webspresso 0.0.93 → 0.0.95

package/plugins/polar/src/middleware.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const { syncPolarBillingForUser } = require('./sync');
+
+/**
+ * Optional middleware: sync billing from Polar on matching requests (webhook delay fallback).
+ * @param {import('./config').PolarConfig} config
+ * @param {Object} [opts]
+ * @param {(req: import('express').Request) => boolean} [opts.when]
+ */
+function polarSyncMiddleware(config, opts = {}) {
+  const when = opts.when || config.syncMiddleware?.when || (() => false);
+
+  return async function polarSync(req, res, next) {
+    try {
+      if (!when(req) || !req.user) return next();
+
+      const knex = config.db?.knex || config.db;
+      if (!knex || !config.accessToken) return next();
+
+      const f = config.fields;
+      let user = req.user;
+      const dbUser = await knex(config.userTable).where(f.id, req.user[f.id] || req.user.id).first();
+      if (dbUser) user = dbUser;
+
+      req.user = await syncPolarBillingForUser(user, knex, config);
+      next();
+    } catch (err) {
+      console.error('[polar] Sync middleware error:', err.message);
+      next();
+    }
+  };
+}
+
+module.exports = {
+  polarSyncMiddleware,
+};

package/plugins/polar/src/migration.js

@@ -0,0 +1,58 @@
+'use strict';
+
+const { DEFAULT_FIELDS } = require('./config');
+
+/**
+ * Generate idempotent Knex migration for Polar billing columns.
+ * @param {Object} [opts]
+ * @param {string} [opts.tableName='users']
+ * @param {Object} [opts.fields]
+ */
+function generatePolarMigration(opts = {}) {
+  const tableName = opts.tableName || 'users';
+  const f = { ...DEFAULT_FIELDS, ...(opts.fields || {}) };
+
+  return `/**
+ * Migration: Add Polar.sh billing fields to ${tableName}
+ * Auto-generated by polar plugin — idempotent (safe to re-run)
+ */
+
+exports.up = async function up(knex) {
+  const hasTable = await knex.schema.hasTable('${tableName}');
+  if (!hasTable) return;
+
+  const hasTier = await knex.schema.hasColumn('${tableName}', '${f.tier}');
+  if (!hasTier) {
+    await knex.schema.alterTable('${tableName}', (table) => {
+      table.string('${f.tier}', 32).notNullable().defaultTo('free').index();
+      table.string('${f.polarCustomerId}', 128).nullable().index();
+      table.string('${f.polarSubscriptionId}', 128).nullable().index();
+      table.string('${f.polarStatus}', 32).notNullable().defaultTo('none').index();
+      table.string('${f.polarCurrentPeriodEnd}', 64).nullable();
+      table.boolean('${f.polarCancelAtPeriodEnd}').notNullable().defaultTo(false);
+    });
+  }
+};
+
+exports.down = async function down(knex) {
+  const hasTable = await knex.schema.hasTable('${tableName}');
+  if (!hasTable) return;
+
+  const hasTier = await knex.schema.hasColumn('${tableName}', '${f.tier}');
+  if (hasTier) {
+    await knex.schema.alterTable('${tableName}', (table) => {
+      table.dropColumn('${f.tier}');
+      table.dropColumn('${f.polarCustomerId}');
+      table.dropColumn('${f.polarSubscriptionId}');
+      table.dropColumn('${f.polarStatus}');
+      table.dropColumn('${f.polarCurrentPeriodEnd}');
+      table.dropColumn('${f.polarCancelAtPeriodEnd}');
+    });
+  }
+};
+`;
+}
+
+module.exports = {
+  generatePolarMigration,
+};

package/plugins/polar/src/nunjucks-filters.js

@@ -0,0 +1,56 @@
+'use strict';
+
+function dateLabel(value) {
+  if (!value) return '';
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime()) ? '' : value.toISOString().slice(0, 10);
+  }
+  const str = String(value);
+  if (/^\d{4}-\d{2}-\d{2}/.test(str)) return str.slice(0, 10);
+  const parsed = new Date(str);
+  return Number.isNaN(parsed.getTime()) ? str.slice(0, 10) : parsed.toISOString().slice(0, 10);
+}
+
+function createSafeTruncateFilter(originalTruncate) {
+  return function safeTruncate(value, length, end) {
+    if (value == null) return '';
+    if (value instanceof Date) {
+      return dateLabel(value);
+    }
+    if (typeof value === 'object') {
+      try {
+        return originalTruncate(JSON.stringify(value), length, end);
+      } catch {
+        return originalTruncate(String(value), length, end);
+      }
+    }
+    return originalTruncate(String(value), length, end);
+  };
+}
+
+function defaultTruncate(value, length = 20, end = '…') {
+  const str = value instanceof Date ? dateLabel(value) : String(value ?? '');
+  if (str.length <= length) return str;
+  return `${str.slice(0, length)}${end}`;
+}
+
+function registerNunjucksFilters(nunjucksEnv) {
+  nunjucksEnv.addFilter('dateLabel', dateLabel);
+
+  let existing = null;
+  if (typeof nunjucksEnv.getFilter === 'function') {
+    existing = nunjucksEnv.getFilter('truncate');
+  }
+
+  const truncateFn = typeof existing === 'function'
+    ? createSafeTruncateFilter(existing)
+    : defaultTruncate;
+
+  nunjucksEnv.addFilter('truncate', truncateFn, true);
+}
+
+module.exports = {
+  dateLabel,
+  createSafeTruncateFilter,
+  registerNunjucksFilters,
+};

package/plugins/polar/src/portal.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const { polarApiRequest } = require('./api');
+const { isValidPortalRedirectUrl } = require('./urls');
+
+function getDefaultPortalUrl(config) {
+  if (!config.orgSlug) return null;
+  const host = config.sandbox ? 'https://sandbox.polar.sh' : 'https://polar.sh';
+  return `${host}/${config.orgSlug}/portal`;
+}
+
+async function getPolarPortalUrl(user, baseUrl, config) {
+  const defaultPortal = getDefaultPortalUrl(config);
+  const f = config.fields;
+
+  if (config.accessToken && user[f.polarCustomerId]) {
+    try {
+      const payload = { customer_id: user[f.polarCustomerId] };
+      if (baseUrl) {
+        const returnPath = config.urls.return.startsWith('http')
+          ? config.urls.return
+          : `${baseUrl}${config.urls.return}`;
+        payload.return_url = returnPath;
+      }
+
+      const data = await polarApiRequest('/customer-sessions/', {
+        method: 'POST',
+        body: payload,
+        accessToken: config.accessToken,
+        sandbox: config.sandbox,
+      });
+
+      if (data.customer_portal_url && isValidPortalRedirectUrl(data.customer_portal_url)) {
+        return data.customer_portal_url;
+      }
+    } catch (err) {
+      console.error('[polar] Portal API error:', err.message);
+    }
+  }
+
+  if (defaultPortal && isValidPortalRedirectUrl(defaultPortal)) {
+    return defaultPortal;
+  }
+
+  throw new Error('Polar customer portal is not configured. Set POLAR_ORG_SLUG to your Polar organization slug.');
+}
+
+module.exports = {
+  getDefaultPortalUrl,
+  getPolarPortalUrl,
+};

package/plugins/polar/src/rate-limit.js

@@ -0,0 +1,138 @@
+'use strict';
+
+const { loadPeer } = require('../../rate-limit/index.js');
+
+const DEFAULT_IPV6_SUBNET = 56;
+
+/**
+ * @param {Function} ipKeyGenerator
+ * @param {string} prefix
+ */
+function polarIpKey(ipKeyGenerator, prefix) {
+  return (req) => `${prefix}:${ipKeyGenerator(req.ip, DEFAULT_IPV6_SUBNET)}`;
+}
+
+/**
+ * Prefer authenticated user id; fall back to IPv6-safe IP key (express-rate-limit v8).
+ * @param {Function} ipKeyGenerator
+ * @param {string} prefix
+ */
+function polarUserOrIpKey(ipKeyGenerator, prefix) {
+  const ipKey = polarIpKey(ipKeyGenerator, prefix);
+  return (req) => (req.user?.id != null ? `${prefix}:${req.user.id}` : ipKey(req));
+}
+
+/**
+ * @param {Function} ipKeyGenerator
+ */
+function buildDefaultRateLimits(ipKeyGenerator) {
+  return {
+    webhook: {
+      limit: 120,
+      windowMs: 60_000,
+      message: { error: 'Too many webhook requests' },
+      keyGenerator: polarIpKey(ipKeyGenerator, 'polar:webhook'),
+    },
+    checkout: {
+      limit: 5,
+      windowMs: 60_000,
+      message: { error: 'Too many checkout attempts. Please try again later.' },
+      keyGenerator: polarUserOrIpKey(ipKeyGenerator, 'polar:checkout'),
+    },
+    portal: {
+      limit: 10,
+      windowMs: 60_000,
+      message: { error: 'Too many portal requests. Please try again later.' },
+      keyGenerator: polarUserOrIpKey(ipKeyGenerator, 'polar:portal'),
+    },
+    status: {
+      limit: 60,
+      windowMs: 60_000,
+      message: { error: 'Too many billing status requests' },
+      keyGenerator: polarUserOrIpKey(ipKeyGenerator, 'polar:status'),
+    },
+  };
+}
+
+/** @type {ReturnType<typeof buildDefaultRateLimits>|null} */
+let cachedDefaults = null;
+
+function loadIpKeyGenerator() {
+  try {
+    const { ipKeyGenerator } = loadPeer();
+    return ipKeyGenerator;
+  } catch {
+    return null;
+  }
+}
+
+function getDefaultRateLimits() {
+  const ipKeyGenerator = loadIpKeyGenerator();
+  if (!ipKeyGenerator) {
+    return null;
+  }
+  if (!cachedDefaults) {
+    cachedDefaults = buildDefaultRateLimits(ipKeyGenerator);
+  }
+  return cachedDefaults;
+}
+
+/**
+ * Build per-route limiter middleware from rateLimitPlugin factory.
+ * @param {Object} ctx - plugin onRoutesReady context
+ * @param {import('./config').PolarConfig} config
+ */
+function resolvePolarRateLimiters(ctx, config) {
+  const rlOpt = config.rateLimit;
+  if (rlOpt === false || rlOpt?.enabled === false) {
+    return {};
+  }
+
+  const factory = ctx.middlewares?.rateLimit;
+  if (typeof factory !== 'function') {
+    if (rlOpt === true || (rlOpt && typeof rlOpt === 'object')) {
+      console.warn(
+        '[polar] rateLimit is enabled but rateLimitPlugin is not loaded — add rateLimitPlugin() before polarPlugin in plugins[]'
+      );
+    }
+    return {};
+  }
+
+  const defaults = getDefaultRateLimits();
+  if (!defaults) {
+    console.warn(
+      '[polar] rateLimit is enabled but express-rate-limit >= 8 is not installed — skipping polar rate limiters'
+    );
+    return {};
+  }
+
+  const overrides = rlOpt === true ? {} : (rlOpt || {});
+  const routes = ['webhook', 'checkout', 'portal', 'status'];
+  const out = {};
+
+  for (const route of routes) {
+    if (overrides[route] === false) continue;
+    const opts = {
+      ...defaults[route],
+      ...(typeof overrides[route] === 'object' ? overrides[route] : {}),
+    };
+    out[route] = factory(opts);
+  }
+
+  return out;
+}
+
+module.exports = {
+  loadIpKeyGenerator,
+  polarIpKey,
+  polarUserOrIpKey,
+  buildDefaultRateLimits,
+  getDefaultRateLimits,
+  resolvePolarRateLimiters,
+  /** @deprecated use getDefaultRateLimits() */
+  get DEFAULT_RATE_LIMITS() {
+    return getDefaultRateLimits() || buildDefaultRateLimits(
+      loadIpKeyGenerator() || ((ip) => String(ip))
+    );
+  },
+};

package/plugins/polar/src/routes.js

@@ -0,0 +1,213 @@
+'use strict';
+
+const { verifyPolarWebhook, handlePolarWebhookEvent } = require('./webhooks');
+const { getPolarCheckoutUrl } = require('./checkout');
+const { getPolarPortalUrl } = require('./portal');
+const { syncPolarBillingForUser } = require('./sync');
+const { userHasProTier } = require('./user-resolver');
+const { userIsPaid } = require('./billing-hooks');
+
+function resolveKnex(db) {
+  return db?.knex || (typeof db?.raw === 'function' ? db : null);
+}
+
+function wantsJson(req) {
+  return req.xhr
+    || req.headers.accept?.includes('application/json')
+    || req.is('json');
+}
+
+function resolveBaseUrl(req, config) {
+  return config.baseUrl || `${req.protocol}://${req.get('host')}`;
+}
+
+function createInjectDb(db) {
+  return (req, res, next) => {
+    if (db && !req.db) req.db = db;
+    next();
+  };
+}
+
+function createWebhookHandler(config) {
+  return async function polarWebhookHandler(req, res) {
+    try {
+      const secret = config.webhookSecret;
+      if (!secret) {
+        return res.status(500).json({ error: 'POLAR_WEBHOOK_SECRET is not configured' });
+      }
+
+      const rawPayload = req.rawBody
+        ? (Buffer.isBuffer(req.rawBody) ? req.rawBody.toString('utf8') : String(req.rawBody))
+        : (typeof req.body === 'string' ? req.body : JSON.stringify(req.body));
+
+      if (!verifyPolarWebhook(rawPayload, req.headers, secret)) {
+        return res.status(401).json({ error: 'Invalid webhook signature', received: false });
+      }
+
+      const knex = resolveKnex(config.db);
+      if (!knex) {
+        return res.status(500).json({ error: 'Database unavailable' });
+      }
+
+      const event = typeof req.body === 'object' && req.body && !Buffer.isBuffer(req.body)
+        ? req.body
+        : JSON.parse(rawPayload);
+
+      const result = await handlePolarWebhookEvent(event, knex, config);
+      return res.status(200).json({
+        received: true,
+        processed: result.processed,
+        action: result.action,
+        userId: result.userId,
+      });
+    } catch (err) {
+      console.error('[polar] Webhook error:', err);
+      return res.status(400).json({ error: err.message || 'Webhook processing failed' });
+    }
+  };
+}
+
+function createCheckoutHandler(config) {
+  return async function polarCheckoutHandler(req, res) {
+    try {
+      if (!req.user) {
+        if (wantsJson(req)) return res.status(401).json({ error: 'Authentication required' });
+        return res.redirect(config.urls.login);
+      }
+
+      const knex = resolveKnex(config.db);
+      const f = config.fields;
+      let user = req.user;
+
+      if (knex) {
+        const dbUser = await knex(config.userTable).where(f.id, req.user[f.id] || req.user.id).first();
+        if (dbUser) user = dbUser;
+        if (config.accessToken && config.syncBeforeCheckout) {
+          user = await syncPolarBillingForUser(user, knex, config);
+        }
+      }
+
+      if (await userIsPaid(user, knex, config)) {
+        const alreadyUrl = config.urls.alreadySubscribed.startsWith('http')
+          ? config.urls.alreadySubscribed
+          : config.urls.alreadySubscribed;
+        if (wantsJson(req)) {
+          return res.status(409).json({
+            error: 'You already have an active subscription.',
+            tier: user[f.tier],
+            polarStatus: user[f.polarStatus] || 'active',
+          });
+        }
+        return res.redirect(alreadyUrl);
+      }
+
+      const plan = req.body?.plan || req.query?.plan || 'pro_monthly';
+      const baseUrl = resolveBaseUrl(req, config);
+      const checkoutUrl = await getPolarCheckoutUrl({ user, plan, baseUrl, config });
+
+      if (wantsJson(req)) {
+        return res.json({ url: checkoutUrl });
+      }
+      return res.redirect(checkoutUrl);
+    } catch (err) {
+      console.error('[polar] Checkout error:', err.message);
+      if (wantsJson(req)) {
+        return res.status(503).json({ error: 'Checkout is temporarily unavailable. Please try again later.' });
+      }
+      const errUrl = config.urls.return.includes('?')
+        ? `${config.urls.return}&error=checkout_unavailable`
+        : `${config.urls.return}?error=checkout_unavailable`;
+      return res.redirect(errUrl);
+    }
+  };
+}
+
+function createPortalHandler(config) {
+  return async function polarPortalHandler(req, res) {
+    try {
+      if (!req.user) {
+        return res.redirect(config.urls.login);
+      }
+
+      const baseUrl = resolveBaseUrl(req, config);
+      const portalUrl = await getPolarPortalUrl(req.user, baseUrl, config);
+      return res.redirect(portalUrl);
+    } catch (err) {
+      console.error('[polar] Portal error:', err.message);
+      const errUrl = config.urls.return.includes('?')
+        ? `${config.urls.return}&error=portal_unavailable`
+        : `${config.urls.return}?error=portal_unavailable`;
+      return res.redirect(errUrl);
+    }
+  };
+}
+
+function createStatusHandler(config) {
+  return async function polarStatusHandler(req, res, next) {
+    try {
+      const knex = resolveKnex(config.db);
+      const f = config.fields;
+      let user = req.user;
+
+      if (!user) {
+        return res.status(401).json({ error: 'Unauthorized' });
+      }
+
+      if (knex) {
+        const dbUser = await knex(config.userTable).where(f.id, user[f.id] || user.id).first();
+        if (dbUser) user = dbUser;
+        if (config.accessToken) {
+          user = await syncPolarBillingForUser(user, knex, config);
+        }
+      }
+
+      const tier = user[f.tier] || config.freeTierName;
+      const isPro = userHasProTier(user, config);
+
+      return res.json({
+        userId: user[f.id],
+        publicId: user[f.publicId],
+        tier,
+        isPro,
+        polarStatus: user[f.polarStatus] || 'none',
+        polarCustomerId: user[f.polarCustomerId] || null,
+        polarSubscriptionId: user[f.polarSubscriptionId] || null,
+        polarCurrentPeriodEnd: user[f.polarCurrentPeriodEnd] || null,
+        polarCancelAtPeriodEnd: Boolean(user[f.polarCancelAtPeriodEnd]),
+      });
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+
+function createRequireAuth(config, ctx) {
+  if (typeof config.requireAuth === 'function') {
+    return config.requireAuth;
+  }
+
+  const authFactory = ctx.middlewares?.auth;
+  if (typeof authFactory === 'function') {
+    return (req, res, next) => {
+      const isApi = req.path.startsWith('/api/') || wantsJson(req);
+      return authFactory({ api: isApi })(req, res, next);
+    };
+  }
+
+  return (req, res, next) => {
+    if (req.user) return next();
+    if (wantsJson(req) || req.path.startsWith('/api/')) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    return res.redirect(config.urls.login);
+  };
+}
+
+module.exports = {
+  createInjectDb,
+  createWebhookHandler,
+  createCheckoutHandler,
+  createPortalHandler,
+  createStatusHandler,
+  createRequireAuth,
+};

package/plugins/polar/src/sync.js

@@ -0,0 +1,138 @@
+'use strict';
+
+const { polarApiRequest } = require('./api');
+const {
+  userHasProTier,
+  listPolarSubscriptions,
+  pickBestActiveSubscription,
+  normalizePolarTimestamp,
+  collectExternalCustomerIds,
+} = require('./user-resolver');
+
+async function applyPolarProSubscription(knex, user, customerState, subscription, config) {
+  const f = config.fields;
+  const update = {
+    [f.tier]: config.proTierName,
+    [f.polarStatus]: subscription.status || 'active',
+    [f.polarCustomerId]: customerState?.id || subscription.customer_id || user[f.polarCustomerId] || null,
+    [f.polarSubscriptionId]: subscription.id || user[f.polarSubscriptionId] || null,
+    [f.polarCurrentPeriodEnd]: normalizePolarTimestamp(subscription.current_period_end),
+    [f.polarCancelAtPeriodEnd]: Boolean(subscription.cancel_at_period_end),
+    updated_at: new Date(),
+  };
+
+  if (config.hooks.onSubscriptionChange) {
+    await config.hooks.onSubscriptionChange({
+      user,
+      tier: config.proTierName,
+      polarStatus: update[f.polarStatus],
+      subscription,
+      knex,
+      update,
+    });
+  } else {
+    await knex(config.userTable).where(f.id, user[f.id]).update(update);
+  }
+
+  return knex(config.userTable).where(f.id, user[f.id]).first();
+}
+
+async function syncFromCustomerState(user, knex, customerState, config) {
+  if (!customerState) return user;
+
+  const activeSub = pickBestActiveSubscription(customerState.active_subscriptions, config);
+  if (activeSub) {
+    return applyPolarProSubscription(knex, user, customerState, activeSub, config);
+  }
+
+  const f = config.fields;
+  if (customerState.id && customerState.id !== user[f.polarCustomerId]) {
+    const patch = {
+      [f.polarCustomerId]: customerState.id,
+      updated_at: new Date(),
+    };
+    await knex(config.userTable).where(f.id, user[f.id]).update(patch);
+    return { ...user, [f.polarCustomerId]: customerState.id };
+  }
+
+  return user;
+}
+
+async function syncPolarBillingForUser(user, knex, config) {
+  if (!user || !knex || !config.accessToken) {
+    return user;
+  }
+
+  const apiOpts = { accessToken: config.accessToken, sandbox: config.sandbox };
+  const externalIds = collectExternalCustomerIds(user, config);
+
+  for (const externalId of externalIds) {
+    try {
+      const state = await polarApiRequest(
+        `/customers/external/${encodeURIComponent(externalId)}/state`,
+        apiOpts
+      );
+      user = await syncFromCustomerState(user, knex, state, config);
+      if (userHasProTier(user, config)) return user;
+    } catch (err) {
+      if (!String(err.message || '').includes('404')) {
+        console.error('[polar] Sync error (external state):', externalId, err.message);
+      }
+    }
+  }
+
+  const f = config.fields;
+  if (user[f.polarCustomerId]) {
+    try {
+      const state = await polarApiRequest(`/customers/${user[f.polarCustomerId]}/state`, apiOpts);
+      user = await syncFromCustomerState(user, knex, state, config);
+      if (userHasProTier(user, config)) return user;
+    } catch (err) {
+      if (!String(err.message || '').includes('404')) {
+        console.error('[polar] Sync error (customer state):', user[f.polarCustomerId], err.message);
+      }
+    }
+  }
+
+  if (user[f.email]) {
+    try {
+      const customersData = await polarApiRequest(
+        `/customers/?email=${encodeURIComponent(String(user[f.email]).trim())}&limit=5`,
+        apiOpts
+      );
+      for (const customer of listPolarSubscriptions(customersData)) {
+        if (!customer?.id) continue;
+        const state = await polarApiRequest(`/customers/${customer.id}/state`, apiOpts);
+        user = await syncFromCustomerState(user, knex, state, config);
+        if (userHasProTier(user, config)) return user;
+      }
+    } catch (err) {
+      console.error('[polar] Sync error (email lookup):', user[f.email], err.message);
+    }
+  }
+
+  for (const externalId of externalIds) {
+    try {
+      const subsData = await polarApiRequest(
+        `/subscriptions/?external_customer_id=${encodeURIComponent(externalId)}&limit=10`,
+        apiOpts
+      );
+      const activeSub = pickBestActiveSubscription(listPolarSubscriptions(subsData), config);
+      if (activeSub) {
+        return applyPolarProSubscription(knex, user, { id: activeSub.customer_id }, activeSub, config);
+      }
+    } catch (err) {
+      if (!String(err.message || '').includes('404')) {
+        console.error('[polar] Sync error (subscriptions list):', externalId, err.message);
+      }
+    }
+  }
+
+  return user;
+}
+
+module.exports = {
+  applyPolarProSubscription,
+  syncFromCustomerState,
+  syncPolarBillingForUser,
+};