whale-code 6.4.0

package/dist/server/handlers/api-keys.js

@@ -0,0 +1,221 @@
+// server/handlers/api-keys.ts — API Key management: create, list, get, revoke, update
+// Supports linking keys to creations (TV menus, displays, landing pages)
+import { createHash, randomUUID } from "node:crypto";
+const KEY_COLS = "id, name, key_prefix, key_type, scope, is_active, rate_limit_per_minute, rate_limit_per_day, last_used_at, request_count, expires_at, revoked_at, revoked_reason, creation_id, created_at, updated_at";
+export async function handleAPIKeys(sb, args, storeId) {
+    const sid = storeId;
+    const action = args.action;
+    switch (action) {
+        // ---- generate: Create a new API key ----
+        case "generate": {
+            const name = args.name;
+            if (!name?.trim())
+                return { success: false, error: "name is required" };
+            const keyType = args.key_type || "live";
+            if (keyType !== "live" && keyType !== "test") {
+                return { success: false, error: "key_type must be 'live' or 'test'" };
+            }
+            const scopes = args.scopes || ["*"];
+            const rateLimitPerMinute = args.rate_limit_per_minute || 60;
+            const rateLimitPerDay = args.rate_limit_per_day || 10000;
+            const expiresAt = args.expires_at;
+            const creationId = args.creation_id;
+            // Resolve owner — use provided owner_user_id or find store owner
+            let ownerUserId = args.owner_user_id;
+            if (!ownerUserId) {
+                const { data: store } = await sb
+                    .from("stores")
+                    .select("owner_user_id")
+                    .eq("id", sid)
+                    .single();
+                if (store?.owner_user_id) {
+                    ownerUserId = store.owner_user_id;
+                }
+            }
+            if (!ownerUserId) {
+                return { success: false, error: "Could not determine key owner. Provide owner_user_id or ensure store has an owner." };
+            }
+            // If creation_id provided, verify it belongs to this store
+            if (creationId) {
+                const { data: creation } = await sb
+                    .from("creations")
+                    .select("id, name")
+                    .eq("id", creationId)
+                    .eq("store_id", sid)
+                    .single();
+                if (!creation) {
+                    return { success: false, error: "Creation not found in this store." };
+                }
+            }
+            // Generate key: wk_<type>_<32-char-random>
+            const rawUuid = randomUUID().replace(/-/g, "");
+            const keyValue = `wk_${keyType}_${rawUuid}`;
+            const keyPrefix = keyValue.substring(0, 12);
+            const keyHash = createHash("sha256").update(keyValue).digest("hex");
+            const { data, error } = await sb.from("api_keys").insert({
+                owner_user_id: ownerUserId,
+                store_id: sid,
+                name: name.trim(),
+                key_prefix: keyPrefix,
+                key_hash: keyHash,
+                key_type: keyType,
+                scope: scopes,
+                is_active: true,
+                rate_limit_per_minute: rateLimitPerMinute,
+                rate_limit_per_day: rateLimitPerDay,
+                expires_at: expiresAt || null,
+                creation_id: creationId || null,
+            }).select(KEY_COLS).single();
+            if (error)
+                return { success: false, error: error.message };
+            return {
+                success: true,
+                data: {
+                    ...data,
+                    key_value: keyValue,
+                    warning: "Copy this key now. The full key value will NOT be returned again — only the hash is stored.",
+                },
+            };
+        }
+        // ---- list: List all API keys for store ----
+        case "list": {
+            const limit = Math.min(args.limit || 25, 100);
+            let q = sb
+                .from("api_keys")
+                .select(KEY_COLS)
+                .eq("store_id", sid)
+                .order("created_at", { ascending: false })
+                .limit(limit);
+            if (args.is_active !== undefined)
+                q = q.eq("is_active", args.is_active);
+            if (args.key_type)
+                q = q.eq("key_type", args.key_type);
+            if (args.creation_id)
+                q = q.eq("creation_id", args.creation_id);
+            const { data, error } = await q;
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data: { count: data?.length || 0, keys: data } };
+        }
+        // ---- get: Get a single API key by ID ----
+        case "get": {
+            const keyId = args.key_id;
+            if (!keyId)
+                return { success: false, error: "key_id is required" };
+            const { data, error } = await sb
+                .from("api_keys")
+                .select(KEY_COLS)
+                .eq("id", keyId)
+                .eq("store_id", sid)
+                .single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data };
+        }
+        // ---- revoke: Deactivate an API key ----
+        case "revoke": {
+            const keyId = args.key_id;
+            if (!keyId)
+                return { success: false, error: "key_id is required" };
+            const reason = args.reason || "Revoked via MCP tool";
+            const { data, error } = await sb
+                .from("api_keys")
+                .update({
+                is_active: false,
+                revoked_at: new Date().toISOString(),
+                revoked_reason: reason,
+            })
+                .eq("id", keyId)
+                .eq("store_id", sid)
+                .eq("is_active", true)
+                .select("id, name, key_prefix, is_active, revoked_at, revoked_reason, creation_id")
+                .single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data };
+        }
+        // ---- update: Update key name, scopes, rate limits, or creation link ----
+        case "update": {
+            const keyId = args.key_id;
+            if (!keyId)
+                return { success: false, error: "key_id is required" };
+            const updates = {};
+            if (args.name !== undefined)
+                updates.name = args.name;
+            if (args.scopes !== undefined)
+                updates.scope = args.scopes;
+            if (args.rate_limit_per_minute !== undefined)
+                updates.rate_limit_per_minute = args.rate_limit_per_minute;
+            if (args.rate_limit_per_day !== undefined)
+                updates.rate_limit_per_day = args.rate_limit_per_day;
+            if (args.expires_at !== undefined)
+                updates.expires_at = args.expires_at || null;
+            if (args.creation_id !== undefined)
+                updates.creation_id = args.creation_id || null;
+            if (Object.keys(updates).length === 0) {
+                return { success: false, error: "No fields to update." };
+            }
+            const { data, error } = await sb
+                .from("api_keys")
+                .update(updates)
+                .eq("id", keyId)
+                .eq("store_id", sid)
+                .select(KEY_COLS)
+                .single();
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data };
+        }
+        // ---- delete: Permanently delete an API key ----
+        case "delete": {
+            const keyId = args.key_id;
+            if (!keyId)
+                return { success: false, error: "key_id is required" };
+            const { error } = await sb
+                .from("api_keys")
+                .delete()
+                .eq("id", keyId)
+                .eq("store_id", sid);
+            if (error)
+                return { success: false, error: error.message };
+            return { success: true, data: { deleted: true, key_id: keyId } };
+        }
+        // ---- list_creations: List creations available for key linking ----
+        case "list_creations": {
+            const creationType = args.creation_type;
+            const limit = Math.min(args.limit || 50, 100);
+            let q = sb
+                .from("creations")
+                .select("id, name, creation_type, status, slug, display_mode, location_id, created_at")
+                .eq("store_id", sid)
+                .order("creation_type")
+                .order("name")
+                .limit(limit);
+            if (creationType)
+                q = q.eq("creation_type", creationType);
+            const { data, error } = await q;
+            if (error)
+                return { success: false, error: error.message };
+            // Also fetch which creations already have API keys
+            const creationIds = (data || []).map((c) => c.id);
+            const { data: linkedKeys } = creationIds.length > 0
+                ? await sb.from("api_keys").select("creation_id, id, name, key_prefix, is_active").in("creation_id", creationIds).eq("store_id", sid)
+                : { data: [] };
+            const keyMap = new Map();
+            for (const k of linkedKeys || []) {
+                if (k.creation_id)
+                    keyMap.set(k.creation_id, k);
+            }
+            const enriched = (data || []).map((c) => ({
+                ...c,
+                api_key: keyMap.get(c.id) || null,
+            }));
+            return { success: true, data: { count: enriched.length, creations: enriched } };
+        }
+        default:
+            return {
+                success: false,
+                error: `Unknown api_keys action: ${action}. Available: generate, list, get, revoke, update, delete, list_creations`,
+            };
+    }
+}

package/dist/server/handlers/billing.d.ts

@@ -0,0 +1,33 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export interface UsageCounters {
+    messages_in: number;
+    messages_out: number;
+    agent_invocations: number;
+    tokens_used: number;
+    api_calls: number;
+}
+export interface StorePlan {
+    plan: "free" | "starter" | "pro" | "enterprise";
+    limits: {
+        messages_per_month: number;
+        agent_invocations_per_month: number;
+        tokens_per_month: number;
+        nodes_max: number;
+        channels_per_node: number;
+    };
+}
+/** Increment usage counters for a store */
+export declare function incrementUsage(supabase: SupabaseClient, storeId: string, counters: Partial<UsageCounters>): Promise<void>;
+/** Check if a store is within its plan limits */
+export declare function checkPlanLimits(supabase: SupabaseClient, storeId: string, action: "message" | "agent_invocation" | "api_call"): Promise<{
+    allowed: boolean;
+    reason?: string;
+}>;
+/** Handle billing-related API routes */
+export declare function handleBillingRoutes(pathname: string, method: string, body: Record<string, unknown> | null, supabase: SupabaseClient, auth: {
+    userId?: string;
+    isServiceRole: boolean;
+}): Promise<{
+    status: number;
+    body: Record<string, unknown>;
+} | null>;

package/dist/server/handlers/billing.js

@@ -0,0 +1,272 @@
+const DEFAULT_PLANS = {
+    free: {
+        messages_per_month: 500,
+        agent_invocations_per_month: 100,
+        tokens_per_month: 500_000,
+        nodes_max: 1,
+        channels_per_node: 2,
+    },
+    starter: {
+        messages_per_month: 5_000,
+        agent_invocations_per_month: 1_000,
+        tokens_per_month: 5_000_000,
+        nodes_max: 3,
+        channels_per_node: 5,
+    },
+    pro: {
+        messages_per_month: 50_000,
+        agent_invocations_per_month: 10_000,
+        tokens_per_month: 50_000_000,
+        nodes_max: 5,
+        channels_per_node: 10,
+    },
+    enterprise: {
+        messages_per_month: -1, // unlimited
+        agent_invocations_per_month: -1,
+        tokens_per_month: -1,
+        nodes_max: 50,
+        channels_per_node: 50,
+    },
+};
+/** Get current billing period string (YYYY-MM) */
+function getCurrentPeriod() {
+    const now = new Date();
+    return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
+}
+/** Increment usage counters for a store */
+export async function incrementUsage(supabase, storeId, counters) {
+    const period = getCurrentPeriod();
+    // Upsert the usage row
+    const { data: existing } = await supabase
+        .from("store_usage")
+        .select("id, messages_in, messages_out, agent_invocations, tokens_used, api_calls")
+        .eq("store_id", storeId)
+        .eq("period", period)
+        .single();
+    if (existing) {
+        await supabase
+            .from("store_usage")
+            .update({
+            messages_in: (existing.messages_in || 0) + (counters.messages_in || 0),
+            messages_out: (existing.messages_out || 0) + (counters.messages_out || 0),
+            agent_invocations: (existing.agent_invocations || 0) + (counters.agent_invocations || 0),
+            tokens_used: (existing.tokens_used || 0) + (counters.tokens_used || 0),
+            api_calls: (existing.api_calls || 0) + (counters.api_calls || 0),
+            updated_at: new Date().toISOString(),
+        })
+            .eq("id", existing.id);
+    }
+    else {
+        await supabase.from("store_usage").insert({
+            store_id: storeId,
+            period,
+            messages_in: counters.messages_in || 0,
+            messages_out: counters.messages_out || 0,
+            agent_invocations: counters.agent_invocations || 0,
+            tokens_used: counters.tokens_used || 0,
+            api_calls: counters.api_calls || 0,
+        });
+    }
+}
+/** Check if a store is within its plan limits */
+export async function checkPlanLimits(supabase, storeId, action) {
+    const period = getCurrentPeriod();
+    // Get store plan
+    const { data: planRow } = await supabase
+        .from("store_plans")
+        .select("plan, limits")
+        .eq("store_id", storeId)
+        .single();
+    const planName = planRow?.plan || "free";
+    const limits = planRow?.limits || DEFAULT_PLANS[planName] || DEFAULT_PLANS.free;
+    // Get current usage
+    const { data: usage } = await supabase
+        .from("store_usage")
+        .select("messages_in, messages_out, agent_invocations, tokens_used, api_calls")
+        .eq("store_id", storeId)
+        .eq("period", period)
+        .single();
+    const currentUsage = usage || { messages_in: 0, messages_out: 0, agent_invocations: 0, tokens_used: 0, api_calls: 0 };
+    switch (action) {
+        case "message": {
+            const total = (currentUsage.messages_in || 0) + (currentUsage.messages_out || 0);
+            if (limits.messages_per_month > 0 && total >= limits.messages_per_month) {
+                return { allowed: false, reason: `Message limit reached (${total}/${limits.messages_per_month} this month)` };
+            }
+            break;
+        }
+        case "agent_invocation": {
+            if (limits.agent_invocations_per_month > 0 && (currentUsage.agent_invocations || 0) >= limits.agent_invocations_per_month) {
+                return { allowed: false, reason: `Agent invocation limit reached (${currentUsage.agent_invocations}/${limits.agent_invocations_per_month} this month)` };
+            }
+            break;
+        }
+        case "api_call": {
+            // API calls are generous — don't limit for now
+            break;
+        }
+    }
+    return { allowed: true };
+}
+/** Handle billing-related API routes */
+export async function handleBillingRoutes(pathname, method, body, supabase, auth) {
+    // GET /usage — current period usage for a store
+    if (pathname === "/usage" && (method === "GET" || method === "POST")) {
+        const storeId = body?.store_id;
+        if (!storeId) {
+            return { status: 400, body: { error: "store_id required" } };
+        }
+        const period = getCurrentPeriod();
+        const [usageResult, planResult] = await Promise.all([
+            supabase.from("store_usage")
+                .select("*")
+                .eq("store_id", storeId)
+                .eq("period", period)
+                .single(),
+            supabase.from("store_plans")
+                .select("plan, limits")
+                .eq("store_id", storeId)
+                .single(),
+        ]);
+        const usage = usageResult.data || {
+            messages_in: 0, messages_out: 0, agent_invocations: 0, tokens_used: 0, api_calls: 0,
+        };
+        const planName = planResult.data?.plan || "free";
+        const limits = planResult.data?.limits || DEFAULT_PLANS[planName] || DEFAULT_PLANS.free;
+        return {
+            status: 200,
+            body: {
+                success: true,
+                period,
+                plan: planName,
+                usage,
+                limits,
+            },
+        };
+    }
+    // GET /usage/history — usage history for a store
+    if (pathname === "/usage/history" && (method === "GET" || method === "POST")) {
+        const storeId = body?.store_id;
+        if (!storeId) {
+            return { status: 400, body: { error: "store_id required" } };
+        }
+        const { data: history, error } = await supabase
+            .from("store_usage")
+            .select("*")
+            .eq("store_id", storeId)
+            .order("period", { ascending: false })
+            .limit(12);
+        if (error) {
+            return { status: 500, body: { error: error.message } };
+        }
+        return { status: 200, body: { success: true, history: history || [] } };
+    }
+    // POST /billing/checkout — create a Stripe Checkout session for plan upgrade
+    if (pathname === "/billing/checkout" && method === "POST") {
+        const storeId = body?.store_id;
+        const planId = body?.plan_id;
+        if (!storeId || !planId) {
+            return { status: 400, body: { error: "store_id and plan_id required" } };
+        }
+        const stripeKey = process.env.STRIPE_SECRET_KEY;
+        if (!stripeKey) {
+            return { status: 500, body: { error: "Stripe not configured" } };
+        }
+        // Map plan IDs to Stripe price IDs (set in env)
+        const priceMap = {
+            starter: process.env.STRIPE_PRICE_STARTER || "",
+            pro: process.env.STRIPE_PRICE_PRO || "",
+            enterprise: process.env.STRIPE_PRICE_ENTERPRISE || "",
+        };
+        const priceId = priceMap[planId];
+        if (!priceId) {
+            return { status: 400, body: { error: `No Stripe price configured for plan: ${planId}` } };
+        }
+        // Check if store already has a Stripe customer
+        const { data: planRow } = await supabase
+            .from("store_plans")
+            .select("stripe_customer_id")
+            .eq("store_id", storeId)
+            .single();
+        const successUrl = body?.success_url || "https://whaletools.app/settings/billing?success=true";
+        const cancelUrl = body?.cancel_url || "https://whaletools.app/settings/billing?canceled=true";
+        const params = new URLSearchParams();
+        params.set("mode", "subscription");
+        params.set("line_items[0][price]", priceId);
+        params.set("line_items[0][quantity]", "1");
+        params.set("success_url", successUrl);
+        params.set("cancel_url", cancelUrl);
+        params.set("metadata[store_id]", storeId);
+        if (auth.userId)
+            params.set("metadata[user_id]", auth.userId);
+        if (planRow?.stripe_customer_id) {
+            params.set("customer", planRow.stripe_customer_id);
+        }
+        else if (auth.userId) {
+            // Look up user email for pre-fill
+            const { data: profile } = await supabase.from("profiles").select("email").eq("id", auth.userId).single();
+            if (profile?.email)
+                params.set("customer_email", profile.email);
+        }
+        try {
+            const res = await fetch("https://api.stripe.com/v1/checkout/sessions", {
+                method: "POST",
+                headers: {
+                    "Authorization": `Basic ${Buffer.from(stripeKey + ":").toString("base64")}`,
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: params.toString(),
+            });
+            const session = await res.json();
+            if (!res.ok) {
+                return { status: 500, body: { error: session.error?.message || "Stripe error" } };
+            }
+            return { status: 200, body: { success: true, url: session.url } };
+        }
+        catch (err) {
+            return { status: 500, body: { error: `Stripe checkout failed: ${err.message}` } };
+        }
+    }
+    // POST /billing/portal — create a Stripe Customer Portal session
+    if (pathname === "/billing/portal" && method === "POST") {
+        const storeId = body?.store_id;
+        if (!storeId) {
+            return { status: 400, body: { error: "store_id required" } };
+        }
+        const stripeKey = process.env.STRIPE_SECRET_KEY;
+        if (!stripeKey) {
+            return { status: 500, body: { error: "Stripe not configured" } };
+        }
+        const { data: planRow } = await supabase
+            .from("store_plans")
+            .select("stripe_customer_id")
+            .eq("store_id", storeId)
+            .single();
+        if (!planRow?.stripe_customer_id) {
+            return { status: 400, body: { error: "No Stripe customer found. Subscribe to a plan first." } };
+        }
+        const returnUrl = body?.return_url || "https://whaletools.app/settings/billing";
+        const params = new URLSearchParams();
+        params.set("customer", planRow.stripe_customer_id);
+        params.set("return_url", returnUrl);
+        try {
+            const res = await fetch("https://api.stripe.com/v1/billing_portal/sessions", {
+                method: "POST",
+                headers: {
+                    "Authorization": `Basic ${Buffer.from(stripeKey + ":").toString("base64")}`,
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: params.toString(),
+            });
+            const session = await res.json();
+            if (!res.ok) {
+                return { status: 500, body: { error: session.error?.message || "Stripe error" } };
+            }
+            return { status: 200, body: { success: true, url: session.url } };
+        }
+        catch (err) {
+            return { status: 500, body: { error: `Portal session failed: ${err.message}` } };
+        }
+    }
+    return null;
+}

package/dist/server/handlers/browser.d.ts

@@ -0,0 +1,10 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export declare function generatePdfFromHtml(html: string, options?: {
+    format?: string;
+    landscape?: boolean;
+}): Promise<Buffer>;
+export declare function handleBrowser(_sb: SupabaseClient, args: Record<string, unknown>, _storeId?: string): Promise<{
+    success: boolean;
+    data?: unknown;
+    error?: string;
+}>;