vibecarbon 0.9.0 → 0.10.0

package/carbon/src/server/middleware/requirePlan.ts

@@ -1,9 +1,8 @@
 import type { SupabaseClient } from '@supabase/supabase-js';
 import type { Context, Next } from 'hono';
 import type { PlanId } from '../../shared/pricing';
-import { planIdFromStripePriceId } from '../../shared/pricing';
-import { env } from '../lib/env';
-import { isStripeConfigured } from '../lib/stripe';
+import { planIdFromPriceId } from '../../shared/pricing';
+import { getProviderPriceIds, isBillingConfigured } from '../billing';
 import { supabaseAdmin } from '../lib/supabase';
 import type { HonoVariables } from '../types';
 
@@ -16,6 +15,62 @@ const planHierarchy: Record<PlanId, number> = {
   pro: 2,
 };
 
+/**
+ * Resolve the highest active plan available to a user, considering BOTH their
+ * personal subscription and the subscriptions of any organization they belong
+ * to. A user is entitled to a plan if their own customer record OR any org they
+ * are a member of has an active/trialing subscription at that tier.
+ */
+async function resolveHighestPlan(userId: string): Promise<PlanId> {
+  const priceIds = getProviderPriceIds();
+  const customerIds: string[] = [];
+
+  // Personal customer (organization_id IS NULL).
+  const { data: personal } = await adminDb
+    .from('customers')
+    .select('id')
+    .eq('user_id', userId)
+    .is('organization_id', null)
+    .maybeSingle();
+  if (personal?.id) customerIds.push(personal.id);
+
+  // Org customers for every organization the user is a member of.
+  const { data: memberships } = await adminDb
+    .from('memberships')
+    .select('organization_id')
+    .eq('user_id', userId);
+  const orgIds = (memberships ?? [])
+    .map((m: { organization_id: string | null }) => m.organization_id)
+    .filter((id: string | null): id is string => Boolean(id));
+
+  if (orgIds.length > 0) {
+    const { data: orgCustomers } = await adminDb
+      .from('customers')
+      .select('id')
+      .in('organization_id', orgIds);
+    for (const c of orgCustomers ?? []) {
+      if (c.id) customerIds.push(c.id);
+    }
+  }
+
+  if (customerIds.length === 0) return 'free';
+
+  const { data: subscriptions } = await adminDb
+    .from('subscriptions')
+    .select('stripe_price_id, status')
+    .in('customer_id', customerIds)
+    .in('status', ['active', 'trialing']);
+
+  let highest: PlanId = 'free';
+  for (const sub of subscriptions ?? []) {
+    const plan = planIdFromPriceId(sub.stripe_price_id, priceIds);
+    if (planHierarchy[plan] > planHierarchy[highest]) {
+      highest = plan;
+    }
+  }
+  return highest;
+}
+
 /**
  * Hono middleware that gates API routes behind a minimum plan.
  *
@@ -25,8 +80,10 @@ const planHierarchy: Record<PlanId, number> = {
  */
 export function requirePlan(minimumPlan: PlanId) {
   return async (c: Context<{ Variables: HonoVariables }>, next: Next) => {
-    // If billing isn't configured, allow all requests (dev mode / self-hosted)
-    if (!isStripeConfigured()) {
+    // If billing isn't configured at all (dev / self-hosted with no provider),
+    // allow all requests. Uses isBillingConfigured() — provider-agnostic —
+    // rather than the Stripe-only check, so Paddle/Polar deployments gate too.
+    if (!isBillingConfigured()) {
       await next();
       return;
     }
@@ -36,40 +93,13 @@ export function requirePlan(minimumPlan: PlanId) {
       return c.json({ error: 'Unauthorized' }, 401);
     }
 
-    // Free plan requires no subscription check
+    // Free plan requires no subscription check.
     if (minimumPlan === 'free') {
       await next();
       return;
     }
 
-    // Find customer for this user
-    const { data: customer } = await adminDb
-      .from('customers')
-      .select('id')
-      .eq('user_id', user.id)
-      .is('organization_id', null)
-      .maybeSingle();
-
-    if (!customer) {
-      return c.json({ error: 'Upgrade required', requiredPlan: minimumPlan }, 403);
-    }
-
-    // Find active subscription
-    const { data: subscription } = await adminDb
-      .from('subscriptions')
-      .select('stripe_price_id, status')
-      .eq('customer_id', customer.id)
-      .in('status', ['active', 'trialing'])
-      .maybeSingle();
-
-    if (!subscription) {
-      return c.json({ error: 'Upgrade required', requiredPlan: minimumPlan }, 403);
-    }
-
-    const currentPlan = planIdFromStripePriceId(subscription.stripe_price_id, {
-      starter: env.STRIPE_PRICE_STARTER,
-      pro: env.STRIPE_PRICE_PRO,
-    });
+    const currentPlan = await resolveHighestPlan(user.id);
 
     if (planHierarchy[currentPlan] < planHierarchy[minimumPlan]) {
       return c.json({ error: 'Upgrade required', requiredPlan: minimumPlan, currentPlan }, 403);

package/carbon/src/server/middleware/requireSuperAdmin.ts

@@ -0,0 +1,26 @@
+import type { Context, Next } from 'hono';
+import { isSuperAdmin } from '../lib/auth';
+import type { HonoVariables } from '../types';
+
+/**
+ * Hono middleware: gate a route (or route group) behind the super_admin role.
+ *
+ * The role is read from the JWT's `app_metadata.role` (verified upstream by the
+ * session middleware via `supabase.auth.getUser()`), matching stats.ts/theme.ts.
+ *
+ * Usage:
+ *   adminRoutes.use('*', requireSuperAdmin);
+ */
+export async function requireSuperAdmin(
+  c: Context<{ Variables: HonoVariables }>,
+  next: Next
+): Promise<Response | undefined> {
+  const user = c.get('user');
+  if (!user) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+  if (!isSuperAdmin(user)) {
+    return c.json({ error: 'Super admin access required' }, 403);
+  }
+  await next();
+}

package/carbon/src/server/routes/v1/admin/contact.ts

@@ -3,6 +3,7 @@ import { Hono } from 'hono';
 import { z } from 'zod';
 import { sanitizeError } from '../../../lib/errors';
 import { supabaseAdmin } from '../../../lib/supabase';
+import { requireSuperAdmin } from '../../../middleware/requireSuperAdmin';
 import type { HonoVariables } from '../../../types';
 
 // biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
@@ -10,26 +11,10 @@ const adminDb = supabaseAdmin as SupabaseClient<any>;
 
 const adminContactRoutes = new Hono<{ Variables: HonoVariables }>();
 
-/**
- * Require super admin for all contact management endpoints
- */
-adminContactRoutes.use('*', async (c, next) => {
-  const user = c.get('user');
-  if (!user) return c.json({ error: 'Unauthorized' }, 401);
-
-  const { data } = await adminDb
-    .from('auth.users')
-    .select('raw_app_meta_data')
-    .eq('id', user.id)
-    .single();
-
-  const role = data?.raw_app_meta_data?.role;
-  if (role !== 'super_admin') {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-
-  await next();
-});
+// Require super admin for all contact management endpoints (JWT-based role
+// check — see requireSuperAdmin). The prior `adminDb.from('auth.users')` guard
+// errored on the unexposed auth schema and fell closed for everyone.
+adminContactRoutes.use('*', requireSuperAdmin);
 
 /**
  * List contact submissions with pagination

package/carbon/src/server/routes/v1/admin/jobs.ts

@@ -3,6 +3,7 @@ import { Hono } from 'hono';
 import { z } from 'zod';
 import { sanitizeError } from '../../../lib/errors';
 import { supabaseAdmin } from '../../../lib/supabase';
+import { requireSuperAdmin } from '../../../middleware/requireSuperAdmin';
 import type { HonoVariables } from '../../../types';
 
 // biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
@@ -10,26 +11,11 @@ const adminDb = supabaseAdmin as SupabaseClient<any>;
 
 const jobsRoutes = new Hono<{ Variables: HonoVariables }>();
 
-/**
- * Require super admin for all job management endpoints
- */
-jobsRoutes.use('*', async (c, next) => {
-  const user = c.get('user');
-  if (!user) return c.json({ error: 'Unauthorized' }, 401);
-
-  const { data } = await adminDb
-    .from('auth.users')
-    .select('raw_app_meta_data')
-    .eq('id', user.id)
-    .single();
-
-  const role = data?.raw_app_meta_data?.role;
-  if (role !== 'super_admin') {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-
-  await next();
-});
+// Require super admin for all job management endpoints. Uses the JWT-based
+// role check (app_metadata.role) — the previous `adminDb.from('auth.users')`
+// query errored because the auth schema isn't exposed to PostgREST, which made
+// this guard fail closed (403 for everyone) and broke the admin panels.
+jobsRoutes.use('*', requireSuperAdmin);
 
 /**
  * List all scheduled cron jobs

package/carbon/src/server/routes/v1/admin/newsletter.ts

@@ -6,6 +6,7 @@ import { env } from '../../../lib/env';
 import { sanitizeError } from '../../../lib/errors';
 import { logger } from '../../../lib/logger';
 import { supabaseAdmin } from '../../../lib/supabase';
+import { requireSuperAdmin } from '../../../middleware/requireSuperAdmin';
 import type { HonoVariables } from '../../../types';
 
 // biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
@@ -13,26 +14,27 @@ const adminDb = supabaseAdmin as SupabaseClient<any>;
 
 const adminNewsletterRoutes = new Hono<{ Variables: HonoVariables }>();
 
+// Require super admin for all newsletter management endpoints (JWT-based role
+// check — see requireSuperAdmin). The prior `adminDb.from('auth.users')` guard
+// errored on the unexposed auth schema and fell closed for everyone.
+adminNewsletterRoutes.use('*', requireSuperAdmin);
+
 /**
- * Require super admin for all newsletter management endpoints
+ * Escape a value for safe inclusion in a CSV cell.
+ *
+ * SECURITY: subscriber `name` is attacker-controlled via the public /subscribe
+ * endpoint. Two hazards are handled:
+ *  1. CSV structure — always quote and double any internal `"` so a value can't
+ *     inject extra columns/rows.
+ *  2. CSV/formula injection — a cell beginning with `= + - @` or a control char
+ *     (tab, CR) is executed as a formula by Excel/Sheets when the file is opened.
+ *     Prefix such cells with a single quote to neutralize them.
  */
-adminNewsletterRoutes.use('*', async (c, next) => {
-  const user = c.get('user');
-  if (!user) return c.json({ error: 'Unauthorized' }, 401);
-
-  const { data } = await adminDb
-    .from('auth.users')
-    .select('raw_app_meta_data')
-    .eq('id', user.id)
-    .single();
-
-  const role = data?.raw_app_meta_data?.role;
-  if (role !== 'super_admin') {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-
-  await next();
-});
+function csvCell(value: string | null | undefined): string {
+  const s = value == null ? '' : String(value);
+  const guarded = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
+  return `"${guarded.replace(/"/g, '""')}"`;
+}
 
 /**
  * List subscribers with pagination and filtering
@@ -133,10 +135,11 @@ adminNewsletterRoutes.post('/send', async (c) => {
   }
 
   try {
-    // Get all active subscribers
+    // Get all active subscribers. confirmation_token doubles as the per-subscriber
+    // unsubscribe secret (see routes/v1/newsletter.ts).
     const { data: subscribers, error } = await adminDb
       .from('newsletter_subscribers')
-      .select('id, email')
+      .select('id, email, confirmation_token')
       .eq('status', 'active');
 
     if (error) {
@@ -153,7 +156,7 @@ adminNewsletterRoutes.post('/send', async (c) => {
 
     // Send emails in batches (non-blocking)
     for (const subscriber of subscribers) {
-      const unsubscribeUrl = `${baseUrl}/api/v1/newsletter/unsubscribe?email=${encodeURIComponent(subscriber.email)}&token=${subscriber.id}`;
+      const unsubscribeUrl = `${baseUrl}/api/v1/newsletter/unsubscribe?email=${encodeURIComponent(subscriber.email)}&token=${encodeURIComponent(subscriber.confirmation_token ?? '')}`;
       const emailHtml = `${body.html}
 <hr style="margin: 32px 0; border: none; border-top: 1px solid #e4e4e7;">
 <p style="font-size: 12px; color: #71717a; text-align: center;">
@@ -222,9 +225,9 @@ adminNewsletterRoutes.get('/export', async (c) => {
           status: string;
           subscribed_at: string | null;
           created_at: string;
-        }) => `${s.email},${s.name || ''},${s.status},${s.subscribed_at || ''},${s.created_at}`
+        }) => [s.email, s.name, s.status, s.subscribed_at, s.created_at].map(csvCell).join(',')
       ),
-    ].join('\n');
+    ].join('\r\n');
 
     c.header('Content-Type', 'text/csv');
     c.header('Content-Disposition', 'attachment; filename="newsletter-subscribers.csv"');

package/carbon/src/server/routes/v1/auth.ts

@@ -2,10 +2,10 @@ import type { SupabaseClient } from '@supabase/supabase-js';
 import { Hono } from 'hono';
 import { z } from 'zod';
 import { isSuperAdmin } from '../../lib/auth';
+import { getClientIp } from '../../lib/client-ip';
 import { env } from '../../lib/env';
 import { sanitizeError } from '../../lib/errors';
 import { logger } from '../../lib/logger';
-import { getClientIp } from '../../lib/request';
 import { createAuthClient, supabaseAdmin } from '../../lib/supabase';
 import type { HonoVariables } from '../../types';
 
@@ -106,7 +106,10 @@ authRoutes.post('/login', async (c) => {
         logger.error({ error: recordError }, 'Failed to record login attempt');
       }
 
-      return c.json({ error: authError?.message || 'Invalid credentials' }, 401);
+      // SECURITY: return a single generic message regardless of the underlying
+      // auth error so responses can't be used to enumerate which emails exist
+      // or distinguish "wrong password" from "no such user".
+      return c.json({ error: 'Invalid credentials' }, 401);
     }
 
     // Step 3b: Clear failed attempts on success

package/carbon/src/server/routes/v1/billing.ts

@@ -5,10 +5,15 @@ import { planIdFromPriceId, plans } from '../../../shared/pricing';
 import { getBillingProvider, getProviderPriceIds, isBillingConfigured } from '../../billing';
 import { env } from '../../lib/env';
 import { sanitizeError } from '../../lib/errors';
+import { createRateLimiter } from '../../lib/rate-limiter';
 import { supabaseAdmin } from '../../lib/supabase';
 import { requireAal2 } from '../../middleware/requireAal2';
+import { requireOrgRole } from '../../middleware/requireOrgRole';
 import type { HonoVariables } from '../../types';
 
+// Organization billing actions require an owner/admin of the target org.
+const ORG_BILLING_ROLES = ['OWNER', 'ADMIN'];
+
 // Helper to access tables not yet in generated types
 // biome-ignore lint/suspicious/noExplicitAny: Tables not yet in generated Database types
 const adminDb = supabaseAdmin as SupabaseClient<any>;
@@ -236,9 +241,13 @@ billingRoutes.get('/prices', (c) => {
 // ============================================================================
 
 /**
- * Get current subscription for user or organization
+ * Get current subscription for user or organization.
+ *
+ * SECURITY: requireOrgRole enforces org membership before this handler runs, so
+ * a caller cannot read another organization's subscription by supplying an
+ * arbitrary organizationId (the previous IDOR).
  */
-billingRoutes.get('/subscription', async (c) => {
+billingRoutes.get('/subscription', requireOrgRole(ORG_BILLING_ROLES), async (c) => {
   const user = c.get('user');
 
   if (!user) {
@@ -365,7 +374,7 @@ billingRoutes.get('/subscription', async (c) => {
 /**
  * Create a checkout session via the active billing provider
  */
-billingRoutes.post('/checkout', requireAal2, async (c) => {
+billingRoutes.post('/checkout', requireAal2, requireOrgRole(ORG_BILLING_ROLES), async (c) => {
   const user = c.get('user');
 
   if (!user) {
@@ -376,7 +385,8 @@ billingRoutes.post('/checkout', requireAal2, async (c) => {
     return c.json({ error: 'Billing is not configured' }, 503);
   }
 
-  // Parse and validate request body
+  // Parse and validate request body. Organization access is enforced by the
+  // requireOrgRole middleware above (which reads the same cached body).
   let body: z.infer<typeof checkoutSchema>;
   try {
     const rawBody = await c.req.json();
@@ -392,26 +402,6 @@ billingRoutes.post('/checkout', requireAal2, async (c) => {
     return c.json({ error: 'Invalid JSON body' }, 400);
   }
 
-  // Validate organization access if billing for organization
-  if (body.type === 'organization') {
-    if (!body.organizationId) {
-      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
-    }
-
-    // Check user is admin/owner of organization
-    const supabase = c.get('supabase');
-    const { data: membership } = await supabase
-      .from('memberships')
-      .select('role')
-      .eq('user_id', user.id)
-      .eq('organization_id', body.organizationId)
-      .single();
-
-    if (!membership || !['OWNER', 'ADMIN'].includes(membership.role)) {
-      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
-    }
-  }
-
   try {
     const provider = getBillingProvider();
 
@@ -472,7 +462,7 @@ const setupSchema = z.object({
  * method collection differently (during checkout or via their portal).
  * For non-Stripe providers, this endpoint returns 501.
  */
-billingRoutes.post('/setup', requireAal2, async (c) => {
+billingRoutes.post('/setup', requireAal2, requireOrgRole(ORG_BILLING_ROLES), async (c) => {
   const user = c.get('user');
 
   if (!user) {
@@ -492,6 +482,7 @@ billingRoutes.post('/setup', requireAal2, async (c) => {
     );
   }
 
+  // Organization access is enforced by requireOrgRole above.
   let body: z.infer<typeof setupSchema>;
   try {
     const rawBody = await c.req.json();
@@ -507,24 +498,6 @@ billingRoutes.post('/setup', requireAal2, async (c) => {
     return c.json({ error: 'Invalid JSON body' }, 400);
   }
 
-  if (body.type === 'organization') {
-    if (!body.organizationId) {
-      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
-    }
-
-    const supabase = c.get('supabase');
-    const { data: membership } = await supabase
-      .from('memberships')
-      .select('role')
-      .eq('user_id', user.id)
-      .eq('organization_id', body.organizationId)
-      .single();
-
-    if (!membership || !['OWNER', 'ADMIN'].includes(membership.role)) {
-      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
-    }
-  }
-
   try {
     // Import Stripe directly for setup mode (Stripe-specific feature)
     const { getStripe } = await import('../../lib/stripe');
@@ -569,7 +542,7 @@ billingRoutes.post('/setup', requireAal2, async (c) => {
 /**
  * Create a customer portal session via the active billing provider
  */
-billingRoutes.post('/portal', requireAal2, async (c) => {
+billingRoutes.post('/portal', requireAal2, requireOrgRole(ORG_BILLING_ROLES), async (c) => {
   const user = c.get('user');
 
   if (!user) {
@@ -580,7 +553,8 @@ billingRoutes.post('/portal', requireAal2, async (c) => {
     return c.json({ error: 'Billing is not configured' }, 503);
   }
 
-  // Parse and validate request body
+  // Parse and validate request body. Organization access is enforced by the
+  // requireOrgRole middleware above.
   let body: z.infer<typeof portalSchema>;
   try {
     const rawBody = await c.req.json();
@@ -596,25 +570,6 @@ billingRoutes.post('/portal', requireAal2, async (c) => {
     return c.json({ error: 'Invalid JSON body' }, 400);
   }
 
-  // Validate organization access if billing for organization
-  if (body.type === 'organization') {
-    if (!body.organizationId) {
-      return c.json({ error: 'Organization ID is required for organization billing' }, 400);
-    }
-
-    const supabase = c.get('supabase');
-    const { data: membership } = await supabase
-      .from('memberships')
-      .select('role')
-      .eq('user_id', user.id)
-      .eq('organization_id', body.organizationId)
-      .single();
-
-    if (!membership || !['OWNER', 'ADMIN'].includes(membership.role)) {
-      return c.json({ error: 'You must be an admin to manage organization billing' }, 403);
-    }
-  }
-
   try {
     // Find existing customer
     const query = adminDb.from('customers').select('stripe_customer_id');
@@ -669,6 +624,11 @@ const TIER_PRICE_IDS: Record<string, string | undefined> = {
   fullerene: env.FULLERENE_PRICE_ID,
 };
 
+// SECURITY: this route is public (no auth) and calls provider.createCustomer on
+// every request, so it's an abuse/cost vector. Apply a strict per-IP limiter on
+// top of the app-wide 100/min, matching the contact/newsletter public routes.
+billingRoutes.use('/license-checkout', createRateLimiter({ windowMs: 15 * 60 * 1000, max: 5 }));
+
 /**
  * Create a one-time payment checkout session for a license tier.
  * No authentication required — collects email for the provider.

package/carbon/src/server/routes/v1/index.ts

@@ -936,7 +936,10 @@ v1Routes.get('/admin/users', async (c) => {
 // ADMIN IMPERSONATION (Super Admin only)
 // ============================================================================
 
-v1Routes.post('/admin/impersonate/:userId', async (c) => {
+// SECURITY: impersonation mints a login link for another user — the highest-
+// impact admin action here — so it is gated behind aal2 (step-up MFA) in
+// addition to the super_admin check, when MFA is globally enabled.
+v1Routes.post('/admin/impersonate/:userId', requireAal2, async (c) => {
   const user = c.get('user');
 
   if (!user) {
@@ -949,6 +952,10 @@ v1Routes.post('/admin/impersonate/:userId', async (c) => {
 
   const targetUserId = c.req.param('userId');
 
+  if (!targetUserId) {
+    return c.json({ error: 'User ID is required' }, 400);
+  }
+
   if (targetUserId === user.id) {
     return c.json({ error: 'Cannot impersonate yourself' }, 400);
   }

package/carbon/src/server/routes/v1/newsletter.ts

@@ -112,12 +112,14 @@ newsletterRoutes.get('/confirm', async (c) => {
   }
 
   try {
+    // NOTE: confirmation_token is intentionally NOT cleared here — it doubles as
+    // the per-subscriber unsubscribe secret (see the unsubscribe route below).
+    // Re-confirmation is already prevented by the `status = 'pending'` filter.
     const { data, error } = await adminDb
       .from('newsletter_subscribers')
       .update({
         status: 'active',
         subscribed_at: new Date().toISOString(),
-        confirmation_token: null,
       })
       .eq('confirmation_token', token)
       .eq('status', 'pending')
@@ -147,30 +149,34 @@ newsletterRoutes.get('/unsubscribe', async (c) => {
   const email = c.req.query('email');
   const token = c.req.query('token');
 
-  if (!email) {
-    return c.json({ error: 'Missing email' }, 400);
+  // SECURITY: require the per-subscriber token (confirmation_token) so a caller
+  // can't unsubscribe an arbitrary address by guessing/knowing only the email.
+  // The token was matched against the wrong column (`id`) before, and was
+  // optional — either flaw let anyone unsubscribe anyone.
+  if (!email || !token) {
+    return c.json({ error: 'Missing email or unsubscribe token' }, 400);
   }
 
   try {
-    const query = adminDb
+    const { data, error } = await adminDb
       .from('newsletter_subscribers')
       .update({
         status: 'unsubscribed',
         unsubscribed_at: new Date().toISOString(),
       })
-      .eq('email', email);
-
-    // If token provided, verify it matches (for one-click unsubscribe)
-    if (token) {
-      query.eq('id', token);
-    }
-
-    const { error } = await query;
+      .eq('email', email)
+      .eq('confirmation_token', token)
+      .select('id')
+      .maybeSingle();
 
     if (error) {
       return c.json({ error: sanitizeError(error, 'Failed to unsubscribe') }, 500);
     }
 
+    if (!data) {
+      return c.json({ error: 'Invalid unsubscribe link' }, 400);
+    }
+
     const baseUrl = env.SITE_URL || 'http://localhost:5173';
     return c.redirect(`${baseUrl}/?newsletter=unsubscribed`);
   } catch (error) {