webspresso 0.0.93 → 0.0.95

package/plugins/polar/src/urls.js

@@ -0,0 +1,141 @@
+'use strict';
+
+function getPolarBuyBase(sandbox) {
+  return sandbox ? 'https://sandbox-buy.polar.sh' : 'https://buy.polar.sh';
+}
+
+function getPolarWebBase(sandbox) {
+  return sandbox ? 'https://sandbox.polar.sh' : 'https://polar.sh';
+}
+
+function isBlockedPolarUrl(urlString) {
+  try {
+    const url = new URL(urlString);
+    const path = url.pathname.replace(/\/+$/, '') || '/';
+    return (
+      path === '/404'
+      || path === '/purchases/subscriptions'
+      || (url.hostname === 'polar.sh' && path === '/')
+    );
+  } catch {
+    return true;
+  }
+}
+
+function isValidCheckoutRedirectUrl(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (isBlockedPolarUrl(urlString)) return false;
+
+    if (
+      url.hostname === 'buy.polar.sh'
+      || url.hostname === 'sandbox-buy.polar.sh'
+    ) {
+      return true;
+    }
+
+    const webHosts = new Set(['polar.sh', 'sandbox.polar.sh', 'www.polar.sh']);
+    if (webHosts.has(url.hostname)) {
+      return (
+        url.pathname.startsWith('/checkout/')
+        || url.pathname.includes('/polar_c_')
+        || url.pathname.includes('/polar_cl_')
+      );
+    }
+
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+function isValidPortalRedirectUrl(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (isBlockedPolarUrl(urlString)) return false;
+    if (url.hostname === 'polar.sh' || url.hostname === 'sandbox.polar.sh') {
+      return /^\/[^/]+\/portal(?:\/|$)/.test(url.pathname);
+    }
+    return url.hostname.endsWith('.polar.sh') && url.pathname.includes('/portal');
+  } catch {
+    return false;
+  }
+}
+
+function extractCheckoutUrlFromResponse(data, sandbox = false) {
+  if (!data || typeof data !== 'object') return null;
+
+  const webBase = getPolarWebBase(sandbox);
+  const candidates = [
+    data.url,
+    data.checkout_url,
+    data.checkout?.url,
+  ].filter(Boolean);
+
+  for (const candidate of candidates) {
+    const normalized = candidate.startsWith('/')
+      ? `${webBase}${candidate}`
+      : candidate;
+    if (isValidCheckoutRedirectUrl(normalized)) {
+      return normalized;
+    }
+  }
+
+  if (data.client_secret) {
+    const built = `${webBase}/checkout/${data.client_secret}`;
+    if (isValidCheckoutRedirectUrl(built)) {
+      return built;
+    }
+  }
+
+  return null;
+}
+
+function polarCspDirectives(opts = {}) {
+  const self = "'self'";
+  const domains = opts.domains || [
+    'https://buy.polar.sh',
+    'https://sandbox-buy.polar.sh',
+    'https://polar.sh',
+    'https://sandbox.polar.sh',
+    'https://api.polar.sh',
+    'https://sandbox-api.polar.sh',
+  ];
+  return {
+    formAction: [self, ...domains],
+    connectSrc: [self, ...domains],
+  };
+}
+
+/**
+ * Union Polar CSP sources into an existing Helmet/plugin CSP config (does not replace).
+ * @param {Object} [existing]
+ * @param {Object} [opts] - passed to polarCspDirectives
+ */
+function mergePolarCspDirectives(existing = {}, opts = {}) {
+  const polar = polarCspDirectives(opts);
+  const mergeList = (key) => {
+    const base = existing[key];
+    const items = [
+      ...(Array.isArray(base) ? base : base ? [base] : []),
+      ...polar[key],
+    ];
+    return [...new Set(items)];
+  };
+  return {
+    ...existing,
+    formAction: mergeList('formAction'),
+    connectSrc: mergeList('connectSrc'),
+  };
+}
+
+module.exports = {
+  getPolarBuyBase,
+  getPolarWebBase,
+  isBlockedPolarUrl,
+  isValidCheckoutRedirectUrl,
+  isValidPortalRedirectUrl,
+  extractCheckoutUrlFromResponse,
+  polarCspDirectives,
+  mergePolarCspDirectives,
+};

package/plugins/polar/src/user-resolver.js

@@ -0,0 +1,199 @@
+'use strict';
+
+const PRO_SUBSCRIPTION_STATUSES = new Set(['active', 'trialing']);
+
+function normalizePolarEventData(data) {
+  if (!data || typeof data !== 'object') return {};
+
+  const subscription = data.subscription && typeof data.subscription === 'object'
+    ? data.subscription
+    : null;
+
+  return {
+    ...data,
+    ...(subscription || {}),
+    metadata: data.metadata || subscription?.metadata || data.checkout?.metadata || {},
+    customer: data.customer || subscription?.customer || data.checkout?.customer || null,
+  };
+}
+
+function collectPolarMetadata(data) {
+  const normalized = normalizePolarEventData(data);
+  const metadata = normalized.metadata && typeof normalized.metadata === 'object'
+    ? normalized.metadata
+    : {};
+  return { normalized, metadata };
+}
+
+function isProSubscriptionStatus(status) {
+  return PRO_SUBSCRIPTION_STATUSES.has(String(status || '').toLowerCase());
+}
+
+function userHasProTier(user, config) {
+  if (!user) return false;
+  const tierField = config.fields.tier;
+  const tier = user[tierField];
+  return config.proTiers.includes(tier);
+}
+
+function parsePolarTimestamp(value) {
+  if (!value) return null;
+  if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value;
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+
+function normalizePolarTimestamp(value) {
+  const parsed = parsePolarTimestamp(value);
+  return parsed ? parsed.toISOString() : null;
+}
+
+function listPolarSubscriptions(data) {
+  if (!data) return [];
+  if (Array.isArray(data)) return data;
+  if (Array.isArray(data.items)) return data.items;
+  if (Array.isArray(data.results)) return data.results;
+  return [];
+}
+
+function pickBestActiveSubscription(subscriptions, config) {
+  const list = Array.isArray(subscriptions) ? subscriptions : [];
+  if (!list.length) return null;
+
+  const activeOnly = list.filter((sub) => !sub.status || isProSubscriptionStatus(sub.status));
+  if (!activeOnly.length) return null;
+
+  const productIds = new Set();
+  for (const planKey of config.proTiers.flatMap((t) => config.tierMapping[t] || [])) {
+    const pid = config.plans[planKey];
+    if (pid) productIds.add(pid);
+  }
+
+  if (productIds.size) {
+    const matched = activeOnly.find((sub) => productIds.has(sub.product_id));
+    if (matched) return matched;
+  }
+
+  return activeOnly[0];
+}
+
+function buildCheckoutMetadata(user, config, customFields = {}) {
+  const f = config.fields;
+  const metadata = {};
+
+  if (user[f.id] != null) metadata.user_id = String(user[f.id]);
+  if (user[f.publicId]) metadata.public_id = String(user[f.publicId]);
+  if (user.username) metadata.username = String(user.username);
+
+  for (const [key, value] of Object.entries(customFields)) {
+    if (value !== undefined && value !== null && String(value).trim() !== '') {
+      metadata[key] = String(value);
+    }
+  }
+
+  const cleaned = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (value !== undefined && value !== null && String(value).trim() !== '') {
+      cleaned[key] = String(value);
+    }
+  }
+  return cleaned;
+}
+
+/**
+ * @param {Object} data
+ * @param {Object} knex
+ * @param {import('./config').PolarConfig} config
+ */
+async function resolveUserFromPolarData(data, knex, config) {
+  if (!data || !knex) return null;
+
+  const { normalized, metadata } = collectPolarMetadata(data);
+  const f = config.fields;
+  const table = config.userTable;
+
+  if (metadata.user_id) {
+    const uid = String(metadata.user_id).trim();
+    let user = await knex(table).where(f.id, uid).first();
+    if (!user && /^\d+$/.test(uid)) {
+      user = await knex(table).where(f.id, Number(uid)).first();
+    }
+    if (user) return user;
+  }
+
+  if (metadata.public_id) {
+    const user = await knex(table).where(f.publicId, String(metadata.public_id)).first();
+    if (user) return user;
+  }
+
+  const externalId =
+    normalized.external_customer_id
+    || normalized.external_id
+    || data.external_id
+    || normalized.customer?.external_id
+    || data.customer?.external_id
+    || null;
+
+  if (externalId) {
+    let user = await knex(table).where(f.publicId, String(externalId)).first();
+    if (!user && /^\d+$/.test(String(externalId))) {
+      user = await knex(table).where(f.id, Number(externalId)).first();
+    }
+    if (user) return user;
+  }
+
+  const email = (
+    normalized.customer?.email
+    || normalized.customer_email
+    || normalized.email
+    || data.customer?.email
+  );
+  if (email) {
+    const user = await knex(table).whereRaw('LOWER(??) = ?', [f.email, String(email).toLowerCase().trim()]).first();
+    if (user) return user;
+  }
+
+  const customerId = normalized.customer_id || normalized.customer?.id || data.customer_id || null;
+  if (customerId) {
+    const user = await knex(table).where(f.polarCustomerId, customerId).first();
+    if (user) return user;
+  }
+
+  return null;
+}
+
+function extractSubscriptionFields(data, user, config) {
+  const normalized = normalizePolarEventData(data);
+  const f = config.fields;
+  return {
+    subscriptionId: normalized.id || user?.[f.polarSubscriptionId] || null,
+    customerId: normalized.customer_id || normalized.customer?.id || user?.[f.polarCustomerId] || null,
+    status: normalized.status || 'active',
+    periodEnd: normalizePolarTimestamp(normalized.current_period_end),
+    cancelAtPeriodEnd: Boolean(normalized.cancel_at_period_end),
+  };
+}
+
+function collectExternalCustomerIds(user, config) {
+  const f = config.fields;
+  return [...new Set([
+    user?.[f.publicId] && String(user[f.publicId]),
+    user?.[f.id] != null && String(user[f.id]),
+  ].filter(Boolean))];
+}
+
+module.exports = {
+  PRO_SUBSCRIPTION_STATUSES,
+  normalizePolarEventData,
+  collectPolarMetadata,
+  isProSubscriptionStatus,
+  userHasProTier,
+  parsePolarTimestamp,
+  normalizePolarTimestamp,
+  listPolarSubscriptions,
+  pickBestActiveSubscription,
+  buildCheckoutMetadata,
+  resolveUserFromPolarData,
+  extractSubscriptionFields,
+  collectExternalCustomerIds,
+};

package/plugins/polar/src/webhooks.js

@@ -0,0 +1,248 @@
+'use strict';
+
+const crypto = require('crypto');
+const { syncPolarBillingForUser, applyPolarProSubscription } = require('./sync');
+const {
+  collectPolarMetadata,
+  isProSubscriptionStatus,
+  userHasProTier,
+  parsePolarTimestamp,
+  pickBestActiveSubscription,
+  resolveUserFromPolarData,
+  extractSubscriptionFields,
+} = require('./user-resolver');
+
+function verifyPolarWebhook(rawPayload, headers, secret) {
+  if (!secret) return false;
+
+  const signatureHeader =
+    headers['webhook-signature']
+    || headers['polar-webhook-signature']
+    || headers['x-polar-signature'];
+
+  if (!signatureHeader) return false;
+
+  const webhookId = headers['webhook-id'] || headers['x-webhook-id'] || '';
+  const webhookTimestamp = headers['webhook-timestamp'] || headers['x-webhook-timestamp'] || '';
+
+  const candidates = signatureHeader
+    .split(/[\s,]+/)
+    .map((s) => s.trim().replace(/^v1=|^v1,/, ''))
+    .filter(Boolean);
+
+  const payloadStr = typeof rawPayload === 'string' ? rawPayload : rawPayload.toString('utf8');
+  const standardToSign = webhookId && webhookTimestamp ? `${webhookId}.${webhookTimestamp}.${payloadStr}` : payloadStr;
+
+  const cleanSecret = secret.startsWith('whsec_')
+    ? Buffer.from(secret.slice(6), 'base64')
+    : secret;
+
+  const expectedBase64 = crypto.createHmac('sha256', cleanSecret).update(standardToSign).digest('base64');
+  const expectedHex = crypto.createHmac('sha256', cleanSecret).update(standardToSign).digest('hex');
+  const rawExpectedBase64 = crypto.createHmac('sha256', cleanSecret).update(payloadStr).digest('base64');
+  const rawExpectedHex = crypto.createHmac('sha256', cleanSecret).update(payloadStr).digest('hex');
+
+  const expectedList = [expectedBase64, expectedHex, rawExpectedBase64, rawExpectedHex];
+
+  for (const candidate of candidates) {
+    for (const exp of expectedList) {
+      try {
+        const a = Buffer.from(candidate);
+        const b = Buffer.from(exp);
+        if (a.length === b.length && crypto.timingSafeEqual(a, b)) {
+          return true;
+        }
+      } catch {
+        // continue
+      }
+    }
+  }
+
+  return false;
+}
+
+async function updateUserTier(knex, user, patch, config) {
+  const f = config.fields;
+  if (config.hooks.onSubscriptionChange && patch.tier !== undefined) {
+    await config.hooks.onSubscriptionChange({
+      user,
+      tier: patch.tier,
+      polarStatus: patch[f.polarStatus],
+      subscription: patch._subscription || null,
+      knex,
+      update: patch,
+    });
+    return knex(config.userTable).where(f.id, user[f.id]).first();
+  }
+
+  const { _subscription, ...dbPatch } = patch;
+  await knex(config.userTable).where(f.id, user[f.id]).update({
+    ...dbPatch,
+    updated_at: new Date(),
+  });
+  return knex(config.userTable).where(f.id, user[f.id]).first();
+}
+
+async function handlePolarWebhookEvent(event, knex, config, hooks = {}) {
+  const mergedConfig = { ...config, hooks: { ...config.hooks, ...hooks } };
+
+  if (!event || !event.type || !knex) {
+    return { processed: false, action: 'invalid_event' };
+  }
+
+  const { type, data } = event;
+  const user = await resolveUserFromPolarData(data, knex, mergedConfig);
+
+  if (!user) {
+    console.warn('[polar] Webhook user_not_found', { type, metadata: collectPolarMetadata(data).metadata });
+    return { processed: false, action: 'user_not_found', eventType: type };
+  }
+
+  const f = mergedConfig.fields;
+  const {
+    subscriptionId,
+    customerId,
+    status,
+    periodEnd,
+    cancelAtPeriodEnd,
+  } = extractSubscriptionFields(data, user, mergedConfig);
+
+  switch (type) {
+    case 'subscription.created':
+    case 'subscription.updated':
+    case 'subscription.active':
+    case 'subscription.uncanceled': {
+      const isProActive = isProSubscriptionStatus(status);
+      const patch = {
+        [f.polarStatus]: status,
+        [f.polarCustomerId]: customerId,
+        [f.polarSubscriptionId]: subscriptionId,
+        [f.polarCurrentPeriodEnd]: periodEnd,
+        [f.polarCancelAtPeriodEnd]: cancelAtPeriodEnd,
+        _subscription: data,
+      };
+
+      if (isProActive) {
+        patch[f.tier] = mergedConfig.proTierName;
+        patch.tier = mergedConfig.proTierName;
+        await updateUserTier(knex, user, patch, mergedConfig);
+        return { processed: true, action: 'subscription_activated', userId: user[f.id], tier: mergedConfig.proTierName };
+      }
+
+      patch[f.tier] = user[f.tier];
+      patch.tier = user[f.tier];
+      await updateUserTier(knex, user, patch, mergedConfig);
+
+      const syncedUser = await syncPolarBillingForUser(user, knex, mergedConfig);
+      return {
+        processed: true,
+        action: userHasProTier(syncedUser, mergedConfig) ? 'subscription_synced_to_pro' : 'subscription_pending',
+        userId: user[f.id],
+        tier: syncedUser?.[f.tier] || user[f.tier],
+      };
+    }
+
+    case 'subscription.canceled':
+    case 'subscription.revoked': {
+      const periodEndDate = parsePolarTimestamp(periodEnd);
+      const isImmediate = type === 'subscription.revoked' || !periodEndDate || periodEndDate <= new Date();
+
+      const patch = {
+        [f.polarStatus]: 'canceled',
+        [f.polarCancelAtPeriodEnd]: true,
+        _subscription: data,
+      };
+
+      if (isImmediate) {
+        patch[f.tier] = mergedConfig.freeTierName;
+        patch.tier = mergedConfig.freeTierName;
+      } else {
+        patch[f.tier] = user[f.tier];
+        patch.tier = user[f.tier];
+      }
+
+      await updateUserTier(knex, user, patch, mergedConfig);
+      return {
+        processed: true,
+        action: isImmediate ? 'downgraded_to_free' : 'marked_cancel_pending',
+        userId: user[f.id],
+      };
+    }
+
+    case 'order.created':
+    case 'order.updated':
+    case 'order.paid':
+    case 'checkout.updated': {
+      const syncedUser = await syncPolarBillingForUser(user, knex, mergedConfig);
+      if (userHasProTier(syncedUser, mergedConfig)) {
+        return { processed: true, action: 'order_completed', userId: user[f.id], tier: mergedConfig.proTierName };
+      }
+
+      await knex(mergedConfig.userTable).where(f.id, user[f.id]).update({
+        [f.polarCustomerId]: customerId || user[f.polarCustomerId],
+        updated_at: new Date(),
+      });
+
+      return { processed: true, action: 'checkout_recorded', userId: user[f.id], tier: user[f.tier] };
+    }
+
+    case 'customer.state_changed': {
+      const activeSub = pickBestActiveSubscription(data.active_subscriptions, mergedConfig);
+      if (activeSub) {
+        await applyPolarProSubscription(knex, user, data, activeSub, mergedConfig);
+        return { processed: true, action: 'customer_state_pro', userId: user[f.id], tier: mergedConfig.proTierName };
+      }
+
+      const hasNoActiveSubs = Array.isArray(data.active_subscriptions) && data.active_subscriptions.length === 0;
+      if (hasNoActiveSubs && userHasProTier(user, mergedConfig)) {
+        const patch = {
+          [f.tier]: mergedConfig.freeTierName,
+          tier: mergedConfig.freeTierName,
+          [f.polarStatus]: 'none',
+          [f.polarCancelAtPeriodEnd]: false,
+          [f.polarCurrentPeriodEnd]: null,
+          [f.polarSubscriptionId]: null,
+          [f.polarCustomerId]: data.id || user[f.polarCustomerId],
+        };
+        await updateUserTier(knex, user, patch, mergedConfig);
+        return { processed: true, action: 'customer_state_free', userId: user[f.id], tier: mergedConfig.freeTierName };
+      }
+
+      if (data.id) {
+        await knex(mergedConfig.userTable).where(f.id, user[f.id]).update({
+          [f.polarCustomerId]: data.id,
+          updated_at: new Date(),
+        });
+      }
+
+      return { processed: true, action: 'customer_state_recorded', userId: user[f.id], tier: user[f.tier] };
+    }
+
+    default:
+      return { processed: true, action: 'ignored_event_type', type };
+  }
+}
+
+function createWebhookRawBodyMiddleware(paths = []) {
+  const normalized = new Set(
+    (Array.isArray(paths) ? paths : [paths]).map((p) => (p.startsWith('/') ? p : `/${p}`))
+  );
+
+  return function polarWebhookRawBody(req, res, next) {
+    if (!normalized.has(req.path)) return next();
+
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => {
+      req.rawBody = Buffer.concat(chunks);
+      next();
+    });
+    req.on('error', next);
+  };
+}
+
+module.exports = {
+  verifyPolarWebhook,
+  handlePolarWebhookEvent,
+  createWebhookRawBodyMiddleware,
+};

package/plugins/rate-limit/index.js

@@ -175,4 +175,8 @@ function rateLimitPlugin(options = {}) {
   return plugin;
 }
 
-module.exports = { rateLimitPlugin };
+module.exports = {
+  rateLimitPlugin,
+  loadPeer,
+  resolveLimiterConfig,
+};

package/src/file-router.js

@@ -113,8 +113,9 @@ function rewriteDynamicRouteMarkers(route) {
     }
     const inner = route.slice(open + 1, close);
     let repl;
-    if (inner.startsWith('...') && inner.length > 3) {
-      repl = '*';
+    if (inner.startsWith('...')) {
+      const paramName = inner.length > 3 ? inner.slice(3) : 'splat';
+      repl = '*' + paramName;
     } else if (inner.length > 0 && inner.indexOf('[') === -1) {
       repl = ':' + inner;
     } else {
@@ -1049,6 +1050,14 @@ function mountPages(app, options) {
       
       app[route.method](route.routePath, async (req, res, next) => {
         try {
+          if (route.routePath.includes('*') && req.params) {
+            for (const val of Object.values(req.params)) {
+              if (Array.isArray(val) && req.params[0] === undefined) {
+                req.params[0] = val.join('/');
+                break;
+              }
+            }
+          }
           // Same instance as createApp({ db }) / getAppContext().db — available to handler & route middleware
           if (db != null) {
             req.db = db;
@@ -1133,6 +1142,14 @@ function mountPages(app, options) {
 
       app.get(route.routePath, async (req, res, next) => {
         try {
+          if (route.routePath.includes('*') && req.params) {
+            for (const val of Object.values(req.params)) {
+              if (Array.isArray(val) && req.params[0] === undefined) {
+                req.params[0] = val.join('/');
+                break;
+              }
+            }
+          }
           // Detect locale
           const locale = detectLocale(req);
           const defaultLocale = process.env.DEFAULT_LOCALE || 'en';