vibecarbon 0.1.0

package/carbon/src/server/routes/v1/newsletter.ts

@@ -0,0 +1,181 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { sendEmail } from '../../lib/email';
+import { env } from '../../lib/env';
+import { sanitizeError } from '../../lib/errors';
+import { logger } from '../../lib/logger';
+import { createRateLimiter } from '../../lib/rate-limiter';
+import { supabaseAdmin } from '../../lib/supabase';
+import type { HonoVariables } from '../../types';
+
+// biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
+const adminDb = supabaseAdmin as SupabaseClient<any>;
+
+const newsletterRoutes = new Hono<{ Variables: HonoVariables }>();
+
+// Rate limiting for subscribe (10 per 15 minutes per IP)
+newsletterRoutes.use('/subscribe', createRateLimiter({ windowMs: 15 * 60 * 1000, max: 10 }));
+
+const subscribeSchema = z.object({
+  email: z.string().email('Valid email is required').max(200),
+  name: z.string().max(200).optional(),
+});
+
+/**
+ * Subscribe to newsletter (public, rate-limited)
+ * Uses double opt-in: sends confirmation email with token.
+ */
+newsletterRoutes.post('/subscribe', async (c) => {
+  let body: z.infer<typeof subscribeSchema>;
+  try {
+    const rawBody = await c.req.json();
+    const result = subscribeSchema.safeParse(rawBody);
+    if (!result.success) {
+      return c.json({ error: result.error.issues.map((e) => e.message).join(', ') }, 400);
+    }
+    body = result.data;
+  } catch {
+    return c.json({ error: 'Invalid JSON body' }, 400);
+  }
+
+  try {
+    // Check if already subscribed
+    const { data: existing } = await adminDb
+      .from('newsletter_subscribers')
+      .select('id, status')
+      .eq('email', body.email)
+      .maybeSingle();
+
+    if (existing?.status === 'active') {
+      // Already subscribed — don't reveal this to prevent email enumeration
+      return c.json({ success: true, message: 'Check your email to confirm your subscription.' });
+    }
+
+    if (existing?.status === 'pending') {
+      // Resend confirmation
+      return c.json({ success: true, message: 'Check your email to confirm your subscription.' });
+    }
+
+    // Insert or update (if previously unsubscribed)
+    const { data: subscriber, error: insertError } = await adminDb
+      .from('newsletter_subscribers')
+      .upsert(
+        {
+          email: body.email,
+          name: body.name || null,
+          status: 'pending',
+          confirmation_token: crypto.randomUUID(),
+          unsubscribed_at: null,
+        },
+        { onConflict: 'email' }
+      )
+      .select('confirmation_token')
+      .single();
+
+    if (insertError) {
+      logger.error({ error: insertError }, 'Failed to create newsletter subscriber');
+      return c.json({ error: sanitizeError(insertError, 'Failed to subscribe') }, 500);
+    }
+
+    // Send confirmation email (double opt-in)
+    const baseUrl = env.SITE_URL || 'http://localhost:5173';
+    const confirmUrl = `${baseUrl}/api/v1/newsletter/confirm?token=${subscriber.confirmation_token}`;
+
+    sendEmail({
+      to: body.email,
+      subject: 'Confirm your newsletter subscription',
+      html: `<h2>Confirm Your Subscription</h2>
+<p>Click the link below to confirm your newsletter subscription:</p>
+<p style="text-align: center; margin: 24px 0;">
+  <a href="${confirmUrl}" style="display: inline-block; padding: 10px 24px; background: #18181b; color: #fff; text-decoration: none; border-radius: 6px; font-weight: 500;">Confirm Subscription</a>
+</p>
+<p style="font-size: 12px; color: #71717a;">If you didn't request this, you can safely ignore this email.</p>`,
+    }).catch((err) => {
+      logger.error({ error: err }, 'Failed to send newsletter confirmation email');
+    });
+
+    return c.json({ success: true, message: 'Check your email to confirm your subscription.' });
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to subscribe') }, 500);
+  }
+});
+
+/**
+ * Confirm newsletter subscription (via email link)
+ */
+newsletterRoutes.get('/confirm', async (c) => {
+  const token = c.req.query('token');
+
+  if (!token) {
+    return c.json({ error: 'Missing confirmation token' }, 400);
+  }
+
+  try {
+    const { data, error } = await adminDb
+      .from('newsletter_subscribers')
+      .update({
+        status: 'active',
+        subscribed_at: new Date().toISOString(),
+        confirmation_token: null,
+      })
+      .eq('confirmation_token', token)
+      .eq('status', 'pending')
+      .select('email')
+      .maybeSingle();
+
+    if (error) {
+      return c.json({ error: sanitizeError(error, 'Failed to confirm') }, 500);
+    }
+
+    if (!data) {
+      return c.json({ error: 'Invalid or expired confirmation link' }, 400);
+    }
+
+    // Redirect to homepage with success
+    const baseUrl = env.SITE_URL || 'http://localhost:5173';
+    return c.redirect(`${baseUrl}/?newsletter=confirmed`);
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to confirm') }, 500);
+  }
+});
+
+/**
+ * Unsubscribe from newsletter (via email link)
+ */
+newsletterRoutes.get('/unsubscribe', async (c) => {
+  const email = c.req.query('email');
+  const token = c.req.query('token');
+
+  if (!email) {
+    return c.json({ error: 'Missing email' }, 400);
+  }
+
+  try {
+    const query = adminDb
+      .from('newsletter_subscribers')
+      .update({
+        status: 'unsubscribed',
+        unsubscribed_at: new Date().toISOString(),
+      })
+      .eq('email', email);
+
+    // If token provided, verify it matches (for one-click unsubscribe)
+    if (token) {
+      query.eq('id', token);
+    }
+
+    const { error } = await query;
+
+    if (error) {
+      return c.json({ error: sanitizeError(error, 'Failed to unsubscribe') }, 500);
+    }
+
+    const baseUrl = env.SITE_URL || 'http://localhost:5173';
+    return c.redirect(`${baseUrl}/?newsletter=unsubscribed`);
+  } catch (error) {
+    return c.json({ error: sanitizeError(error, 'Failed to unsubscribe') }, 500);
+  }
+});
+
+export { newsletterRoutes };

package/carbon/src/server/routes/v1/performance.ts

@@ -0,0 +1,157 @@
+import { Hono } from 'hono';
+import { isSuperAdmin } from '../../lib/auth';
+import { logger } from '../../lib/logger';
+import type { HonoVariables } from '../../types';
+
+const performanceRoutes = new Hono<{ Variables: HonoVariables }>();
+
+// Detect runtime environment (same logic as services-status.ts)
+const isKubernetes = !!process.env.KUBERNETES_SERVICE_HOST;
+const isDocker =
+  !isKubernetes && (process.env.NODE_ENV === 'production' || process.env.DOCKER === 'true');
+
+interface ServiceHealthCheck {
+  name: string;
+  url: string;
+  acceptCodes?: number[];
+}
+
+// Core services to check latency against (subset of services-status.ts)
+const HEALTH_CHECK_SERVICES: ServiceHealthCheck[] = [
+  {
+    name: 'API Gateway',
+    url: isKubernetes
+      ? 'http://kong:8000/'
+      : isDocker
+        ? 'http://kong:8000/'
+        : 'http://localhost:8000/',
+    acceptCodes: [404],
+  },
+  {
+    name: 'Authentication',
+    url: isKubernetes
+      ? 'http://kong:8000/auth/v1/health'
+      : isDocker
+        ? 'http://auth:9999/health'
+        : 'http://localhost:8000/auth/v1/health',
+    acceptCodes: isDocker ? undefined : [200, 401],
+  },
+  {
+    name: 'REST API',
+    url: isKubernetes
+      ? 'http://kong:8000/rest/v1/'
+      : isDocker
+        ? 'http://rest:3000/'
+        : 'http://localhost:8000/rest/v1/',
+    acceptCodes: [200, 401],
+  },
+  {
+    name: 'Realtime',
+    url: isKubernetes
+      ? 'http://kong:8000/realtime/v1/'
+      : isDocker
+        ? 'http://realtime:4000/api/tenants'
+        : 'http://localhost:8000/realtime/v1/',
+    acceptCodes: [200, 401, 403, 426],
+  },
+  {
+    name: 'File Storage',
+    url: isKubernetes
+      ? 'http://kong:8000/storage/v1/status'
+      : isDocker
+        ? 'http://storage:5000/status'
+        : 'http://localhost:8000/storage/v1/status',
+    acceptCodes: isDocker ? undefined : [200, 401],
+  },
+  {
+    name: 'DB Management',
+    url: isKubernetes
+      ? 'http://kong:8000/pg/'
+      : isDocker
+        ? 'http://meta:8080/health'
+        : 'http://localhost:8000/pg/',
+    acceptCodes: [200, 401],
+  },
+];
+
+const SERVICE_TIMEOUT_MS = 2000;
+
+async function checkServiceLatency(
+  service: ServiceHealthCheck
+): Promise<{ name: string; latencyMs: number; status: 'healthy' | 'unhealthy' | 'unknown' }> {
+  const start = performance.now();
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), SERVICE_TIMEOUT_MS);
+
+    const response = await fetch(service.url, {
+      method: 'GET',
+      signal: controller.signal,
+    });
+    clearTimeout(timeoutId);
+
+    const latencyMs = Math.round(performance.now() - start);
+
+    const isHealthy = service.acceptCodes
+      ? service.acceptCodes.includes(response.status)
+      : response.status >= 200 && response.status < 400;
+
+    return { name: service.name, latencyMs, status: isHealthy ? 'healthy' : 'unhealthy' };
+  } catch {
+    const latencyMs = Math.round(performance.now() - start);
+    return { name: service.name, latencyMs, status: 'unhealthy' };
+  }
+}
+
+// ============================================================================
+// ADMIN PERFORMANCE ENDPOINT (Super Admin only)
+// ============================================================================
+
+performanceRoutes.get('/', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isSuperAdmin(user)) {
+    return c.json({ error: 'Super admin access required' }, 403);
+  }
+
+  // Gather server metrics
+  const mem = process.memoryUsage();
+  const server = {
+    uptimeSeconds: Math.round(process.uptime()),
+    memoryMB: {
+      rss: Math.round(mem.rss / 1024 / 1024),
+      heapUsed: Math.round(mem.heapUsed / 1024 / 1024),
+      heapTotal: Math.round(mem.heapTotal / 1024 / 1024),
+    },
+    nodeVersion: process.version,
+    platform: `${process.platform} ${process.arch}`,
+  };
+
+  // Check all service latencies in parallel
+  const items = await Promise.all(HEALTH_CHECK_SERVICES.map(checkServiceLatency));
+
+  const healthy = items.filter((s) => s.status === 'healthy').length;
+  const healthyItems = items.filter((s) => s.status === 'healthy');
+  const avgLatencyMs =
+    healthyItems.length > 0
+      ? Math.round(healthyItems.reduce((sum, s) => sum + s.latencyMs, 0) / healthyItems.length)
+      : 0;
+
+  logger.debug({ userId: user.id }, 'Admin performance metrics fetched');
+
+  return c.json({
+    server,
+    services: {
+      healthy,
+      total: items.length,
+      avgLatencyMs,
+      items,
+    },
+  });
+});
+
+export { performanceRoutes };

package/carbon/src/server/routes/v1/stats.ts

@@ -0,0 +1,170 @@
+import { Hono } from 'hono';
+import { isSuperAdmin } from '../../lib/auth';
+import { logger } from '../../lib/logger';
+import { supabaseAdmin } from '../../lib/supabase';
+import type { HonoVariables } from '../../types';
+
+const statsRoutes = new Hono<{ Variables: HonoVariables }>();
+
+/**
+ * Count organizations with an optional filter applied to the query builder.
+ * Returns 0 on any error for resilience.
+ */
+async function countOrgs(
+  // biome-ignore lint/suspicious/noExplicitAny: Supabase query builder generics are too complex to type the filter callback
+  filter?: (q: any) => PromiseLike<{ count: number | null; error: unknown }>
+): Promise<number> {
+  try {
+    const base = supabaseAdmin.from('organizations').select('*', { count: 'exact', head: true });
+    const result = filter ? await filter(base) : await base;
+    return result.error ? 0 : (result.count ?? 0);
+  } catch {
+    return 0;
+  }
+}
+
+// ============================================================================
+// ADMIN STATS ENDPOINT (Super Admin only)
+// ============================================================================
+
+statsRoutes.get('/', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isSuperAdmin(user)) {
+    return c.json({ error: 'Super admin access required' }, 403);
+  }
+
+  const now = new Date();
+
+  // Start of current month (UTC)
+  const startOfThisMonth = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+  // Start of previous month (UTC)
+  const startOfLastMonth = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() - 1, 1));
+
+  // 30 days ago and 60 days ago for active user calculations
+  const thirtyDaysAgo = new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000);
+  const sixtyDaysAgo = new Date(now.getTime() - 60 * 24 * 60 * 60 * 1000);
+
+  // 42 days ago for weekly signups (6 weeks)
+  const fortyTwoDaysAgo = new Date(now.getTime() - 42 * 24 * 60 * 60 * 1000);
+
+  // Fetch all user data with a single listUsers call, then derive all counts in-memory.
+  // Previously this made 5 separate listUsers calls with perPage: 1000 each.
+  // Now we make one call to get the total count (perPage: 1) and one call to fetch
+  // all users for segmentation. For apps with many users, pagination fetches all pages.
+  const [usersResult, totalOrgsResult, orgsNewThisMonthResult, orgsNewLastMonthResult] =
+    await Promise.all([
+      // Single listUsers call — fetch all users for date-based segmentation
+      (async () => {
+        try {
+          // First get the total count with a lightweight call
+          const countResult = await supabaseAdmin.auth.admin.listUsers({ page: 1, perPage: 1 });
+          if (countResult.error) return { total: 0, users: [] };
+          const total = countResult.data.total;
+
+          // Fetch all users (paginated if needed) for segmentation
+          const allUsers: typeof countResult.data.users = [];
+          const pageSize = 1000;
+          const totalPages = Math.ceil(total / pageSize);
+          for (let page = 1; page <= totalPages; page++) {
+            const pageResult = await supabaseAdmin.auth.admin.listUsers({
+              page,
+              perPage: pageSize,
+            });
+            if (pageResult.error) break;
+            allUsers.push(...pageResult.data.users);
+          }
+          return { total, users: allUsers };
+        } catch {
+          return { total: 0, users: [] };
+        }
+      })(),
+
+      // Total organizations
+      countOrgs(),
+
+      // Organizations created this month
+      countOrgs((q) => q.gte('created_at', startOfThisMonth.toISOString())),
+
+      // Organizations created last month
+      countOrgs((q) =>
+        q
+          .gte('created_at', startOfLastMonth.toISOString())
+          .lt('created_at', startOfThisMonth.toISOString())
+      ),
+    ]);
+
+  // Derive all user stats from the single fetched dataset
+  const { total: totalUsersResult, users: allUsers } = usersResult;
+
+  const newThisMonthResult = allUsers.filter(
+    (u) => new Date(u.created_at) >= startOfThisMonth
+  ).length;
+
+  const newLastMonthResult = allUsers.filter(
+    (u) => new Date(u.created_at) >= startOfLastMonth && new Date(u.created_at) < startOfThisMonth
+  ).length;
+
+  const activeThisMonthResult = allUsers.filter(
+    (u) => u.last_sign_in_at && new Date(u.last_sign_in_at) >= thirtyDaysAgo
+  ).length;
+
+  const activeLastMonthResult = allUsers.filter(
+    (u) =>
+      u.last_sign_in_at &&
+      new Date(u.last_sign_in_at) >= sixtyDaysAgo &&
+      new Date(u.last_sign_in_at) < thirtyDaysAgo
+  ).length;
+
+  const weeklySignupsResult = bucketIntoWeeks(
+    allUsers
+      .filter((u) => new Date(u.created_at) >= fortyTwoDaysAgo)
+      .map((u) => new Date(u.created_at)),
+    fortyTwoDaysAgo
+  );
+
+  logger.debug({ userId: user.id }, 'Admin stats fetched');
+
+  return c.json({
+    users: {
+      total: totalUsersResult,
+      newThisMonth: newThisMonthResult,
+      newLastMonth: newLastMonthResult,
+      activeThisMonth: activeThisMonthResult,
+      activeLastMonth: activeLastMonthResult,
+      weeklySignups: weeklySignupsResult,
+    },
+    orgs: {
+      total: totalOrgsResult,
+      newThisMonth: orgsNewThisMonthResult,
+      newLastMonth: orgsNewLastMonthResult,
+    },
+  });
+});
+
+/**
+ * Bucket an array of dates into 6 weekly buckets.
+ * Week 1 = oldest (starts at `from`), Week 6 = most recent.
+ */
+function bucketIntoWeeks(dates: Date[], from: Date): Array<{ week: string; count: number }> {
+  const msPerWeek = 7 * 24 * 60 * 60 * 1000;
+  const buckets = [0, 0, 0, 0, 0, 0];
+
+  for (const date of dates) {
+    const weekIndex = Math.min(Math.floor((date.getTime() - from.getTime()) / msPerWeek), 5);
+    if (weekIndex >= 0 && weekIndex <= 5) {
+      buckets[weekIndex]++;
+    }
+  }
+
+  return buckets.map((count, i) => ({
+    week: `W${i + 1}`,
+    count,
+  }));
+}
+
+export { statsRoutes };

package/carbon/src/server/routes/v1/theme.ts

@@ -0,0 +1,106 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { isSuperAdmin } from '../../lib/auth';
+import { logger } from '../../lib/logger';
+import { supabaseAdmin } from '../../lib/supabase';
+import type { HonoVariables } from '../../types';
+
+const themeRoutes = new Hono<{ Variables: HonoVariables }>();
+
+// Zod schema for theme validation — all fields optional
+const colorSchemaFields = {
+  primary: z.string().optional(),
+  primaryDim: z.string().optional(),
+  primaryForeground: z.string().optional(),
+  secondaryAccent: z.string().optional(),
+  secondaryAccentForeground: z.string().optional(),
+  destructive: z.string().optional(),
+  warning: z.string().optional(),
+  success: z.string().optional(),
+};
+
+const themeSchema = z.object({
+  light: z.object(colorSchemaFields).optional(),
+  dark: z
+    .object({
+      primary: z.string().optional(),
+      primaryDim: z.string().optional(),
+      primaryForeground: z.string().optional(),
+      secondaryAccent: z.string().optional(),
+      secondaryAccentForeground: z.string().optional(),
+    })
+    .optional(),
+  radius: z.string().optional(),
+  smoothScrollEnabled: z.boolean().optional(),
+  smoothScrollIntensity: z.number().min(0).max(100).optional(),
+});
+
+// ============================================================================
+// GET / — Public. Returns the current app theme.
+// ============================================================================
+
+themeRoutes.get('/', async (c): Promise<Response> => {
+  try {
+    const { data, error } = await supabaseAdmin
+      .from('app_settings')
+      .select('value')
+      .eq('key', 'app_theme')
+      .single();
+
+    if (error || !data) {
+      logger.debug({ error }, 'No app_theme found, returning default');
+      return c.json({ theme: {} });
+    }
+
+    return c.json({ theme: data.value });
+  } catch (err) {
+    logger.error({ error: err }, 'Failed to fetch app theme');
+    return c.json({ theme: {} });
+  }
+});
+
+// ============================================================================
+// PATCH / — Super admin only. Upserts the app theme.
+// ============================================================================
+
+themeRoutes.patch('/', async (c) => {
+  const user = c.get('user');
+
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  if (!isSuperAdmin(user)) {
+    return c.json({ error: 'Super admin access required' }, 403);
+  }
+
+  // Validate request body
+  const body = await c.req.json();
+  const parsed = themeSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return c.json({ error: 'Invalid theme data', details: parsed.error.flatten() }, 400);
+  }
+
+  const theme = parsed.data;
+
+  try {
+    const { error } = await supabaseAdmin
+      .from('app_settings')
+      .upsert({ key: 'app_theme', value: theme, updated_by: user.id }, { onConflict: 'key' });
+
+    if (error) {
+      logger.error({ error, userId: user.id }, 'Failed to save app theme');
+      return c.json({ error: 'Failed to save theme' }, 500);
+    }
+
+    logger.info({ userId: user.id }, 'App theme updated');
+
+    return c.json({ success: true, theme });
+  } catch (err) {
+    logger.error({ error: err, userId: user.id }, 'Failed to save app theme');
+    return c.json({ error: 'Failed to save theme' }, 500);
+  }
+});
+
+export { themeRoutes };