vibecarbon 0.9.0 → 0.11.0

package/carbon/tests/unit/server/client-ip.test.ts

@@ -0,0 +1,76 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// getClientIp imports env (which validates real env vars at import time) and
+// logger. Mock both so this unit test is hermetic and can drive NODE_ENV /
+// TRUSTED_PROXY_HOPS directly.
+const { fakeEnv } = vi.hoisted(() => ({
+  fakeEnv: { NODE_ENV: 'production', TRUSTED_PROXY_HOPS: 1 } as {
+    NODE_ENV: string;
+    TRUSTED_PROXY_HOPS: number;
+  },
+}));
+
+vi.mock('@server/lib/env', () => ({ env: fakeEnv }));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+const { getClientIp } = await import('@server/lib/client-ip');
+
+// Minimal context double: only needs req.header(name).
+function ctx(headers: Record<string, string>) {
+  const lower: Record<string, string> = {};
+  for (const [k, v] of Object.entries(headers)) lower[k.toLowerCase()] = v;
+  return { req: { header: (name: string) => lower[name.toLowerCase()] } };
+}
+
+beforeEach(() => {
+  fakeEnv.NODE_ENV = 'production';
+  fakeEnv.TRUSTED_PROXY_HOPS = 1;
+});
+
+describe('getClientIp — trusted-proxy-aware resolution', () => {
+  it('returns the entry Traefik appended (rightmost) with a single trusted hop', () => {
+    // Traefik appends the real client IP to the right of whatever the client sent.
+    const ip = getClientIp(ctx({ 'x-forwarded-for': '203.0.113.9, 198.51.100.7' }));
+    expect(ip).toBe('198.51.100.7');
+  });
+
+  it('SECURITY: a spoofed leftmost XFF cannot change the resolved identity', () => {
+    // Same real client (rightmost), different attacker-supplied leftmost values.
+    // If the resolver keyed off the leftmost, these would resolve differently and
+    // let an attacker mint a fresh rate-limit / lockout bucket per request.
+    const a = getClientIp(ctx({ 'x-forwarded-for': '1.1.1.1, 198.51.100.7' }));
+    const b = getClientIp(ctx({ 'x-forwarded-for': '2.2.2.2, 198.51.100.7' }));
+    const c = getClientIp(ctx({ 'x-forwarded-for': 'attacker-junk, 198.51.100.7' }));
+    expect(a).toBe('198.51.100.7');
+    expect(b).toBe('198.51.100.7');
+    expect(c).toBe('198.51.100.7');
+  });
+
+  it('handles a single-entry XFF (direct client → Traefik)', () => {
+    expect(getClientIp(ctx({ 'x-forwarded-for': '198.51.100.7' }))).toBe('198.51.100.7');
+  });
+
+  it('honours a deeper trusted-proxy hop count (counts from the right)', () => {
+    fakeEnv.TRUSTED_PROXY_HOPS = 2;
+    const ip = getClientIp(ctx({ 'x-forwarded-for': '1.1.1.1, 198.51.100.7, 203.0.113.1' }));
+    expect(ip).toBe('198.51.100.7');
+  });
+
+  it('does NOT trust x-real-ip / cf-connecting-ip (Traefik does not set them)', () => {
+    const ip = getClientIp(
+      ctx({ 'x-real-ip': '6.6.6.6', 'cf-connecting-ip': '7.7.7.7' })
+    );
+    expect(ip).toBe('unknown');
+  });
+
+  it('fails closed to a shared sentinel when no trusted IP is derivable (prod)', () => {
+    expect(getClientIp(ctx({}))).toBe('unknown');
+  });
+
+  it('falls back to localhost in development', () => {
+    fakeEnv.NODE_ENV = 'development';
+    expect(getClientIp(ctx({}))).toBe('localhost');
+  });
+});

package/carbon/tests/unit/server/env-bool.test.ts

@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+// env.ts validates process.env at import time and would call process.exit on
+// failure, so we always supply the required vars and only vary the booleans.
+const REQUIRED = {
+  SUPABASE_URL: 'http://supabase.test',
+  SUPABASE_ANON_KEY: 'anon',
+  SUPABASE_SERVICE_ROLE_KEY: 'service',
+  NODE_ENV: 'test',
+};
+
+const TOUCHED = [
+  ...Object.keys(REQUIRED),
+  'GOOGLE_ENABLED',
+  'MAGIC_LINK_ENABLED',
+];
+
+const saved: Record<string, string | undefined> = {};
+
+async function loadEnv(overrides: Record<string, string | undefined>) {
+  for (const k of TOUCHED) saved[k] = process.env[k];
+  vi.resetModules();
+  for (const [k, v] of Object.entries({ ...REQUIRED, ...overrides })) {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  }
+  const mod = await import('@server/lib/env');
+  return mod.env;
+}
+
+afterEach(() => {
+  for (const [k, v] of Object.entries(saved)) {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  }
+});
+
+describe('env boolean parsing', () => {
+  it('SECURITY: parses the literal "false" as false (z.coerce.boolean did NOT)', async () => {
+    const env = await loadEnv({ GOOGLE_ENABLED: 'false' });
+    expect(env.GOOGLE_ENABLED).toBe(false);
+  });
+
+  it('parses "true" as true', async () => {
+    const env = await loadEnv({ GOOGLE_ENABLED: 'true' });
+    expect(env.GOOGLE_ENABLED).toBe(true);
+  });
+
+  it('applies the default (false) when unset', async () => {
+    const env = await loadEnv({ GOOGLE_ENABLED: undefined });
+    expect(env.GOOGLE_ENABLED).toBe(false);
+  });
+
+  it('applies the default (true) for MAGIC_LINK_ENABLED when unset', async () => {
+    const env = await loadEnv({ MAGIC_LINK_ENABLED: undefined });
+    expect(env.MAGIC_LINK_ENABLED).toBe(true);
+  });
+
+  it('treats any non-"true" string as false', async () => {
+    const env = await loadEnv({ GOOGLE_ENABLED: '1' });
+    expect(env.GOOGLE_ENABLED).toBe(false);
+  });
+});

package/carbon/tests/unit/server/paddle-webhook.test.ts

@@ -0,0 +1,57 @@
+import { createHmac } from 'node:crypto';
+import { describe, expect, it, vi } from 'vitest';
+
+// `test_`-prefixed so the repo secret-scanner treats it as an obvious test
+// fixture (not a real leaked secret) — the HMAC key value is arbitrary here.
+const SECRET = 'test_pdl_webhook_secret';
+
+vi.mock('@server/lib/env', () => ({
+  env: { PADDLE_WEBHOOK_SECRET: SECRET, PADDLE_ENVIRONMENT: 'sandbox' },
+}));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+const { PaddleProvider } = await import('@server/billing/providers/paddle');
+
+const body = JSON.stringify({ event_type: 'subscription.created', data: { id: 'sub_1' } });
+
+function sign(ts: number, payloadBody: string): string {
+  const hash = createHmac('sha256', SECRET).update(`${ts}:${payloadBody}`).digest('hex');
+  return `ts=${ts};h1=${hash}`;
+}
+
+describe('PaddleProvider webhook verification', () => {
+  const provider = new PaddleProvider();
+
+  it('accepts a validly signed, recent event', async () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const result = await provider.handleWebhook({ body, signature: sign(ts, body) });
+    expect(result.type).toBe('subscription.created');
+  });
+
+  it('SECURITY: rejects a stale event outside the 5-minute tolerance (replay)', async () => {
+    const staleTs = Math.floor(Date.now() / 1000) - 6 * 60; // 6 minutes old
+    await expect(
+      provider.handleWebhook({ body, signature: sign(staleTs, body) })
+    ).rejects.toThrow(/timestamp outside tolerance/);
+  });
+
+  it('SECURITY: rejects a tampered signature', async () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const good = sign(ts, body);
+    // Flip the last hex char of h1 to forge a mismatch of equal length.
+    const tampered = good.replace(/.$/, (ch) => (ch === '0' ? '1' : '0'));
+    await expect(
+      provider.handleWebhook({ body, signature: tampered })
+    ).rejects.toThrow(/Invalid Paddle webhook signature/);
+  });
+
+  it('rejects a signature computed over a different body', async () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const sigForOtherBody = sign(ts, '{"event_type":"other"}');
+    await expect(
+      provider.handleWebhook({ body, signature: sigForOtherBody })
+    ).rejects.toThrow(/Invalid Paddle webhook signature/);
+  });
+});

package/carbon/tests/unit/server/polar-webhook.test.ts

@@ -0,0 +1,63 @@
+import { createHmac } from 'node:crypto';
+import { describe, expect, it, vi } from 'vitest';
+
+// Polar secrets are base64, prefixed with "whsec_".
+const SECRET_RAW = Buffer.from('polar_test_webhook_secret').toString('base64');
+const SECRET = `whsec_${SECRET_RAW}`;
+
+vi.mock('@server/lib/env', () => ({
+  env: { POLAR_WEBHOOK_SECRET: SECRET, POLAR_ENVIRONMENT: 'sandbox' },
+}));
+vi.mock('@server/lib/logger', () => ({
+  logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+const { PolarProvider } = await import('@server/billing/providers/polar');
+
+const body = JSON.stringify({ type: 'subscription.created', data: { id: 'sub_1' } });
+const WEBHOOK_ID = 'msg_1';
+
+// Mirror the combined header the billing webhook route builds:
+// `${webhookId}.${timestamp}.v1,${signature}`
+function sign(ts: number, payloadBody: string): string {
+  const secretBytes = Buffer.from(SECRET_RAW, 'base64');
+  const sig = createHmac('sha256', secretBytes)
+    .update(`${WEBHOOK_ID}.${ts}.${payloadBody}`)
+    .digest('base64');
+  return `${WEBHOOK_ID}.${ts}.v1,${sig}`;
+}
+
+describe('PolarProvider webhook verification', () => {
+  const provider = new PolarProvider();
+
+  it('accepts a validly signed, recent event', async () => {
+    const ts = Math.floor(Date.now() / 1000);
+    await expect(
+      provider.handleWebhook({ body, signature: sign(ts, body) })
+    ).resolves.toBeDefined();
+  });
+
+  it('SECURITY: rejects a stale event outside the 5-minute tolerance (replay)', async () => {
+    const staleTs = Math.floor(Date.now() / 1000) - 6 * 60; // 6 minutes old
+    await expect(
+      provider.handleWebhook({ body, signature: sign(staleTs, body) })
+    ).rejects.toThrow(/timestamp outside tolerance/);
+  });
+
+  it('SECURITY: rejects a tampered signature', async () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const good = sign(ts, body);
+    const tampered = good.replace(/.$/, (ch) => (ch === 'A' ? 'B' : 'A'));
+    await expect(
+      provider.handleWebhook({ body, signature: tampered })
+    ).rejects.toThrow(/Invalid Polar webhook signature/);
+  });
+
+  it('rejects a signature computed over a different body', async () => {
+    const ts = Math.floor(Date.now() / 1000);
+    const sigForOtherBody = sign(ts, '{"type":"other"}');
+    await expect(
+      provider.handleWebhook({ body, signature: sigForOtherBody })
+    ).rejects.toThrow(/Invalid Polar webhook signature/);
+  });
+});

package/carbon/tests/unit/server/supabase-client.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it, vi } from 'vitest';
+
+const ENV = {
+  SUPABASE_URL: 'http://supabase.test',
+  SUPABASE_ANON_KEY: 'the-anon-key',
+  SUPABASE_SERVICE_ROLE_KEY: 'the-service-role-key',
+};
+
+vi.mock('@server/lib/env', () => ({ env: ENV }));
+
+const { createClientMock } = vi.hoisted(() => ({ createClientMock: vi.fn(() => ({})) }));
+vi.mock('@supabase/supabase-js', () => ({ createClient: createClientMock }));
+
+const { createSupabaseClient } = await import('@server/lib/supabase');
+
+describe('createSupabaseClient (per-user, RLS-enforced client)', () => {
+  it('SECURITY: uses the ANON key (not service role) as the apikey, with the user JWT', () => {
+    createClientMock.mockClear();
+    createSupabaseClient('user-jwt-token');
+
+    expect(createClientMock).toHaveBeenCalledTimes(1);
+    const [url, key, options] = createClientMock.mock.calls[0];
+    expect(url).toBe(ENV.SUPABASE_URL);
+    // Fail-safe: if the Authorization header is ever dropped, this degrades to
+    // the anon role under RLS, NOT to service_role BYPASSRLS.
+    expect(key).toBe(ENV.SUPABASE_ANON_KEY);
+    expect(key).not.toBe(ENV.SUPABASE_SERVICE_ROLE_KEY);
+    expect(options?.global?.headers?.Authorization).toBe('Bearer user-jwt-token');
+  });
+});

package/carbon/volumes/db/wal-archive.sh

@@ -25,6 +25,42 @@ WAL_PATH="${1:?archive_command requires a WAL file path}"
 RETRIES="${WAL_ARCHIVE_RETRIES:-3}"
 SLEEP_BASE="${WAL_ARCHIVE_SLEEP:-2}"
 
+# WRITE-GUARD (finding #3): a standby node must NEVER push WAL into the single
+# canonical WALG_S3_PREFIX. WALG_ROLE=standby is set on the standby's db env
+# (compose .env / k8s supabase.values.yaml). This closes the bring-up window
+# that the pg_is_in_recovery() gate below can't: a freshly-provisioned standby
+# db can briefly be an INDEPENDENT primary (not yet in recovery) before it is
+# reseeded — WALG_ROLE=standby stops it archiving into the primary's stream even
+# then. Exit 0 (not error) so PG recycles the segment instead of pinning WAL.
+if [ "${WALG_ROLE:-primary}" = "standby" ]; then
+    echo "wal-archive: WALG_ROLE=standby — skipping archive of '${WAL_PATH}' (only the primary writes to the canonical prefix)." >&2
+    exit 0
+fi
+
+# Recovery gate: a node in recovery (a streaming standby) must NEVER archive
+# WAL. Doing so would let a standby write into the shared/canonical WAL stream
+# and corrupt the PITR timeline (invisible until a restore during an incident).
+# PostgreSQL with archive_mode=on already skips archive_command during recovery,
+# but gate explicitly as defense in depth (and in case archive_mode=always is
+# ever set, or a split-brain leaves two writers). Only SKIP when we can
+# POSITIVELY confirm recovery — never fail-closed in a way that would drop a
+# real primary's WAL.
+PGDATA_DIR="${PGDATA:-/var/lib/postgresql/data}"
+in_recovery=""
+if command -v psql >/dev/null 2>&1; then
+    in_recovery="$(psql -U "${PGUSER:-supabase_admin}" -d postgres -tAXc 'SELECT pg_is_in_recovery()' 2>/dev/null | tr -d '[:space:]')"
+fi
+# Fall back to the standby.signal marker if psql couldn't answer (e.g. socket
+# not reachable from the archive_command context). Postgres removes this file
+# atomically on promotion, so its presence == "still a standby".
+if [ -z "$in_recovery" ] && [ -f "${PGDATA_DIR}/standby.signal" ]; then
+    in_recovery="t"
+fi
+if [ "$in_recovery" = "t" ]; then
+    echo "wal-archive: node is in recovery (standby) — skipping archive of '${WAL_PATH}' (only the primary archives)." >&2
+    exit 0
+fi
+
 attempt=1
 while [ "$attempt" -le "$RETRIES" ]; do
     if /usr/local/bin/wal-g wal-push "$WAL_PATH"; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -51,7 +51,7 @@
     "boilerplate"
   ],
   "author": "",
-  "license": "AGPL-3.0-only",
+  "license": "FSL-1.1-MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/hyperformant/vibecarbon.git"

package/src/backup.js

@@ -28,7 +28,6 @@ import {
   loadS3Config,
 } from './lib/config.js';
 import { getS3Credentials } from './lib/hetzner-guided-setup.js';
-import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
 import { assertInProjectDir } from './lib/project-guard.js';
@@ -307,7 +306,6 @@ export async function run(args) {
   // backup` from a parent directory emits the canonical message.
   assertInProjectDir();
 
-  requireLicense('backup');
   printBanner();
   p.intro(`${c.bold('vibecarbon backup')} ${c.dim(`v${VERSION}`)}`);
 

package/src/cli.js

@@ -15,6 +15,7 @@
 import dns from 'node:dns';
 import { realpathSync } from 'node:fs';
 import { c } from './lib/colors.js';
+import { shouldGate } from './lib/licensing/gate.js';
 import { perfTimer } from './lib/perf.js';
 import { VERSION } from './lib/version.js';
 
@@ -80,6 +81,7 @@ export const KNOWN_COMMANDS = [
   'shell',
   'diagnose',
   'console',
+  'access',
 ];
 
 function showHelp() {
@@ -184,6 +186,20 @@ async function main() {
   // e2e runner forces it on so we always have total + sub-step
   // breakdowns per CLI invocation.
   const subcommandArgs = args.slice(1);
+
+  // Central license gate: paid commands are gated HERE, pre-dispatch, so a
+  // new command can never ship unguarded (COMMAND_GATES must classify every
+  // KNOWN_COMMAND — enforced by tests/unit/licensing/command-gates.test.ts).
+  // Ordering contract: the canonical "not in a project" refusal must win
+  // over the license upsell (all paid commands are project-scoped), and
+  // -h/-v invocations are never gated — shouldGate() handles the bypass.
+  if (shouldGate(command, subcommandArgs)) {
+    const { assertInProjectDir } = await import('./lib/project-guard.js');
+    assertInProjectDir();
+    const { requireLicense } = await import('./lib/licensing/index.js');
+    requireLicense(command);
+  }
+
   const commandTimer = perfTimer(`cli.${command}.total`);
 
   switch (command) {

package/src/deploy.js

@@ -50,7 +50,6 @@ import {
   setupHA as setupHetznerDnsHA,
   setupSimple as setupHetznerDnsSimple,
 } from './lib/hetzner-dns.js';
-import { requireLicense } from './lib/licensing/index.js';
 import { detectPackageManager } from './lib/project.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { HetznerS3Provider, sanitizeBucketName } from './lib/providers/hetzner-s3.js';
@@ -124,6 +123,12 @@ const SPEC = {
       description:
         'Disaster recovery: seed the fresh DB from the latest wal-g backup in S3 (or PITR to an ISO-8601 timestamp). Skips migrations — the restored DB is authoritative. k8s only.',
     },
+    {
+      name: 'allow-degraded',
+      boolean: true,
+      description:
+        'HA only: proceed even if the standby is not verifiably streaming (warm-standby / degraded DR). By default an HA deploy FAILS unless replication is confirmed streaming.',
+    },
   ],
   examples: [
     { command: 'vibecarbon deploy', description: 'prompts for env (defaults to prod)' },
@@ -140,6 +145,10 @@ const SPEC = {
       command: 'vibecarbon deploy prod -mode k8s -restore latest -y',
       description: 'stand up a fresh cluster and restore the DB from S3 (DR)',
     },
+    {
+      command: 'vibecarbon deploy prod -mode k8s-ha -allow-degraded',
+      description: 'finalize an HA deploy even if the standby is not yet streaming (degraded DR)',
+    },
   ],
 };
 
@@ -188,6 +197,9 @@ function buildLegacyArgs(values, positional) {
     push: false,
     // DR: seed the fresh DB from S3 via wal-g (k8s only). null = normal deploy.
     restore: values.restore || null,
+    // HA gate opt-out: accept a warm/degraded standby instead of failing when
+    // replication isn't verifiably streaming. Ignored for non-HA modes.
+    allowDegraded: !!values['allow-degraded'],
   };
 }
 
@@ -226,10 +238,9 @@ async function main() {
   // upsell path) outside a project, tripping the not-in-project contract.
   assertInProjectDir();
 
-  // 0b. Deploying to production requires a paid license. Graphite (free)
-  // covers local create/up/test; deploy/scale/backup/etc. need Diamond+.
-  // Gate after the project check — help/version already returned above.
-  requireLicense('deploy');
+  // 0b. The paid-license gate for deploy lives in cli.js (central
+  // COMMAND_GATES chokepoint), which runs project-guard → license gate
+  // before dispatching here.
 
   // 0c. Refuse to deploy if the working tree contains likely secrets.
   // We push the project's tracked files to GitHub during deploy (CI,