+      user.email ?? '',
+      body.organizationId
+    );
+
+    const baseUrl = env.NODE_ENV === 'production' ? process.env.SITE_URL : 'http://localhost:5173';
+    const returnUrl = `${baseUrl}/settings/billing`;
+
+    const session = await stripe.checkout.sessions.create({
+      customer: providerCustomerId,
+      mode: 'setup',
+      payment_method_types: ['card'],
+      success_url: `${returnUrl}?setup=success`,
+      cancel_url: `${returnUrl}?setup=canceled`,
+      metadata: {
+        type: body.type,
+        user_id: user.id,
+        organization_id: body.organizationId || '',
+      },
+    });
+
+    return c.json({
+      sessionId: session.id,
+      url: session.url,
+    });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to create setup session') }, 500);
+  }
+});
+
+// ============================================================================
+// CUSTOMER PORTAL
+// ============================================================================
+
+/**
+ * Create a customer portal session via the active billing provider
+ */
+billingRoutes.post('/portal', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isBillingConfigured()) {
+    return c.json({ error: 'Billing is not configured' }, 503);
+  }
+
+  // Parse and validate request body
+  let body: z.infer<typeof portalSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = portalSchema.safeParse(rawBody);
+
+    if (!result.success) {
+      const errors = result.error.issues.map((e: { message: string }) => e.message).join(', ');
+      return c.json({ error: errors }, 400);
+    }
+
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  // Validate organization access if billing for organization
+  if (body.type === 'organization') {
+    if (!body.organizationId) {
+      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
+    }
+
+    const supabase = c.get('supabase');
+    const { data: membership } = await supabase
+      .from('memberships')
+      .select('role')
+      .eq('user_id', user.id)
+      .eq('organization_id', body.organizationId)
+      .single();
+
+    if (!membership || !['OWNER', 'ADMIN'].includes(membership.role)) {
+      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
+    }
+  }
+
+  try {
+    // Find existing customer
+    const query = adminDb.from('customers').select('stripe_customer_id');
+
+    if (body.type === 'user') {
+      query.eq('user_id', user.id).is('organization_id', null);
+    } else {
+      query.eq('organization_id', body.organizationId).is('user_id', null);
+    }
+
+    const { data: customer, error: fetchError } = await query.maybeSingle();
+
+    if (fetchError) {
+      return c.json({ error: sanitizeError(fetchError, 'Failed to fetch customer') }, 500);
+    }
+
+    if (!customer) {
+      return c.json({ error: 'No billing account found. Please subscribe first.' }, 404);
+    }
+
+    const provider = getBillingProvider();
+    const baseUrl = env.NODE_ENV === 'production' ? process.env.SITE_URL : 'http://localhost:5173';
+    const defaultReturnUrl = `${baseUrl}/settings/billing`;
+    const returnUrl =
+      (body.returnUrl && baseUrl ? validateRedirectUrl(body.returnUrl, baseUrl) : null) ||
+      defaultReturnUrl;
+
+    const result = await provider.createPortalSession({
+      customerId: customer.stripe_customer_id,
+      returnUrl,
+    });
+
+    return c.json({
+      url: result.url,
+    });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to create portal session') }, 500);
+  }
+});
+
+// ============================================================================
+// LICENSE CHECKOUT (public, no auth — one-time license purchases)
+// ============================================================================
+
+const licenseCheckoutSchema = z.object({
+  email: z.string().email('Valid email is required'),
+  tier: z.enum(['diamond', 'fullerene']),
+});
+
+const TIER_PRICE_IDS: Record<string, string | undefined> = {
+  diamond: env.DIAMOND_PRICE_ID,
+  fullerene: env.FULLERENE_PRICE_ID,
+};
+
+/**
+ * Create a one-time payment checkout session for a license tier.
+ * No authentication required — collects email for the provider.
+ */
+billingRoutes.post('/license-checkout', async (c) => {
+  if (!isBillingConfigured()) {
+    return c.json({ error: 'Billing is not configured' }, 503);
+  }
+
+  let body: z.infer<typeof licenseCheckoutSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = licenseCheckoutSchema.safeParse(rawBody);
+    if (!result.success) {
+      const errors = result.error.issues.map((e: { message: string }) => e.message).join(', ');
+      return c.json({ error: errors }, 400);
+    }
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  const priceId = TIER_PRICE_IDS[body.tier];
+  if (!priceId) {
+    return c.json({ error: `Price not configured for ${body.tier} tier` }, 503);
+  }
+
+  try {
+    const provider = getBillingProvider();
+
+    // Create a customer with the provided email
+    const customerId = await provider.createCustomer({
+      email: body.email,
+      name: body.email,
+      metadata: { tier: body.tier, source: 'license-checkout' },
+    });
+
+    const baseUrl = env.NODE_ENV === 'production' ? process.env.SITE_URL : 'http://localhost:5173';
+    const successUrl = `${baseUrl}/checkout?success=true&tier=${body.tier}`;
+    const cancelUrl = `${baseUrl}/checkout?tier=${body.tier}`;
+
+    const result = await provider.createCheckout({
+      customerId,
+      priceId,
+      successUrl,
+      cancelUrl,
+      metadata: { tier: body.tier, email: body.email, type: 'license' },
+      mode: 'payment',
+    });
+
+    return c.json({ url: result.url });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to create checkout session') }, 500);
+  }
+});
+
+export { billingRoutes };