webspresso 0.0.93 → 0.0.94

package/plugins/polar/src/user-resolver.js

@@ -0,0 +1,195 @@
+'use strict';
+
+const PRO_SUBSCRIPTION_STATUSES = new Set(['active', 'trialing']);
+
+function normalizePolarEventData(data) {
+  if (!data || typeof data !== 'object') return {};
+
+  const subscription = data.subscription && typeof data.subscription === 'object'
+    ? data.subscription
+    : null;
+
+  return {
+    ...data,
+    ...(subscription || {}),
+    metadata: data.metadata || subscription?.metadata || data.checkout?.metadata || {},
+    customer: data.customer || subscription?.customer || data.checkout?.customer || null,
+  };
+}
+
+function collectPolarMetadata(data) {
+  const normalized = normalizePolarEventData(data);
+  const metadata = normalized.metadata && typeof normalized.metadata === 'object'
+    ? normalized.metadata
+    : {};
+  return { normalized, metadata };
+}
+
+function isProSubscriptionStatus(status) {
+  return PRO_SUBSCRIPTION_STATUSES.has(String(status || '').toLowerCase());
+}
+
+function userHasProTier(user, config) {
+  if (!user) return false;
+  const tierField = config.fields.tier;
+  const tier = user[tierField];
+  return config.proTiers.includes(tier);
+}
+
+function parsePolarTimestamp(value) {
+  if (!value) return null;
+  if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value;
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+
+function normalizePolarTimestamp(value) {
+  const parsed = parsePolarTimestamp(value);
+  return parsed ? parsed.toISOString() : null;
+}
+
+function listPolarSubscriptions(data) {
+  if (!data) return [];
+  if (Array.isArray(data)) return data;
+  if (Array.isArray(data.items)) return data.items;
+  if (Array.isArray(data.results)) return data.results;
+  return [];
+}
+
+function pickBestActiveSubscription(subscriptions, config) {
+  const list = Array.isArray(subscriptions) ? subscriptions : [];
+  if (!list.length) return null;
+
+  const activeOnly = list.filter((sub) => !sub.status || isProSubscriptionStatus(sub.status));
+  if (!activeOnly.length) return null;
+
+  const productIds = new Set();
+  for (const planKey of config.proTiers.flatMap((t) => config.tierMapping[t] || [])) {
+    const pid = config.plans[planKey];
+    if (pid) productIds.add(pid);
+  }
+
+  if (productIds.size) {
+    const matched = activeOnly.find((sub) => productIds.has(sub.product_id));
+    if (matched) return matched;
+  }
+
+  return activeOnly[0];
+}
+
+function buildCheckoutMetadata(user, config, customFields = {}) {
+  const f = config.fields;
+  const metadata = {};
+
+  if (user[f.id] != null) metadata.user_id = String(user[f.id]);
+  if (user[f.publicId]) metadata.public_id = String(user[f.publicId]);
+  if (user.username) metadata.username = String(user.username);
+
+  for (const [key, value] of Object.entries(customFields)) {
+    if (value !== undefined && value !== null && String(value).trim() !== '') {
+      metadata[key] = String(value);
+    }
+  }
+
+  const cleaned = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (value !== undefined && value !== null && String(value).trim() !== '') {
+      cleaned[key] = String(value);
+    }
+  }
+  return cleaned;
+}
+
+/**
+ * @param {Object} data
+ * @param {Object} knex
+ * @param {import('./config').PolarConfig} config
+ */
+async function resolveUserFromPolarData(data, knex, config) {
+  if (!data || !knex) return null;
+
+  const { normalized, metadata } = collectPolarMetadata(data);
+  const f = config.fields;
+  const table = config.userTable;
+
+  if (metadata.user_id) {
+    const user = await knex(table).where(f.id, Number(metadata.user_id)).first();
+    if (user) return user;
+  }
+
+  if (metadata.public_id) {
+    const user = await knex(table).where(f.publicId, String(metadata.public_id)).first();
+    if (user) return user;
+  }
+
+  const externalId =
+    normalized.external_customer_id
+    || normalized.external_id
+    || data.external_id
+    || normalized.customer?.external_id
+    || data.customer?.external_id
+    || null;
+
+  if (externalId) {
+    let user = await knex(table).where(f.publicId, String(externalId)).first();
+    if (!user && /^\d+$/.test(String(externalId))) {
+      user = await knex(table).where(f.id, Number(externalId)).first();
+    }
+    if (user) return user;
+  }
+
+  const email = (
+    normalized.customer?.email
+    || normalized.customer_email
+    || normalized.email
+    || data.customer?.email
+  );
+  if (email) {
+    const user = await knex(table).whereRaw('LOWER(??) = ?', [f.email, String(email).toLowerCase().trim()]).first();
+    if (user) return user;
+  }
+
+  const customerId = normalized.customer_id || normalized.customer?.id || data.customer_id || null;
+  if (customerId) {
+    const user = await knex(table).where(f.polarCustomerId, customerId).first();
+    if (user) return user;
+  }
+
+  return null;
+}
+
+function extractSubscriptionFields(data, user, config) {
+  const normalized = normalizePolarEventData(data);
+  const f = config.fields;
+  return {
+    subscriptionId: normalized.id || user?.[f.polarSubscriptionId] || null,
+    customerId: normalized.customer_id || normalized.customer?.id || user?.[f.polarCustomerId] || null,
+    status: normalized.status || 'active',
+    periodEnd: normalizePolarTimestamp(normalized.current_period_end),
+    cancelAtPeriodEnd: Boolean(normalized.cancel_at_period_end),
+  };
+}
+
+function collectExternalCustomerIds(user, config) {
+  const f = config.fields;
+  return [...new Set([
+    user?.[f.publicId] && String(user[f.publicId]),
+    user?.[f.id] != null && String(user[f.id]),
+  ].filter(Boolean))];
+}
+
+module.exports = {
+  PRO_SUBSCRIPTION_STATUSES,
+  normalizePolarEventData,
+  collectPolarMetadata,
+  isProSubscriptionStatus,
+  userHasProTier,
+  parsePolarTimestamp,
+  normalizePolarTimestamp,
+  listPolarSubscriptions,
+  pickBestActiveSubscription,
+  buildCheckoutMetadata,
+  resolveUserFromPolarData,
+  extractSubscriptionFields,
+  collectExternalCustomerIds,
+};

package/plugins/polar/src/webhooks.js

@@ -0,0 +1,248 @@
+'use strict';
+
+const crypto = require('crypto');
+const { syncPolarBillingForUser, applyPolarProSubscription } = require('./sync');
+const {
+  collectPolarMetadata,
+  isProSubscriptionStatus,
+  userHasProTier,
+  parsePolarTimestamp,
+  pickBestActiveSubscription,
+  resolveUserFromPolarData,
+  extractSubscriptionFields,
+} = require('./user-resolver');
+
+function verifyPolarWebhook(rawPayload, headers, secret) {
+  if (!secret) return false;
+
+  const signatureHeader =
+    headers['webhook-signature']
+    || headers['polar-webhook-signature']
+    || headers['x-polar-signature'];
+
+  if (!signatureHeader) return false;
+
+  const webhookId = headers['webhook-id'] || headers['x-webhook-id'] || '';
+  const webhookTimestamp = headers['webhook-timestamp'] || headers['x-webhook-timestamp'] || '';
+
+  const candidates = signatureHeader
+    .split(/[\s,]+/)
+    .map((s) => s.trim().replace(/^v1=|^v1,/, ''))
+    .filter(Boolean);
+
+  const payloadStr = typeof rawPayload === 'string' ? rawPayload : rawPayload.toString('utf8');
+  const standardToSign = webhookId && webhookTimestamp ? `${webhookId}.${webhookTimestamp}.${payloadStr}` : payloadStr;
+
+  const cleanSecret = secret.startsWith('whsec_')
+    ? Buffer.from(secret.slice(6), 'base64')
+    : secret;
+
+  const expectedBase64 = crypto.createHmac('sha256', cleanSecret).update(standardToSign).digest('base64');
+  const expectedHex = crypto.createHmac('sha256', cleanSecret).update(standardToSign).digest('hex');
+  const rawExpectedBase64 = crypto.createHmac('sha256', cleanSecret).update(payloadStr).digest('base64');
+  const rawExpectedHex = crypto.createHmac('sha256', cleanSecret).update(payloadStr).digest('hex');
+
+  const expectedList = [expectedBase64, expectedHex, rawExpectedBase64, rawExpectedHex];
+
+  for (const candidate of candidates) {
+    for (const exp of expectedList) {
+      try {
+        const a = Buffer.from(candidate);
+        const b = Buffer.from(exp);
+        if (a.length === b.length && crypto.timingSafeEqual(a, b)) {
+          return true;
+        }
+      } catch {
+        // continue
+      }
+    }
+  }
+
+  return false;
+}
+
+async function updateUserTier(knex, user, patch, config) {
+  const f = config.fields;
+  if (config.hooks.onSubscriptionChange && patch.tier !== undefined) {
+    await config.hooks.onSubscriptionChange({
+      user,
+      tier: patch.tier,
+      polarStatus: patch[f.polarStatus],
+      subscription: patch._subscription || null,
+      knex,
+      update: patch,
+    });
+    return knex(config.userTable).where(f.id, user[f.id]).first();
+  }
+
+  const { _subscription, ...dbPatch } = patch;
+  await knex(config.userTable).where(f.id, user[f.id]).update({
+    ...dbPatch,
+    updated_at: new Date(),
+  });
+  return knex(config.userTable).where(f.id, user[f.id]).first();
+}
+
+async function handlePolarWebhookEvent(event, knex, config, hooks = {}) {
+  const mergedConfig = { ...config, hooks: { ...config.hooks, ...hooks } };
+
+  if (!event || !event.type || !knex) {
+    return { processed: false, action: 'invalid_event' };
+  }
+
+  const { type, data } = event;
+  const user = await resolveUserFromPolarData(data, knex, mergedConfig);
+
+  if (!user) {
+    console.warn('[polar] Webhook user_not_found', { type, metadata: collectPolarMetadata(data).metadata });
+    return { processed: false, action: 'user_not_found', eventType: type };
+  }
+
+  const f = mergedConfig.fields;
+  const {
+    subscriptionId,
+    customerId,
+    status,
+    periodEnd,
+    cancelAtPeriodEnd,
+  } = extractSubscriptionFields(data, user, mergedConfig);
+
+  switch (type) {
+    case 'subscription.created':
+    case 'subscription.updated':
+    case 'subscription.active':
+    case 'subscription.uncanceled': {
+      const isProActive = isProSubscriptionStatus(status);
+      const patch = {
+        [f.polarStatus]: status,
+        [f.polarCustomerId]: customerId,
+        [f.polarSubscriptionId]: subscriptionId,
+        [f.polarCurrentPeriodEnd]: periodEnd,
+        [f.polarCancelAtPeriodEnd]: cancelAtPeriodEnd,
+        _subscription: data,
+      };
+
+      if (isProActive) {
+        patch[f.tier] = mergedConfig.proTierName;
+        patch.tier = mergedConfig.proTierName;
+        await updateUserTier(knex, user, patch, mergedConfig);
+        return { processed: true, action: 'subscription_activated', userId: user[f.id], tier: mergedConfig.proTierName };
+      }
+
+      patch[f.tier] = user[f.tier];
+      patch.tier = user[f.tier];
+      await updateUserTier(knex, user, patch, mergedConfig);
+
+      const syncedUser = await syncPolarBillingForUser(user, knex, mergedConfig);
+      return {
+        processed: true,
+        action: userHasProTier(syncedUser, mergedConfig) ? 'subscription_synced_to_pro' : 'subscription_pending',
+        userId: user[f.id],
+        tier: syncedUser?.[f.tier] || user[f.tier],
+      };
+    }
+
+    case 'subscription.canceled':
+    case 'subscription.revoked': {
+      const periodEndDate = parsePolarTimestamp(periodEnd);
+      const isImmediate = type === 'subscription.revoked' || !periodEndDate || periodEndDate <= new Date();
+
+      const patch = {
+        [f.polarStatus]: 'canceled',
+        [f.polarCancelAtPeriodEnd]: true,
+        _subscription: data,
+      };
+
+      if (isImmediate) {
+        patch[f.tier] = mergedConfig.freeTierName;
+        patch.tier = mergedConfig.freeTierName;
+      } else {
+        patch[f.tier] = user[f.tier];
+        patch.tier = user[f.tier];
+      }
+
+      await updateUserTier(knex, user, patch, mergedConfig);
+      return {
+        processed: true,
+        action: isImmediate ? 'downgraded_to_free' : 'marked_cancel_pending',
+        userId: user[f.id],
+      };
+    }
+
+    case 'order.created':
+    case 'order.updated':
+    case 'order.paid':
+    case 'checkout.updated': {
+      const syncedUser = await syncPolarBillingForUser(user, knex, mergedConfig);
+      if (userHasProTier(syncedUser, mergedConfig)) {
+        return { processed: true, action: 'order_completed', userId: user[f.id], tier: mergedConfig.proTierName };
+      }
+
+      await knex(mergedConfig.userTable).where(f.id, user[f.id]).update({
+        [f.polarCustomerId]: customerId || user[f.polarCustomerId],
+        updated_at: new Date(),
+      });
+
+      return { processed: true, action: 'checkout_recorded', userId: user[f.id], tier: user[f.tier] };
+    }
+
+    case 'customer.state_changed': {
+      const activeSub = pickBestActiveSubscription(data.active_subscriptions, mergedConfig);
+      if (activeSub) {
+        await applyPolarProSubscription(knex, user, data, activeSub, mergedConfig);
+        return { processed: true, action: 'customer_state_pro', userId: user[f.id], tier: mergedConfig.proTierName };
+      }
+
+      const hasNoActiveSubs = Array.isArray(data.active_subscriptions) && data.active_subscriptions.length === 0;
+      if (hasNoActiveSubs && userHasProTier(user, mergedConfig)) {
+        const patch = {
+          [f.tier]: mergedConfig.freeTierName,
+          tier: mergedConfig.freeTierName,
+          [f.polarStatus]: 'none',
+          [f.polarCancelAtPeriodEnd]: false,
+          [f.polarCurrentPeriodEnd]: null,
+          [f.polarSubscriptionId]: null,
+          [f.polarCustomerId]: data.id || user[f.polarCustomerId],
+        };
+        await updateUserTier(knex, user, patch, mergedConfig);
+        return { processed: true, action: 'customer_state_free', userId: user[f.id], tier: mergedConfig.freeTierName };
+      }
+
+      if (data.id) {
+        await knex(mergedConfig.userTable).where(f.id, user[f.id]).update({
+          [f.polarCustomerId]: data.id,
+          updated_at: new Date(),
+        });
+      }
+
+      return { processed: true, action: 'customer_state_recorded', userId: user[f.id], tier: user[f.tier] };
+    }
+
+    default:
+      return { processed: true, action: 'ignored_event_type', type };
+  }
+}
+
+function createWebhookRawBodyMiddleware(paths = []) {
+  const normalized = new Set(
+    (Array.isArray(paths) ? paths : [paths]).map((p) => (p.startsWith('/') ? p : `/${p}`))
+  );
+
+  return function polarWebhookRawBody(req, res, next) {
+    if (!normalized.has(req.path)) return next();
+
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => {
+      req.rawBody = Buffer.concat(chunks);
+      next();
+    });
+    req.on('error', next);
+  };
+}
+
+module.exports = {
+  verifyPolarWebhook,
+  handlePolarWebhookEvent,
+  createWebhookRawBodyMiddleware,
+};

package/src/file-router.js

@@ -113,8 +113,9 @@ function rewriteDynamicRouteMarkers(route) {
     }
     const inner = route.slice(open + 1, close);
     let repl;
-    if (inner.startsWith('...') && inner.length > 3) {
-      repl = '*';
+    if (inner.startsWith('...')) {
+      const paramName = inner.length > 3 ? inner.slice(3) : 'splat';
+      repl = '*' + paramName;
     } else if (inner.length > 0 && inner.indexOf('[') === -1) {
       repl = ':' + inner;
     } else {
@@ -1049,6 +1050,14 @@ function mountPages(app, options) {
       
       app[route.method](route.routePath, async (req, res, next) => {
         try {
+          if (route.routePath.includes('*') && req.params) {
+            for (const val of Object.values(req.params)) {
+              if (Array.isArray(val) && req.params[0] === undefined) {
+                req.params[0] = val.join('/');
+                break;
+              }
+            }
+          }
           // Same instance as createApp({ db }) / getAppContext().db — available to handler & route middleware
           if (db != null) {
             req.db = db;
@@ -1133,6 +1142,14 @@ function mountPages(app, options) {
 
       app.get(route.routePath, async (req, res, next) => {
         try {
+          if (route.routePath.includes('*') && req.params) {
+            for (const val of Object.values(req.params)) {
+              if (Array.isArray(val) && req.params[0] === undefined) {
+                req.params[0] = val.join('/');
+                break;
+              }
+            }
+          }
           // Detect locale
           const locale = detectLocale(req);
           const defaultLocale = process.env.DEFAULT_LOCALE || 'en';

package/src/helpers.js

@@ -616,31 +616,54 @@ function createHelpers(ctx) {
     // ============================================
 
     /**
-     * Get injected head content
+     * Get CSP nonce if available from request context
+     * @returns {string} Nonce string or empty string
+     */
+    nonce() {
+      return (
+        req?.res?.locals?.cspNonce ||
+        req?.res?.locals?.nonce ||
+        res?.locals?.cspNonce ||
+        res?.locals?.nonce ||
+        req?.cspNonce ||
+        req?.nonce ||
+        ''
+      );
+    },
+
+    /**
+     * Get injected head content (CSS, scripts)
+     * @param {Object|string} [options] - Optional { nonce: string } or nonce string
      * @returns {string} HTML content for head section
      */
-    injectHead() {
+    injectHead(options) {
+      const explicitNonce = typeof options === 'string' ? options : options?.nonce;
+      const nonce = explicitNonce || this.nonce();
       const injector = getScriptInjector();
       let content = '';
       
       // Add styles
-      const styles = injector.getStylesContent();
+      const styles = injector.getStylesContent(nonce ? { nonce } : options);
       if (styles) {
-        content += `<style id="webspresso-injected-styles">\n${styles}\n</style>\n`;
+        const nonceAttr = nonce ? ` nonce="${nonce}"` : '';
+        content += `<style id="webspresso-injected-styles"${nonceAttr}>\n${styles}\n</style>\n`;
       }
       
       // Add head scripts
-      content += injector.getHeadContent();
+      content += injector.getHeadContent(nonce ? { nonce } : options);
       
       return content;
     },
 
     /**
      * Get injected body content (for end of body)
+     * @param {Object|string} [options] - Optional { nonce: string } or nonce string
      * @returns {string} HTML content for body end
      */
-    injectBody() {
-      return getScriptInjector().getBodyContent();
+    injectBody(options) {
+      const explicitNonce = typeof options === 'string' ? options : options?.nonce;
+      const nonce = explicitNonce || this.nonce();
+      return getScriptInjector().getBodyContent(nonce ? { nonce } : options);
     },
 
     /**
@@ -726,25 +749,49 @@ class ScriptInjector {
 
   /**
    * Get head content sorted by priority
+   * @param {Object|string} [options] - Optional { nonce: string } or nonce string
    */
-  getHeadContent() {
+  getHeadContent(options = {}) {
+    const nonce = typeof options === 'string' ? options : (options?.nonce || '');
     const sorted = [...this.headScripts].sort((a, b) => b.priority - a.priority);
-    return sorted.map(s => s.content).join('\n');
+    return sorted.map(s => {
+      let content = typeof s.content === 'function' ? s.content(options) : s.content;
+      if (nonce && typeof content === 'string') {
+        content = content.replace(/<script(?![^>]*\bnonce=)/gi, `<script nonce="${nonce}"`);
+      }
+      return content;
+    }).join('\n');
   }
 
   /**
    * Get body content sorted by priority
+   * @param {Object|string} [options] - Optional { nonce: string } or nonce string
    */
-  getBodyContent() {
+  getBodyContent(options = {}) {
+    const nonce = typeof options === 'string' ? options : (options?.nonce || '');
     const sorted = [...this.bodyScripts].sort((a, b) => b.priority - a.priority);
-    return sorted.map(s => s.content).join('\n');
+    return sorted.map(s => {
+      let content = typeof s.content === 'function' ? s.content(options) : s.content;
+      if (nonce && typeof content === 'string') {
+        content = content.replace(/<script(?![^>]*\bnonce=)/gi, `<script nonce="${nonce}"`);
+      }
+      return content;
+    }).join('\n');
   }
 
   /**
    * Get styles content
+   * @param {Object|string} [options] - Optional { nonce: string } or nonce string
    */
-  getStylesContent() {
-    return this.styles.map(s => s.content).join('\n');
+  getStylesContent(options = {}) {
+    const nonce = typeof options === 'string' ? options : (options?.nonce || '');
+    return this.styles.map(s => {
+      let content = typeof s.content === 'function' ? s.content(options) : s.content;
+      if (nonce && typeof content === 'string') {
+        content = content.replace(/<style(?![^>]*\bnonce=)/gi, `<style nonce="${nonce}"`);
+      }
+      return content;
+    }).join('\n');
   }
 
   /**

package/templates/skills/webspresso-usage/REFERENCE-framework.md

@@ -213,6 +213,7 @@ Pass **`db`** into **`createApp({ db })`** so **`ctx.db`** works in pages and pl
 | `auditLogPlugin` | Admin mutation audit trail |
 | `recaptchaPlugin` | v2/v3 + middleware |
 | `emailPlugin` | MJML + Nodemailer sending with optional admin UI and auth bridge |
+| `polarPlugin` | Polar.sh billing: checkout, portal, webhooks, tier sync (`webspresso polar:migrate`) |
 | `seoCheckerPlugin` | Dev SEO panel |
 | `restResourcePlugin` | Opt-in REST CRUD from models; `?include=` uses ORM eager load (single-level relations only) |
 | `ormCacheAdminPlugin` | Admin page for ORM cache metrics / purge / invalidate (`db.cache` required) |