vibecarbon 0.9.0 → 0.10.0

package/carbon/src/client/locales/fr.json

@@ -293,7 +293,7 @@
       },
       "deploy": {
         "label": "Déployer",
-        "description": "Déploie en production avec mise à l'échelle automatique, haute disponibilité, monitoring, CI/CD et plus encore."
+        "description": "Déploie en production avec mise à l'échelle, haute disponibilité, monitoring, CI/CD et plus encore."
       }
     },
     "techStack": {
@@ -352,7 +352,7 @@
       "traffic": {
         "risk": "Ne supporte pas le trafic",
         "protection": "Mise à l'échelle automatique",
-        "how": "Kubernetes autoscaling sur les pods et les nœuds VPS"
+        "how": "Autoscaling des pods Kubernetes plus mise à l'échelle des workers en une commande"
       },
       "redundancy": {
         "risk": "Zéro redondance",
@@ -401,25 +401,40 @@
       "compose": {
         "name": "Docker Compose",
         "tagline": "Un VPS, toute votre stack incluse.",
-        "features": ["1 serveur", "Région unique"],
+        "features": [
+          "1 serveur",
+          "Région unique"
+        ],
         "bestFor": "MVP et outils internes"
       },
       "composeHa": {
         "name": "Compose HA",
-        "tagline": "Deux serveurs, bascule automatique.",
-        "features": ["2 serveurs", "Réplication en flux", "Bascule automatique"],
+        "tagline": "Deux régions, bascule en une commande.",
+        "features": [
+          "2 serveurs",
+          "Réplication en flux",
+          "Bascule en une commande"
+        ],
         "bestFor": "SaaS en production sans Kubernetes"
       },
       "k8s": {
         "name": "Kubernetes",
-        "tagline": "Cluster k3s à mise à l'échelle automatique.",
-        "features": ["Région unique", "Mise à l'échelle horizontale", "Mises à jour progressives"],
+        "tagline": "Cluster k3s de production.",
+        "features": [
+          "Région unique",
+          "Mise à l'échelle horizontale",
+          "Mises à jour progressives"
+        ],
         "bestFor": "Applications à fort trafic"
       },
       "k8sHa": {
         "name": "Kubernetes HA",
         "tagline": "Clusters multi-région, disponibilité maximale.",
-        "features": ["2 régions", "Bascule de région", "Mise à l'échelle auto"],
+        "features": [
+          "2 régions",
+          "Bascule de région",
+          "Autoscaling des pods"
+        ],
         "bestFor": "Critique et mondial"
       }
     },
@@ -459,7 +474,7 @@
           "backups": "Sauvegardes S3 automatisées",
           "cicd": "CI/CD via GitHub Actions",
           "unlimited": "Serveurs et projets illimités",
-          "commercial": "Droits d'usage commercial"
+          "commercial": "Exception FSL (intégration, marque blanche, revente)"
         }
       },
       "fullerene": {
@@ -467,7 +482,7 @@
         "cta": "Passer à Fullerene",
         "features": {
           "diamond": "Tout ce qu'inclut Diamond",
-          "commercial": "Droits d'usage commercial (exception AGPL)",
+          "commercial": "Exception FSL : intégrer, proposer en marque blanche ou revendre des services propulsés par Vibecarbon",
           "clients": "Déployez pour des clients et des organisations",
           "corporate": "Équipes d'agence et d'entreprise",
           "support": "Support e-mail prioritaire",
@@ -496,7 +511,7 @@
       },
       "q5": {
         "question": "Comment fonctionne la tarification ?",
-        "answer": "Graphite est gratuit pour toujours — crée des projets, développe localement et utilise tous les modules. Diamond (149 $ à vie) offre une automatisation complète pour les indie hackers et startups — tous les modes de déploiement, sauvegardes, CI/CD et mise à l'échelle. Fullerene (499 $ à vie) est la licence commerciale pour les agences et l'entreprise — déploie pour des clients et organisations sans restrictions AGPL. Paiement unique, sans abonnement."
+        "answer": "Graphite est gratuit pour toujours — crée des projets, développe localement et utilise tous les modules. Diamond (149 $ à vie) offre une automatisation complète pour les indie hackers et startups — tous les modes de déploiement, sauvegardes, CI/CD et mise à l'échelle. Fullerene (499 $ à vie) s'adresse aux agences et à l'entreprise — déploie pour des clients, avec en plus l'exception FSL pour intégrer, proposer en marque blanche ou revendre des services propulsés par Vibecarbon. Paiement unique, sans abonnement."
       },
       "q6": {
         "question": "Combien de projets puis-je créer avec une seule licence ?",
@@ -508,7 +523,7 @@
       },
       "q8": {
         "question": "Que se passe-t-il si Vibecarbon ferme ses portes ?",
-        "answer": "Rien ne change pour votre application. Le code généré est sous licence MIT et n'a aucune dépendance d'exécution envers Vibecarbon — c'est simplement une base de code qui vous appartient entièrement. La CLI est open source sous AGPL, vous pouvez donc l'exécuter à partir des sources indéfiniment. Votre infrastructure tourne sur vos propres serveurs."
+        "answer": "Rien ne change pour votre application. Le code généré est sous licence MIT et n'a aucune dépendance d'exécution envers Vibecarbon — c'est simplement une base de code qui vous appartient entièrement. La CLI est Fair Source (FSL) — vous pouvez l'exécuter à partir des sources indéfiniment pour tout usage non concurrent, et chaque version devient open source MIT deux ans après sa publication. Votre infrastructure tourne sur vos propres serveurs."
       },
       "q9": {
         "question": "Faut-il avoir une expérience DevOps pour déployer ?",

package/carbon/src/client/locales/pt.json

@@ -293,7 +293,7 @@
       },
       "deploy": {
         "label": "Publicar",
-        "description": "Publica em produção com auto-scaling, alta disponibilidade, monitorização, CI/CD e muito mais."
+        "description": "Publica em produção com escalonamento, alta disponibilidade, monitorização, CI/CD e muito mais."
       }
     },
     "techStack": {
@@ -352,7 +352,7 @@
       "traffic": {
         "risk": "Incapaz de escalar",
         "protection": "Auto-scaling",
-        "how": "Auto-scaling Kubernetes em pods e nós VPS"
+        "how": "Auto-scaling de pods Kubernetes mais escalonamento de workers com um comando"
       },
       "redundancy": {
         "risk": "Sem redundância",
@@ -401,25 +401,40 @@
       "compose": {
         "name": "Docker Compose",
         "tagline": "Um VPS, com toda a sua stack incluída.",
-        "features": ["1 servidor", "Região única"],
+        "features": [
+          "1 servidor",
+          "Região única"
+        ],
         "bestFor": "MVPs e ferramentas internas"
       },
       "composeHa": {
         "name": "Compose HA",
-        "tagline": "Dois servidores, failover automático.",
-        "features": ["2 servidores", "Replicação em streaming", "Failover automático"],
+        "tagline": "Duas regiões, failover com um comando.",
+        "features": [
+          "2 servidores",
+          "Replicação em streaming",
+          "Failover com um comando"
+        ],
         "bestFor": "SaaS em produção sem Kubernetes"
       },
       "k8s": {
         "name": "Kubernetes",
-        "tagline": "Cluster k3s com escalonamento automático.",
-        "features": ["Região única", "Escalonamento horizontal", "Atualizações graduais"],
+        "tagline": "Cluster k3s pronto para produção.",
+        "features": [
+          "Região única",
+          "Escalonamento horizontal",
+          "Atualizações graduais"
+        ],
         "bestFor": "Apps de alto tráfego"
       },
       "k8sHa": {
         "name": "Kubernetes HA",
         "tagline": "Clusters multirregião, disponibilidade máxima.",
-        "features": ["2 regiões", "Failover de região", "Escalonamento automático"],
+        "features": [
+          "2 regiões",
+          "Failover de região",
+          "Auto-scaling de pods"
+        ],
         "bestFor": "Crítico e global"
       }
     },
@@ -459,7 +474,7 @@
           "backups": "Backups S3 automáticos",
           "cicd": "CI/CD via GitHub Actions",
           "unlimited": "Servidores e projetos ilimitados",
-          "commercial": "Direitos de uso comercial"
+          "commercial": "Exceção FSL (integração, white-label, revenda)"
         }
       },
       "fullerene": {
@@ -467,7 +482,7 @@
         "cta": "Ir para Fullerene",
         "features": {
           "diamond": "Tudo do Diamond",
-          "commercial": "Direitos de uso comercial (exceção AGPL)",
+          "commercial": "Exceção FSL: integrar, oferecer white-label ou revender serviços baseados no Vibecarbon",
           "clients": "Implante para clientes e organizações",
           "corporate": "Equipas de agência e empresas",
           "support": "Suporte prioritário por e-mail",
@@ -496,7 +511,7 @@
       },
       "q5": {
         "question": "Como funciona o modelo de preços?",
-        "answer": "O Graphite é gratuito para sempre — cria projetos, desenvolve localmente e usa todos os add-ons. O Diamond (149 $ vitalício) é automatização completa para indie hackers e startups — todos os modos de deployment, backups, CI/CD e escalamento. O Fullerene (499 $ vitalício) é a licença comercial para agências e empresas — faz deployment para clientes e organizações sem restrições AGPL. Pagamento único, sem subscrições."
+        "answer": "O Graphite é gratuito para sempre — cria projetos, desenvolve localmente e usa todos os add-ons. O Diamond (149 $ vitalício) é automatização completa para indie hackers e startups — todos os modos de deployment, backups, CI/CD e escalamento. O Fullerene (499 $ vitalício) é para agências e empresas — faz deployment para clientes, mais a exceção FSL para integrar, oferecer white-label ou revender serviços baseados no Vibecarbon. Pagamento único, sem subscrições."
       },
       "q6": {
         "question": "Quantos projetos posso criar com uma licença?",
@@ -508,7 +523,7 @@
       },
       "q8": {
         "question": "O que acontece se o Vibecarbon encerrar?",
-        "answer": "Nada muda para a sua aplicação. O código gerado tem licença MIT sem qualquer dependência em tempo de execução do Vibecarbon — é apenas uma base de código que lhe pertence por completo. A CLI é open source sob AGPL, por isso pode executá-la a partir do código-fonte indefinidamente. A sua infraestrutura corre nos seus próprios servidores."
+        "answer": "Nada muda para a sua aplicação. O código gerado tem licença MIT sem qualquer dependência em tempo de execução do Vibecarbon — é apenas uma base de código que lhe pertence por completo. A CLI é Fair Source (FSL) — pode executá-la a partir do código-fonte indefinidamente para qualquer uso não concorrente, e cada versão torna-se open source MIT dois anos após a publicação. A sua infraestrutura corre nos seus próprios servidores."
       },
       "q9": {
         "question": "Preciso de experiência em DevOps para implantar?",

package/carbon/src/client/pages/Checkout.tsx

@@ -52,7 +52,7 @@ const tierData: Record<string, TierInfo> = {
     gradientClass: 'from-secondary-accent to-fuchsia-400',
     features: [
       'Everything in Diamond',
-      'Commercial use rights (AGPL exception)',
+      'FSL exception: embed, white-label, or resell Vibecarbon-powered services',
       'Deploy for clients & organizations',
       'Agency & enterprise teams',
       'Priority email support',

package/carbon/src/server/billing/providers/paddle.ts

@@ -7,7 +7,7 @@
  * Paddle API docs: https://developer.paddle.com/api-reference/overview
  */
 
-import { createHmac } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { env } from '../../lib/env';
 import { logger } from '../../lib/logger';
 import type { BillingProvider, CheckoutResult, PortalResult, SubscriptionInfo } from '../provider';
@@ -224,9 +224,28 @@ export class PaddleProvider implements BillingProvider {
       .update(payload)
       .digest('hex');
 
-    if (expectedHash !== providedHash) {
+    // SECURITY: constant-time comparison to avoid leaking the expected HMAC via
+    // response-timing. `!==` short-circuits on the first differing byte, which
+    // is a classic signature-forgery oracle. Encode as bytes and compare with
+    // timingSafeEqual (guarding the length first, since it throws on mismatch).
+    const expectedBuf = Buffer.from(expectedHash, 'hex');
+    const providedBuf = Buffer.from(providedHash, 'hex');
+    if (expectedBuf.length !== providedBuf.length || !timingSafeEqual(expectedBuf, providedBuf)) {
       throw new Error('Invalid Paddle webhook signature');
     }
+
+    // SECURITY: reject stale events to blunt replay attacks. A captured, validly
+    // signed payload can otherwise be resent forever. Mirror Stripe/Polar's
+    // 5-minute tolerance. Paddle's `ts` is a Unix timestamp in seconds.
+    const timestampSec = Number.parseInt(timestamp, 10);
+    if (!Number.isFinite(timestampSec)) {
+      throw new Error('Invalid Paddle webhook timestamp');
+    }
+    const ageSec = Math.abs(Date.now() / 1000 - timestampSec);
+    const TOLERANCE_SEC = 5 * 60;
+    if (ageSec > TOLERANCE_SEC) {
+      throw new Error('Paddle webhook timestamp outside tolerance');
+    }
   }
 
   /** Map Paddle event types to normalized billing event names. */

package/carbon/src/server/billing/providers/polar.ts

@@ -244,6 +244,20 @@ export class PolarProvider implements BillingProvider {
     if (!matched) {
       throw new Error('Invalid Polar webhook signature');
     }
+
+    // SECURITY: reject stale events to blunt replay attacks. A captured, validly
+    // signed payload can otherwise be resent forever to re-assert subscription
+    // state. Standard Webhooks timestamps are Unix seconds; use the same
+    // 5-minute tolerance as the Paddle/Stripe verifiers.
+    const timestampSec = Number.parseInt(timestamp, 10);
+    if (!Number.isFinite(timestampSec)) {
+      throw new Error('Invalid Polar webhook timestamp');
+    }
+    const ageSec = Math.abs(Date.now() / 1000 - timestampSec);
+    const TOLERANCE_SEC = 5 * 60;
+    if (ageSec > TOLERANCE_SEC) {
+      throw new Error('Polar webhook timestamp outside tolerance');
+    }
   }
 
   /** Map Polar event types to normalized billing event names. */

package/carbon/src/server/index.ts

@@ -1,6 +1,7 @@
 import { serve } from '@hono/node-server';
 import { serveStatic } from '@hono/node-server/serve-static';
 import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
 import { cors } from 'hono/cors';
 import { logger as honoLogger } from 'hono/logger';
 import { secureHeaders } from 'hono/secure-headers';
@@ -124,15 +125,17 @@ app.use(
   })
 );
 
-// Request body size limit middleware
-app.use('/api/*', async (c, next) => {
-  const contentLength = Number.parseInt(c.req.header('content-length') || '0', 10);
-  const maxSize = 10 * 1024 * 1024; // 10MB
-  if (contentLength > maxSize) {
-    return c.json({ error: 'Request body too large' }, 413);
-  }
-  await next();
-});
+// Request body size limit. bodyLimit enforces the cap while READING the stream,
+// not just by trusting the Content-Length header (which a client can under-state
+// or omit with chunked transfer-encoding to smuggle an oversized body past a
+// header-only check).
+app.use(
+  '/api/*',
+  bodyLimit({
+    maxSize: 10 * 1024 * 1024, // 10MB
+    onError: (c) => c.json({ error: 'Request body too large' }, 413),
+  })
+);
 
 // Supabase session middleware - inject user and client into context
 // Skip for health endpoint (no auth needed, avoids unnecessary getUser() call)

package/carbon/src/server/lib/client-ip.ts

@@ -0,0 +1,68 @@
+import { env } from './env';
+import { logger } from './logger';
+
+// Minimal shape so both Hono's full `Context` and lightweight test doubles work.
+type HasHeader = { req: { header: (name: string) => string | undefined } };
+
+const ipv4Regex = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+const ipv6Regex = /^[a-fA-F0-9:]+$/;
+
+export function isValidIp(ip: string): boolean {
+  return ipv4Regex.test(ip) || ipv6Regex.test(ip);
+}
+
+// Log the "no trusted IP" warning at most once per process to avoid log spam.
+let warnedAboutMissingIP = false;
+
+/**
+ * Resolve the client IP from a trusted reverse proxy.
+ *
+ * SECURITY: `X-Forwarded-For` is an ordered list where each proxy APPENDS the
+ * address of the host it received the connection from. With N trusted proxy
+ * hops in front of this server (`TRUSTED_PROXY_HOPS`, default 1 = Traefik), the
+ * real client IP is the Nth entry counted from the RIGHT. Every entry to the
+ * left of that is attacker-supplied and MUST be ignored — trusting the leftmost
+ * value (as the previous implementations did) lets a client spoof an arbitrary
+ * IP and mint fresh rate-limit / login-lockout buckets at will.
+ *
+ * We deliberately do NOT fall back to `x-real-ip` / `cf-connecting-ip`: Traefik
+ * does not set those, so an attacker could forge them. When a trusted IP can't
+ * be derived we return a shared sentinel ('unknown') so those requests share a
+ * single, more-restrictive bucket (fail closed).
+ */
+export function getClientIp(c: HasHeader, hops: number = env.TRUSTED_PROXY_HOPS): string {
+  const xff = c.req.header('x-forwarded-for');
+
+  if (xff && hops > 0) {
+    const ips = xff
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean);
+
+    // Need at least `hops` entries for the depth-from-right index to land on a
+    // proxy-written value rather than an attacker-supplied one.
+    if (ips.length >= hops) {
+      const candidate = ips[ips.length - hops];
+      if (isValidIp(candidate)) {
+        return candidate;
+      }
+    }
+  }
+
+  // In development there is typically no reverse proxy in front of the server.
+  if (env.NODE_ENV === 'development') {
+    return 'localhost';
+  }
+
+  if (!warnedAboutMissingIP) {
+    warnedAboutMissingIP = true;
+    logger.warn(
+      'Could not determine a trusted client IP from X-Forwarded-For. Ensure the reverse ' +
+        'proxy (Traefik) sets X-Forwarded-For and that TRUSTED_PROXY_HOPS matches the number ' +
+        'of trusted proxies in front of this server. Requests without a trusted IP share a ' +
+        'single rate-limit bucket.'
+    );
+  }
+
+  return 'unknown';
+}

package/carbon/src/server/lib/env.ts

@@ -1,5 +1,14 @@
 import { z } from 'zod';
 
+/**
+ * Parse a boolean env var strictly: only the literal string "true" is true.
+ * `z.coerce.boolean()` is NOT usable here — it treats any non-empty string
+ * (including "false") as `true`. Empty strings are stripped to `undefined`
+ * before validation (see cleanedEnv below), so they fall back to `def`.
+ */
+const envBool = (def: boolean) =>
+  z.preprocess((v) => (v === undefined ? def : v === 'true'), z.boolean());
+
 const envSchema = z.object({
   // Supabase (required)
   SUPABASE_URL: z.string().url(),
@@ -27,12 +36,12 @@ const envSchema = z.object({
   DEV_LOKI_PORT: z.coerce.number().optional(),
 
   // OAuth (optional - configure in Supabase dashboard)
-  GOOGLE_ENABLED: z.coerce.boolean().default(false),
-  MICROSOFT_ENABLED: z.coerce.boolean().default(false),
-  GITHUB_ENABLED: z.coerce.boolean().default(false),
-  APPLE_ENABLED: z.coerce.boolean().default(false),
-  DISCORD_ENABLED: z.coerce.boolean().default(false),
-  MAGIC_LINK_ENABLED: z.coerce.boolean().default(true),
+  GOOGLE_ENABLED: envBool(false),
+  MICROSOFT_ENABLED: envBool(false),
+  GITHUB_ENABLED: envBool(false),
+  APPLE_ENABLED: envBool(false),
+  DISCORD_ENABLED: envBool(false),
+  MAGIC_LINK_ENABLED: envBool(true),
 
   // SMTP (shared with Supabase Auth)
   SMTP_HOST: z.string().optional(),
@@ -72,6 +81,11 @@ const envSchema = z.object({
   // Redis (optional - for distributed rate limiting)
   // Format: redis://[:password@]host:port or redis://[:password@]host:port/db
   REDIS_URL: z.string().url().optional(),
+
+  // Number of trusted reverse-proxy hops in front of this server. Used to pick
+  // the real client IP out of X-Forwarded-For (see lib/client-ip.ts). The
+  // default single hop matches the standard Traefik deployment.
+  TRUSTED_PROXY_HOPS: z.coerce.number().int().min(0).default(1),
 });
 
 // Apply port offset to localhost URLs in development

package/carbon/src/server/lib/rate-limiter.ts

@@ -1,5 +1,6 @@
 import type { Context, Next } from 'hono';
 import Redis from 'ioredis';
+import { getClientIp } from './client-ip';
 import { env } from './env';
 import { logger } from './logger';
 
@@ -194,76 +195,21 @@ function getStore(): HybridStore {
   return store;
 }
 
-// =============================================================================
-// IP EXTRACTION
-// =============================================================================
-
-// Track if we've warned about missing IP headers (log once per process)
-let warnedAboutMissingIP = false;
-
-/**
- * Extract client IP from request headers
- *
- * Security note: Only trust x-forwarded-for when behind a trusted reverse proxy (Traefik).
- * The leftmost IP in x-forwarded-for is the original client IP.
- *
- * Fallback behavior:
- * - In development: Falls back to 'localhost' (expected when not behind proxy)
- * - In production: Falls back to 'unknown' but logs a warning (indicates misconfiguration)
- *
- * When IP is 'unknown', all such requests share a rate limit bucket - this is intentional
- * as it provides more restrictive rate limiting for requests that bypass proper headers.
- */
-function getClientIP(c: Context): string {
-  // x-forwarded-for format: "client, proxy1, proxy2"
-  const xff = c.req.header('x-forwarded-for');
-  if (xff) {
-    // Take leftmost (original client) IP, trim whitespace
-    const clientIP = xff.split(',')[0].trim();
-    // Basic validation - must look like an IP (IPv4 or IPv6)
-    if (/^[\d.:a-fA-F]+$/.test(clientIP)) {
-      return clientIP;
-    }
-  }
-
-  // Fallback to x-real-ip (set by some proxies like nginx)
-  const realIP = c.req.header('x-real-ip');
-  if (realIP && /^[\d.:a-fA-F]+$/.test(realIP)) {
-    return realIP;
-  }
-
-  // Fallback to cf-connecting-ip (Cloudflare)
-  const cfIP = c.req.header('cf-connecting-ip');
-  if (cfIP && /^[\d.:a-fA-F]+$/.test(cfIP)) {
-    return cfIP;
-  }
-
-  // In development, localhost is expected
-  if (env.NODE_ENV === 'development') {
-    return 'localhost';
-  }
-
-  // In production, warn about missing IP headers (indicates proxy misconfiguration)
-  if (!warnedAboutMissingIP) {
-    warnedAboutMissingIP = true;
-    logger.warn(
-      'Could not determine client IP from request headers. ' +
-        'Ensure reverse proxy (Traefik) is configured to set X-Forwarded-For or X-Real-IP headers. ' +
-        'Requests without identifiable IPs will share a rate limit bucket.'
-    );
-  }
-
-  return 'unknown';
-}
-
 // =============================================================================
 // RATE LIMITER MIDDLEWARE
 // =============================================================================
 
 export function createRateLimiter(options: { windowMs: number; max: number }) {
   return async (c: Context, next: Next) => {
-    const ip = getClientIP(c);
-    const key = `${ip}:${c.req.path}`;
+    // SECURITY: prefer a per-user bucket for authenticated requests so a single
+    // account behind a shared/NAT'd IP can't exhaust everyone else's budget (and
+    // can't dodge its own limit by rotating IPs). Falls back to the trusted
+    // client IP — resolved via getClientIp, which ignores attacker-supplied
+    // X-Forwarded-For entries. Note: the app-wide limiters in index.ts run
+    // before the auth middleware sets `user`, so those key by IP.
+    const user = c.get('user');
+    const identifier = user?.id ? `user:${user.id}` : `ip:${getClientIp(c)}`;
+    const key = `${identifier}:${c.req.path}`;
     const now = Date.now();
 
     const result = await getStore().increment(key, options.windowMs, options.max);
@@ -276,7 +222,7 @@ export function createRateLimiter(options: { windowMs: number; max: number }) {
 
     if (!result.allowed) {
       // Log rate limit violations for security monitoring
-      logger.warn({ ip, path: c.req.path, count: result.count }, 'Rate limit exceeded');
+      logger.warn({ identifier, path: c.req.path, count: result.count }, 'Rate limit exceeded');
       return c.json(
         { error: 'Too many requests', retryAfter: Math.ceil((result.resetTime - now) / 1000) },
         429

package/carbon/src/server/lib/supabase.ts

@@ -15,11 +15,17 @@ export const supabaseAdmin: SupabaseClient<Database> = createClient<Database>(
   }
 );
 
-// Create a client for a specific user's context (respects RLS)
-// Uses SERVICE_ROLE_KEY to pass Kong's ACL gate for PostgREST, but RLS is still
-// enforced because PostgREST reads the user's role from the Authorization JWT.
+// Create a client for a specific user's context (respects RLS).
+//
+// SECURITY: uses the ANON key (not the service-role key) as the apikey, with the
+// user's JWT layered on via the Authorization header. PostgREST derives the
+// Postgres role from the JWT, so RLS is enforced for the authenticated user.
+// The critical property is fail-safe degradation: if the Authorization header is
+// ever dropped (bug, proxy stripping, refactor), the client falls back to the
+// anon role under RLS rather than to service_role BYPASSRLS. The dedicated
+// service-role clients (supabaseAdmin / createAuthClient) remain for admin ops.
 export function createSupabaseClient(accessToken: string): SupabaseClient<Database> {
-  return createClient<Database>(env.SUPABASE_URL, env.SUPABASE_SERVICE_ROLE_KEY, {
+  return createClient<Database>(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, {
     global: {
       headers: {
         Authorization: `Bearer ${accessToken}`,

package/carbon/src/server/middleware/requireOrgRole.ts

@@ -0,0 +1,76 @@
+import type { Context, Next } from 'hono';
+import type { HonoVariables } from '../types';
+
+/**
+ * Hono middleware factory: gate an organization-scoped billing route behind
+ * org membership.
+ *
+ * The route indicates its target via `type` ('user' | 'organization') and,
+ * when organization-scoped, `organizationId`. Reads are GET requests that carry
+ * these in the query string; writes are POSTs that carry them in the JSON body
+ * (Hono caches the parsed body, so the handler can re-parse it safely).
+ *
+ * SECURITY: the membership lookup uses the RLS-enforced per-user Supabase client
+ * (`c.get('supabase')`), never the service-role `adminDb`. A caller can only see
+ * memberships they belong to, so this can neither be bypassed nor used to probe
+ * arbitrary organizations. When `type !== 'organization'` the guard is inert.
+ *
+ * Applying this as route middleware (rather than an inline check per handler)
+ * ensures no org-scoped billing route can silently skip the membership check.
+ */
+export function requireOrgRole(roles: string[]) {
+  return async (
+    c: Context<{ Variables: HonoVariables }>,
+    next: Next
+  ): Promise<Response | undefined> => {
+    const user = c.get('user');
+    if (!user) {
+      return c.json({ error: 'Unauthorized' }, 401);
+    }
+
+    let type: string | undefined;
+    let organizationId: string | undefined;
+
+    if (c.req.method === 'GET') {
+      type = c.req.query('type') ?? 'user';
+      organizationId = c.req.query('organizationId');
+    } else {
+      try {
+        const body = (await c.req.json()) as {
+          type?: string;
+          organizationId?: string;
+        };
+        type = body?.type;
+        organizationId = body?.organizationId;
+      } catch {
+        // Malformed JSON — let the handler's own validation return the 400 so
+        // error handling stays in one place. No data is accessed here.
+        await next();
+        return;
+      }
+    }
+
+    if (type !== 'organization') {
+      await next();
+      return;
+    }
+
+    if (!organizationId) {
+      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
+    }
+
+    const supabase = c.get('supabase');
+    const { data: membership } = await supabase
+      .from('memberships')
+      .select('role')
+      .eq('user_id', user.id)
+      .eq('organization_id', organizationId)
+      .single();
+
+    if (!membership || !roles.includes(membership.role)) {
+      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
+    }
+
+    await next();
+  };
+}