feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy
Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.
Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
+ replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
/forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
forgot/reset pages, route-guard middleware.
Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.
Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.
Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
+ unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
confirmation, reminder. Per-page templates avoid html/template's
contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.
Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
atomic per-batch with dedup on existing emails.
Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
country code from full E.164 strings.
Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
Stripe customer/sub ids). Partial unique index keeps one granting sub
per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
/webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
{error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
usage bars, tier cards), global UpgradeModal triggered by useApi's
402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.
Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
presence, no orphans across 10 FK relationships, email uniqueness,
single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
targets, drill instructions, rollback path.
Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
legal review) copy; footer links; signup terms checkbox; TermsGateModal
for accounts created before the rollout; export + delete buttons on
/dashboard/billing.
Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
internal/notification, internal/ratelimit, internal/domain.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Kwaku Danso
+29
-11
@@ -1,13 +1,13 @@
|
||||
<script setup lang="ts">
|
||||
const { host, clear } = useHost()
|
||||
const auth = useAuth()
|
||||
const route = useRoute()
|
||||
|
||||
// GitHub icon is a "marketing" affordance — only show it on the public landing
|
||||
// page. Inside the app it just clutters the chrome.
|
||||
const showGithub = computed(() => route.path === '/')
|
||||
|
||||
function logout() {
|
||||
clear()
|
||||
async function signOut() {
|
||||
await auth.logout()
|
||||
navigateTo('/')
|
||||
}
|
||||
</script>
|
||||
@@ -34,12 +34,17 @@ function logout() {
|
||||
<path d="M12 0C5.374 0 0 5.373 0 12c0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23A11.509 11.509 0 0112 5.803c1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576C20.566 21.797 24 17.3 24 12c0-6.627-5.373-12-12-12z"/>
|
||||
</svg>
|
||||
</a>
|
||||
<template v-if="host">
|
||||
<button class="transition hover:text-zinc-100" @click="logout">Sign out</button>
|
||||
</template>
|
||||
<template v-else>
|
||||
<NuxtLink to="/dashboard" class="transition hover:text-zinc-100">Sign in</NuxtLink>
|
||||
</template>
|
||||
<ClientOnly>
|
||||
<template v-if="auth.isAuthenticated.value">
|
||||
<NuxtLink to="/dashboard" class="transition hover:text-zinc-100">Dashboard</NuxtLink>
|
||||
<NuxtLink to="/dashboard/billing" class="transition hover:text-zinc-100">Billing</NuxtLink>
|
||||
<button class="transition hover:text-zinc-100" @click="signOut">Sign out</button>
|
||||
</template>
|
||||
<template v-else>
|
||||
<NuxtLink to="/login" class="transition hover:text-zinc-100">Sign in</NuxtLink>
|
||||
<NuxtLink to="/signup" class="btn-primary !px-3 !py-1.5 text-xs">Get started</NuxtLink>
|
||||
</template>
|
||||
</ClientOnly>
|
||||
</nav>
|
||||
</div>
|
||||
</header>
|
||||
@@ -48,9 +53,22 @@ function logout() {
|
||||
<NuxtPage />
|
||||
</main>
|
||||
|
||||
<!-- Global "plan limit reached" prompt — surfaces whenever any API
|
||||
call returns 402. Lives at app-root so every page benefits
|
||||
without per-page wiring. -->
|
||||
<UpgradeModal />
|
||||
|
||||
<!-- Privacy / terms onboarding gate. Auto-shows when the signed-in
|
||||
user hasn't accepted the current policies yet. No-op otherwise. -->
|
||||
<TermsGateModal />
|
||||
|
||||
<footer class="mt-16 border-t border-zinc-900">
|
||||
<div class="mx-auto max-w-6xl px-6 py-6 text-xs text-zinc-500">
|
||||
© 2025 GuestGuard — Hassle-free RSVPs for every occasion.
|
||||
<div class="mx-auto flex max-w-6xl flex-wrap items-center justify-between gap-3 px-6 py-6 text-xs text-zinc-500">
|
||||
<span>© 2025 GuestGuard — Hassle-free RSVPs for every occasion.</span>
|
||||
<span class="flex items-center gap-4">
|
||||
<NuxtLink to="/privacy" class="hover:text-zinc-300">Privacy</NuxtLink>
|
||||
<NuxtLink to="/terms" class="hover:text-zinc-300">Terms</NuxtLink>
|
||||
</span>
|
||||
</div>
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
@@ -0,0 +1,217 @@
|
||||
<script setup lang="ts">
|
||||
interface ParsedRow {
|
||||
Name: string
|
||||
Email: string
|
||||
Phone: string
|
||||
PlusOnes: number
|
||||
}
|
||||
interface RowError {
|
||||
row: number
|
||||
reason: string
|
||||
}
|
||||
interface PreviewResponse {
|
||||
rows: ParsedRow[]
|
||||
errors?: RowError[]
|
||||
total_count: number
|
||||
}
|
||||
interface ImportResponse {
|
||||
added: number
|
||||
skipped: number
|
||||
skipped_emails?: string[]
|
||||
errors?: RowError[]
|
||||
total_count: number
|
||||
}
|
||||
|
||||
const props = defineProps<{ eventId: string }>()
|
||||
const emit = defineEmits<{ (e: 'imported'): void }>()
|
||||
|
||||
const config = useRuntimeConfig()
|
||||
const apiBase = config.public.apiBase as string
|
||||
|
||||
type Stage = 'idle' | 'preview' | 'committing' | 'done'
|
||||
const stage = ref<Stage>('idle')
|
||||
const fileName = ref('')
|
||||
const dragging = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
const preview = ref<PreviewResponse | null>(null)
|
||||
const result = ref<ImportResponse | null>(null)
|
||||
let pendingFile: File | null = null
|
||||
|
||||
function reset() {
|
||||
stage.value = 'idle'
|
||||
fileName.value = ''
|
||||
preview.value = null
|
||||
result.value = null
|
||||
error.value = null
|
||||
pendingFile = null
|
||||
}
|
||||
|
||||
async function onFiles(files: FileList | File[] | null) {
|
||||
if (!files || !files.length) return
|
||||
const f = files[0]
|
||||
if (f.size > 1024 * 1024) {
|
||||
error.value = 'File is larger than 1MB.'
|
||||
return
|
||||
}
|
||||
fileName.value = f.name
|
||||
error.value = null
|
||||
pendingFile = f
|
||||
await runPreview()
|
||||
}
|
||||
|
||||
async function runPreview() {
|
||||
if (!pendingFile) return
|
||||
try {
|
||||
const fd = new FormData()
|
||||
fd.append('file', pendingFile)
|
||||
preview.value = await useApi<PreviewResponse>(
|
||||
`/events/${props.eventId}/guests/import/preview`,
|
||||
{ method: 'POST', body: fd },
|
||||
)
|
||||
stage.value = 'preview'
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Could not parse that CSV')
|
||||
stage.value = 'idle'
|
||||
pendingFile = null
|
||||
}
|
||||
}
|
||||
|
||||
async function commit() {
|
||||
if (!pendingFile) return
|
||||
stage.value = 'committing'
|
||||
error.value = null
|
||||
try {
|
||||
const fd = new FormData()
|
||||
fd.append('file', pendingFile)
|
||||
result.value = await useApi<ImportResponse>(
|
||||
`/events/${props.eventId}/guests/import`,
|
||||
{ method: 'POST', body: fd },
|
||||
)
|
||||
stage.value = 'done'
|
||||
emit('imported')
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Import failed')
|
||||
stage.value = 'preview'
|
||||
}
|
||||
}
|
||||
|
||||
function onDrop(e: DragEvent) {
|
||||
dragging.value = false
|
||||
onFiles(e.dataTransfer?.files ?? null)
|
||||
}
|
||||
|
||||
const templateUrl = computed(() => `${apiBase}/events/${props.eventId}/guests/import/template`)
|
||||
|
||||
async function downloadTemplate() {
|
||||
// The endpoint requires a Bearer header, which a plain <a download> can't
|
||||
// attach — fetch through useApi (which adds auth + handles refresh) then
|
||||
// synthesise an anchor click on the resulting blob.
|
||||
try {
|
||||
const res: any = await useApi(`/events/${props.eventId}/guests/import/template`, {
|
||||
method: 'GET',
|
||||
})
|
||||
// useApi auto-parses JSON; for CSV the response body is plain text.
|
||||
const text = typeof res === 'string' ? res : JSON.stringify(res)
|
||||
const blob = new Blob([text], { type: 'text/csv;charset=utf-8' })
|
||||
const url = URL.createObjectURL(blob)
|
||||
const a = document.createElement('a')
|
||||
a.href = url
|
||||
a.download = 'guestguard-import-template.csv'
|
||||
a.click()
|
||||
URL.revokeObjectURL(url)
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Could not download template')
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<!-- No outer .card chrome: this component is now embedded inside a
|
||||
modal that supplies the surface. -->
|
||||
<div>
|
||||
<div class="mb-3 flex items-center justify-end">
|
||||
<button class="text-xs text-zinc-400 hover:text-zinc-200" @click="downloadTemplate">
|
||||
Download template
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<!-- Stage 1: drag-drop zone -->
|
||||
<div v-if="stage === 'idle'">
|
||||
<label
|
||||
class="flex cursor-pointer flex-col items-center justify-center rounded-lg border-2 border-dashed bg-zinc-900/50 p-6 text-center transition"
|
||||
:class="dragging ? 'border-brand-500 bg-brand-500/5' : 'border-zinc-700 hover:border-zinc-600'"
|
||||
@dragover.prevent="dragging = true"
|
||||
@dragleave.prevent="dragging = false"
|
||||
@drop.prevent="onDrop"
|
||||
>
|
||||
<span class="mb-1 text-sm text-zinc-200">Drop a CSV here or click to choose</span>
|
||||
<span class="text-xs text-zinc-500">Up to 5,000 rows · 1MB max</span>
|
||||
<input type="file" accept=".csv,text/csv" class="hidden" @change="onFiles(($event.target as HTMLInputElement).files)" />
|
||||
</label>
|
||||
<p class="mt-2 text-xs text-zinc-500">
|
||||
Required column: <code>name</code>. Optional: <code>email</code>, <code>phone</code>, <code>plus_ones</code>.
|
||||
</p>
|
||||
<p v-if="error" class="mt-3 text-sm text-red-400">{{ error }}</p>
|
||||
</div>
|
||||
|
||||
<!-- Stage 2: preview -->
|
||||
<div v-else-if="stage === 'preview' && preview">
|
||||
<p class="mb-2 text-sm">
|
||||
<span class="text-zinc-200">{{ fileName }}</span>
|
||||
<span class="text-zinc-500"> — {{ preview.rows.length }} valid row{{ preview.rows.length === 1 ? '' : 's' }}, {{ preview.errors?.length || 0 }} error{{ preview.errors?.length === 1 ? '' : 's' }}.</span>
|
||||
</p>
|
||||
|
||||
<div v-if="preview.errors && preview.errors.length" class="mb-3 max-h-32 overflow-auto rounded border border-amber-900/40 bg-amber-950/20 p-2 text-xs text-amber-200">
|
||||
<p class="mb-1 font-medium">Rows with problems (these will be skipped):</p>
|
||||
<ul class="space-y-0.5">
|
||||
<li v-for="(err, i) in preview.errors" :key="i">
|
||||
row {{ err.row }} — {{ err.reason }}
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div v-if="preview.rows.length" class="mb-3 max-h-64 overflow-auto rounded border border-zinc-800">
|
||||
<table class="w-full text-xs">
|
||||
<thead class="bg-zinc-900 text-zinc-400">
|
||||
<tr>
|
||||
<th class="px-2 py-1.5 text-left">Name</th>
|
||||
<th class="px-2 py-1.5 text-left">Email</th>
|
||||
<th class="px-2 py-1.5 text-left">Phone</th>
|
||||
<th class="px-2 py-1.5 text-right">+1s</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="divide-y divide-zinc-800">
|
||||
<tr v-for="(r, i) in preview.rows.slice(0, 100)" :key="i" class="text-zinc-200">
|
||||
<td class="px-2 py-1">{{ r.Name }}</td>
|
||||
<td class="px-2 py-1 text-zinc-400">{{ r.Email || '—' }}</td>
|
||||
<td class="px-2 py-1 text-zinc-400">{{ r.Phone || '—' }}</td>
|
||||
<td class="px-2 py-1 text-right tabular-nums">{{ r.PlusOnes }}</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p v-if="preview.rows.length > 100" class="px-2 py-1 text-xs text-zinc-500">
|
||||
+ {{ preview.rows.length - 100 }} more not shown.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="flex items-center gap-2">
|
||||
<button class="btn-primary" :disabled="!preview.rows.length || stage === 'committing'" @click="commit">
|
||||
Looks good — import {{ preview.rows.length }} guest{{ preview.rows.length === 1 ? '' : 's' }}
|
||||
</button>
|
||||
<button class="btn-ghost" @click="reset">Cancel</button>
|
||||
</div>
|
||||
<p v-if="error" class="mt-3 text-sm text-red-400">{{ error }}</p>
|
||||
</div>
|
||||
|
||||
<!-- Stage 3: committing -->
|
||||
<div v-else-if="stage === 'committing'" class="text-sm text-zinc-400">Importing…</div>
|
||||
|
||||
<!-- Stage 4: done -->
|
||||
<div v-else-if="stage === 'done' && result" class="text-sm">
|
||||
<p class="mb-1 font-medium text-brand-300">Imported {{ result.added }} guest{{ result.added === 1 ? '' : 's' }}.</p>
|
||||
<p v-if="result.skipped" class="text-zinc-400">Skipped {{ result.skipped }} duplicate{{ result.skipped === 1 ? '' : 's' }} (already on this event).</p>
|
||||
<p v-if="result.errors?.length" class="text-zinc-400">{{ result.errors.length }} row{{ result.errors.length === 1 ? '' : 's' }} had errors and were not imported.</p>
|
||||
<button class="btn-ghost mt-3" @click="reset">Import another file</button>
|
||||
</div>
|
||||
</div>
|
||||
</template>
|
||||
@@ -0,0 +1,240 @@
|
||||
<script setup lang="ts">
|
||||
// PhoneInput — country code picker + national digits input.
|
||||
//
|
||||
// Emits an E.164 string via v-model (e.g. "+233244123456"). Empty input
|
||||
// emits an empty string. The country list covers the ~50 most likely
|
||||
// origins for event guests; uncommon ones can still be typed by picking
|
||||
// the closest country and entering the full number — the live preview
|
||||
// shows the host what's being saved.
|
||||
//
|
||||
// Industry-standard UX: WhatsApp / Stripe / airline-booking pattern.
|
||||
|
||||
interface Country {
|
||||
code: string // ISO-3166 alpha-2
|
||||
name: string
|
||||
dialCode: string // includes leading "+"
|
||||
}
|
||||
|
||||
// Curated list — alphabetical-by-name, weighted toward common GuestGuard
|
||||
// audience (UK/EU + Africa + diaspora destinations). The host can always
|
||||
// type the full international number into another country's row if their
|
||||
// country isn't here, but most won't need to.
|
||||
const COUNTRIES: Country[] = [
|
||||
{ code: 'AR', name: 'Argentina', dialCode: '+54' },
|
||||
{ code: 'AU', name: 'Australia', dialCode: '+61' },
|
||||
{ code: 'AT', name: 'Austria', dialCode: '+43' },
|
||||
{ code: 'BE', name: 'Belgium', dialCode: '+32' },
|
||||
{ code: 'BR', name: 'Brazil', dialCode: '+55' },
|
||||
{ code: 'CM', name: 'Cameroon', dialCode: '+237' },
|
||||
{ code: 'CA', name: 'Canada', dialCode: '+1' },
|
||||
{ code: 'CL', name: 'Chile', dialCode: '+56' },
|
||||
{ code: 'CN', name: 'China', dialCode: '+86' },
|
||||
{ code: 'CI', name: "Côte d'Ivoire", dialCode: '+225' },
|
||||
{ code: 'DK', name: 'Denmark', dialCode: '+45' },
|
||||
{ code: 'EG', name: 'Egypt', dialCode: '+20' },
|
||||
{ code: 'ET', name: 'Ethiopia', dialCode: '+251' },
|
||||
{ code: 'FI', name: 'Finland', dialCode: '+358' },
|
||||
{ code: 'FR', name: 'France', dialCode: '+33' },
|
||||
{ code: 'DE', name: 'Germany', dialCode: '+49' },
|
||||
{ code: 'GH', name: 'Ghana', dialCode: '+233' },
|
||||
{ code: 'HK', name: 'Hong Kong', dialCode: '+852' },
|
||||
{ code: 'IN', name: 'India', dialCode: '+91' },
|
||||
{ code: 'ID', name: 'Indonesia', dialCode: '+62' },
|
||||
{ code: 'IE', name: 'Ireland', dialCode: '+353' },
|
||||
{ code: 'IL', name: 'Israel', dialCode: '+972' },
|
||||
{ code: 'IT', name: 'Italy', dialCode: '+39' },
|
||||
{ code: 'JP', name: 'Japan', dialCode: '+81' },
|
||||
{ code: 'KE', name: 'Kenya', dialCode: '+254' },
|
||||
{ code: 'MY', name: 'Malaysia', dialCode: '+60' },
|
||||
{ code: 'MX', name: 'Mexico', dialCode: '+52' },
|
||||
{ code: 'MA', name: 'Morocco', dialCode: '+212' },
|
||||
{ code: 'NL', name: 'Netherlands', dialCode: '+31' },
|
||||
{ code: 'NZ', name: 'New Zealand', dialCode: '+64' },
|
||||
{ code: 'NG', name: 'Nigeria', dialCode: '+234' },
|
||||
{ code: 'NO', name: 'Norway', dialCode: '+47' },
|
||||
{ code: 'PH', name: 'Philippines', dialCode: '+63' },
|
||||
{ code: 'PL', name: 'Poland', dialCode: '+48' },
|
||||
{ code: 'PT', name: 'Portugal', dialCode: '+351' },
|
||||
{ code: 'RW', name: 'Rwanda', dialCode: '+250' },
|
||||
{ code: 'SA', name: 'Saudi Arabia', dialCode: '+966' },
|
||||
{ code: 'SN', name: 'Senegal', dialCode: '+221' },
|
||||
{ code: 'SG', name: 'Singapore', dialCode: '+65' },
|
||||
{ code: 'ZA', name: 'South Africa', dialCode: '+27' },
|
||||
{ code: 'KR', name: 'South Korea', dialCode: '+82' },
|
||||
{ code: 'ES', name: 'Spain', dialCode: '+34' },
|
||||
{ code: 'SE', name: 'Sweden', dialCode: '+46' },
|
||||
{ code: 'CH', name: 'Switzerland', dialCode: '+41' },
|
||||
{ code: 'TW', name: 'Taiwan', dialCode: '+886' },
|
||||
{ code: 'TZ', name: 'Tanzania', dialCode: '+255' },
|
||||
{ code: 'TH', name: 'Thailand', dialCode: '+66' },
|
||||
{ code: 'TR', name: 'Turkey', dialCode: '+90' },
|
||||
{ code: 'AE', name: 'UAE', dialCode: '+971' },
|
||||
{ code: 'UG', name: 'Uganda', dialCode: '+256' },
|
||||
{ code: 'GB', name: 'United Kingdom', dialCode: '+44' },
|
||||
{ code: 'US', name: 'United States', dialCode: '+1' },
|
||||
]
|
||||
|
||||
// Longer dial codes first so "+1" doesn't shadow "+1...". Sorted once.
|
||||
const SORTED_BY_DIAL = [...COUNTRIES].sort((a, b) => b.dialCode.length - a.dialCode.length)
|
||||
|
||||
const props = defineProps<{
|
||||
modelValue: string
|
||||
/** ISO-3166 alpha-2 to use as default. Browser locale is consulted if omitted. */
|
||||
defaultCountry?: string
|
||||
}>()
|
||||
const emit = defineEmits<{ (e: 'update:modelValue', value: string): void }>()
|
||||
|
||||
function findByCode(code: string): Country | undefined {
|
||||
return COUNTRIES.find((c) => c.code === code.toUpperCase())
|
||||
}
|
||||
|
||||
function parsePhone(v: string): { country: Country | null; national: string } {
|
||||
if (!v) return { country: null, national: '' }
|
||||
const trimmed = v.trim().replace(/[\s\-()]/g, '')
|
||||
for (const c of SORTED_BY_DIAL) {
|
||||
if (trimmed.startsWith(c.dialCode)) {
|
||||
return { country: c, national: trimmed.slice(c.dialCode.length) }
|
||||
}
|
||||
}
|
||||
// Fall through: leading +XX didn't match anything (or no leading +).
|
||||
// Strip a leading + and a leading 0 from local-format numbers so the
|
||||
// host's national digits show up cleanly in the input.
|
||||
return { country: null, national: trimmed.replace(/^\+/, '').replace(/^0+/, '') }
|
||||
}
|
||||
|
||||
function detectDefault(): Country {
|
||||
if (props.defaultCountry) {
|
||||
const c = findByCode(props.defaultCountry)
|
||||
if (c) return c
|
||||
}
|
||||
if (typeof navigator !== 'undefined' && navigator.language) {
|
||||
const region = navigator.language.split('-')[1] || ''
|
||||
const c = findByCode(region)
|
||||
if (c) return c
|
||||
}
|
||||
return findByCode('GB')!
|
||||
}
|
||||
|
||||
const initial = parsePhone(props.modelValue)
|
||||
const country = ref<Country>(initial.country || detectDefault())
|
||||
const national = ref(initial.national)
|
||||
|
||||
// Digits the host typed, with leading 0s stripped (local-format helper).
|
||||
const nationalDigits = computed(() => national.value.replace(/\D/g, '').replace(/^0+/, ''))
|
||||
|
||||
// E.164 composed from current state. Empty when no digits — keeps the
|
||||
// stored value clean (don't save "+44" with no number).
|
||||
const composed = computed(() => {
|
||||
return nationalDigits.value ? `${country.value.dialCode}${nationalDigits.value}` : ''
|
||||
})
|
||||
|
||||
// Inline validation. We don't try to encode per-country length rules
|
||||
// (that's libphonenumber's job and overkill here) — instead we apply a
|
||||
// generous floor/ceiling on the national digit count. Catches obvious
|
||||
// typos without false-positives on shorter formats like Iceland (+354 7).
|
||||
type Validation = 'empty' | 'short' | 'long' | 'ok'
|
||||
const validation = computed<Validation>(() => {
|
||||
const n = nationalDigits.value.length
|
||||
if (n === 0) return 'empty'
|
||||
if (n < 6) return 'short'
|
||||
if (n > 13) return 'long'
|
||||
return 'ok'
|
||||
})
|
||||
|
||||
// Emit on user changes — guard reentrancy so an external prop update
|
||||
// doesn't bounce back into our own watcher.
|
||||
let emitting = false
|
||||
watch(composed, (v) => {
|
||||
emitting = true
|
||||
emit('update:modelValue', v)
|
||||
Promise.resolve().then(() => { emitting = false })
|
||||
})
|
||||
|
||||
// Re-sync from prop changes (e.g., parent resets the form, edit modal
|
||||
// reopens for a different guest). Skip when our own emit caused it.
|
||||
watch(() => props.modelValue, (v) => {
|
||||
if (emitting) return
|
||||
const p = parsePhone(v)
|
||||
if (p.country) country.value = p.country
|
||||
national.value = p.national
|
||||
})
|
||||
|
||||
// Smart input: if the host pastes (or types) a full E.164 with leading
|
||||
// "+" into the national field, extract the country code and split it
|
||||
// into the picker + the national digits. Rescues the common mistake of
|
||||
// pasting "+233244123456" into the digits field instead of using the
|
||||
// picker — without this, the value would get double-prefixed.
|
||||
function onNationalInput(e: Event) {
|
||||
const v = (e.target as HTMLInputElement).value
|
||||
if (v.startsWith('+')) {
|
||||
const parsed = parsePhone(v)
|
||||
if (parsed.country) {
|
||||
country.value = parsed.country
|
||||
national.value = parsed.national
|
||||
return
|
||||
}
|
||||
}
|
||||
national.value = v
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<div>
|
||||
<div class="flex gap-2">
|
||||
<select
|
||||
v-model="country"
|
||||
class="input w-28 shrink-0 cursor-pointer"
|
||||
aria-label="Country code"
|
||||
>
|
||||
<option v-for="c in COUNTRIES" :key="c.code" :value="c">
|
||||
{{ c.dialCode }} {{ c.code }}
|
||||
</option>
|
||||
</select>
|
||||
<input
|
||||
:value="national"
|
||||
@input="onNationalInput"
|
||||
type="tel"
|
||||
inputmode="tel"
|
||||
autocomplete="tel-national"
|
||||
class="input flex-1"
|
||||
:class="{
|
||||
'border-amber-700/60 focus:border-amber-500 focus:ring-amber-500': validation === 'short' || validation === 'long',
|
||||
}"
|
||||
placeholder="Phone number"
|
||||
:aria-invalid="validation === 'short' || validation === 'long' || undefined"
|
||||
/>
|
||||
</div>
|
||||
<!-- Live feedback. Different message per validation state:
|
||||
empty → optional hint
|
||||
short → amber warning, hostsees it before pressing Save
|
||||
long → amber warning
|
||||
ok → green confirmation with the canonical E.164 visible -->
|
||||
<p class="mt-1 flex items-center gap-1 text-xs">
|
||||
<template v-if="validation === 'empty'">
|
||||
<span class="text-zinc-500">
|
||||
Optional — include the country code so guests on any network can be reached.
|
||||
</span>
|
||||
</template>
|
||||
<template v-else-if="validation === 'short'">
|
||||
<svg class="h-3.5 w-3.5 shrink-0 text-amber-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
|
||||
<path fill-rule="evenodd" d="M8.485 3.495c.673-1.167 2.357-1.167 3.03 0l6.28 10.875c.673 1.167-.17 2.625-1.516 2.625H3.72c-1.347 0-2.189-1.458-1.515-2.625L8.485 3.495zM10 8a1 1 0 01.993.883L11 9v3a1 1 0 01-1.993.117L9 12V9a1 1 0 011-1zm0 6a1 1 0 110 2 1 1 0 010-2z" clip-rule="evenodd" />
|
||||
</svg>
|
||||
<span class="text-amber-300">Looks too short — make sure you've entered all the digits.</span>
|
||||
</template>
|
||||
<template v-else-if="validation === 'long'">
|
||||
<svg class="h-3.5 w-3.5 shrink-0 text-amber-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
|
||||
<path fill-rule="evenodd" d="M8.485 3.495c.673-1.167 2.357-1.167 3.03 0l6.28 10.875c.673 1.167-.17 2.625-1.516 2.625H3.72c-1.347 0-2.189-1.458-1.515-2.625L8.485 3.495zM10 8a1 1 0 01.993.883L11 9v3a1 1 0 01-1.993.117L9 12V9a1 1 0 011-1zm0 6a1 1 0 110 2 1 1 0 010-2z" clip-rule="evenodd" />
|
||||
</svg>
|
||||
<span class="text-amber-300">Looks too long — check for extra digits.</span>
|
||||
</template>
|
||||
<template v-else>
|
||||
<svg class="h-3.5 w-3.5 shrink-0 text-brand-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
|
||||
<path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd" />
|
||||
</svg>
|
||||
<span class="text-zinc-500">
|
||||
Saved as <span class="font-mono text-zinc-300">{{ composed }}</span>
|
||||
</span>
|
||||
</template>
|
||||
</p>
|
||||
</div>
|
||||
</template>
|
||||
@@ -0,0 +1,80 @@
|
||||
<script setup lang="ts">
|
||||
// Shown the first time a host signs into the dashboard after T&C
|
||||
// enforcement is rolled out. Existing accounts created before this
|
||||
// feature don't have terms_accepted_at set — they're re-prompted once
|
||||
// here, then they're set going forward.
|
||||
//
|
||||
// Lives in app.vue so any authed page can be the host's first stop.
|
||||
|
||||
const auth = useAuth()
|
||||
const accepted = ref(false)
|
||||
const submitting = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
|
||||
// Only fires when the user is signed in AND we know they haven't
|
||||
// accepted. /me payload includes terms_accepted_at; if absent → prompt.
|
||||
const needsAcceptance = computed(() => {
|
||||
const u = auth.user.value
|
||||
return !!u && !u.terms_accepted_at && !u.privacy_policy_accepted_at
|
||||
})
|
||||
|
||||
async function accept() {
|
||||
if (!accepted.value) return
|
||||
submitting.value = true
|
||||
error.value = null
|
||||
try {
|
||||
await useApi('/me/accept-terms', { method: 'POST' })
|
||||
// Refresh auth state so the user object reflects the new fields.
|
||||
await auth.refresh()
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Could not record acceptance')
|
||||
} finally {
|
||||
submitting.value = false
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<Teleport to="body">
|
||||
<div
|
||||
v-if="needsAcceptance"
|
||||
class="fixed inset-0 z-50 flex items-center justify-center bg-black/70 p-4 backdrop-blur-sm"
|
||||
>
|
||||
<div
|
||||
role="dialog"
|
||||
aria-modal="true"
|
||||
aria-labelledby="terms-title"
|
||||
class="w-full max-w-md rounded-lg border border-zinc-800 bg-zinc-900 p-5 shadow-2xl"
|
||||
>
|
||||
<h3 id="terms-title" class="mb-1 text-base font-semibold">One quick thing</h3>
|
||||
<p class="mb-4 text-sm text-zinc-400">
|
||||
We've updated how GuestGuard handles your data. Before you carry on,
|
||||
please confirm you've read and agree to the current policies.
|
||||
</p>
|
||||
|
||||
<label class="flex cursor-pointer items-start gap-2 text-sm text-zinc-200">
|
||||
<input
|
||||
v-model="accepted"
|
||||
type="checkbox"
|
||||
class="mt-0.5 h-4 w-4 cursor-pointer accent-brand-500"
|
||||
/>
|
||||
<span>
|
||||
I agree to GuestGuard's
|
||||
<NuxtLink to="/terms" target="_blank" class="text-brand-400 hover:text-brand-300">Terms of Service</NuxtLink>
|
||||
and
|
||||
<NuxtLink to="/privacy" target="_blank" class="text-brand-400 hover:text-brand-300">Privacy Policy</NuxtLink>.
|
||||
</span>
|
||||
</label>
|
||||
|
||||
<button
|
||||
class="btn-primary mt-4 w-full disabled:opacity-50"
|
||||
:disabled="!accepted || submitting"
|
||||
@click="accept"
|
||||
>
|
||||
{{ submitting ? 'Saving…' : 'Continue' }}
|
||||
</button>
|
||||
<p v-if="error" class="mt-3 text-sm text-red-400">{{ error }}</p>
|
||||
</div>
|
||||
</div>
|
||||
</Teleport>
|
||||
</template>
|
||||
@@ -0,0 +1,131 @@
|
||||
<script setup lang="ts">
|
||||
// Global "plan limit reached" modal. Bound to the upgrade-prompt state
|
||||
// in useBilling, which is populated by the 402 interceptor in useApi.
|
||||
// Lives in app.vue so any page that fires an API call benefits from it
|
||||
// without per-page wiring.
|
||||
|
||||
const billing = useBilling()
|
||||
const router = useRouter()
|
||||
const upgrading = ref<'pro' | 'business' | null>(null)
|
||||
|
||||
const reasonText = computed(() => {
|
||||
const p = billing.prompt.value
|
||||
if (!p) return ''
|
||||
if (p.reason === 'events_per_month') {
|
||||
return `You've used ${p.used} of ${p.limit} events this month on the ${labelTier(p.tier)} plan.`
|
||||
}
|
||||
if (p.reason === 'guests_per_event') {
|
||||
return `This event already has ${p.used} of ${p.limit} guests allowed on the ${labelTier(p.tier)} plan.`
|
||||
}
|
||||
return p.error
|
||||
})
|
||||
|
||||
function labelTier(t: string): string {
|
||||
return t.charAt(0).toUpperCase() + t.slice(1)
|
||||
}
|
||||
|
||||
async function quickUpgrade(tier: 'pro' | 'business') {
|
||||
upgrading.value = tier
|
||||
try {
|
||||
await billing.startCheckout(tier)
|
||||
// startCheckout navigates the page — nothing else to do.
|
||||
} catch {
|
||||
// Fallback: send the user to the billing page so they see the error
|
||||
// in context.
|
||||
await router.push('/dashboard/billing')
|
||||
billing.dismissUpgradePrompt()
|
||||
} finally {
|
||||
upgrading.value = null
|
||||
}
|
||||
}
|
||||
|
||||
function viewPlans() {
|
||||
billing.dismissUpgradePrompt()
|
||||
router.push('/dashboard/billing')
|
||||
}
|
||||
|
||||
// Esc closes the modal — keeps interaction symmetrical with all the
|
||||
// other dialogs across the app.
|
||||
function onKeydown(e: KeyboardEvent) {
|
||||
if (e.key === 'Escape' && billing.prompt.value) {
|
||||
billing.dismissUpgradePrompt()
|
||||
}
|
||||
}
|
||||
if (import.meta.client) {
|
||||
onMounted(() => window.addEventListener('keydown', onKeydown))
|
||||
onUnmounted(() => window.removeEventListener('keydown', onKeydown))
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<Teleport to="body">
|
||||
<div
|
||||
v-if="billing.prompt.value"
|
||||
class="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm"
|
||||
@click.self="billing.dismissUpgradePrompt()"
|
||||
>
|
||||
<div
|
||||
role="alertdialog"
|
||||
aria-modal="true"
|
||||
aria-labelledby="upgrade-title"
|
||||
aria-describedby="upgrade-desc"
|
||||
class="w-full max-w-md rounded-lg border border-zinc-800 bg-zinc-900 p-5 shadow-2xl"
|
||||
>
|
||||
<div class="mb-3 flex items-start gap-3">
|
||||
<div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-brand-500/15">
|
||||
<svg class="h-4 w-4 text-brand-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
|
||||
<path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd" />
|
||||
</svg>
|
||||
</div>
|
||||
<div class="min-w-0">
|
||||
<h3 id="upgrade-title" class="text-base font-semibold text-zinc-100">Plan limit reached</h3>
|
||||
<p id="upgrade-desc" class="mt-1 text-sm text-zinc-400">{{ reasonText }}</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p class="mb-4 text-sm text-zinc-300">Pick a plan to keep going — your work isn't lost.</p>
|
||||
|
||||
<div class="space-y-2">
|
||||
<button
|
||||
type="button"
|
||||
class="flex w-full items-center justify-between rounded-md border border-brand-700/60 bg-brand-500/10 px-3 py-3 text-left transition hover:bg-brand-500/15 disabled:opacity-50"
|
||||
:disabled="upgrading !== null"
|
||||
@click="quickUpgrade('pro')"
|
||||
>
|
||||
<span>
|
||||
<span class="block text-sm font-medium text-zinc-100">Upgrade to Pro</span>
|
||||
<span class="block text-xs text-zinc-500">$49 / month · 10 events · 1,000 guests per event</span>
|
||||
</span>
|
||||
<span class="text-xs text-zinc-400">{{ upgrading === 'pro' ? 'Opening checkout…' : '→' }}</span>
|
||||
</button>
|
||||
|
||||
<button
|
||||
type="button"
|
||||
class="flex w-full items-center justify-between rounded-md border border-zinc-700 bg-zinc-950 px-3 py-3 text-left transition hover:border-zinc-500 hover:bg-zinc-900 disabled:opacity-50"
|
||||
:disabled="upgrading !== null"
|
||||
@click="quickUpgrade('business')"
|
||||
>
|
||||
<span>
|
||||
<span class="block text-sm font-medium text-zinc-100">Upgrade to Business</span>
|
||||
<span class="block text-xs text-zinc-500">$199 / month · Unlimited events · 5,000 guests per event</span>
|
||||
</span>
|
||||
<span class="text-xs text-zinc-400">{{ upgrading === 'business' ? 'Opening checkout…' : '→' }}</span>
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<div class="mt-4 flex items-center justify-between text-xs">
|
||||
<button
|
||||
type="button"
|
||||
class="text-zinc-400 hover:text-zinc-200"
|
||||
@click="viewPlans"
|
||||
>Compare all plans</button>
|
||||
<button
|
||||
type="button"
|
||||
class="text-zinc-500 hover:text-zinc-300"
|
||||
@click="billing.dismissUpgradePrompt()"
|
||||
>Maybe later</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</Teleport>
|
||||
</template>
|
||||
@@ -1,16 +1,57 @@
|
||||
// Typed wrapper around $fetch with the configured API base.
|
||||
// Usage: const events = await useApi<EventList>('/events')
|
||||
//
|
||||
// Adds `Authorization: Bearer <access_token>` when the caller is signed in,
|
||||
// and on a 401 transparently asks `/auth/refresh` for a new token and retries
|
||||
// once. Failed refresh clears local auth state — pages can rely on the
|
||||
// returned error to redirect to /login.
|
||||
|
||||
export async function useApi<T = unknown>(
|
||||
path: string,
|
||||
opts: { method?: string; body?: unknown; query?: Record<string, unknown> } = {},
|
||||
): Promise<T> {
|
||||
const config = useRuntimeConfig()
|
||||
const base = config.public.apiBase as string
|
||||
return await $fetch<T>(path, {
|
||||
baseURL: base,
|
||||
method: (opts.method ?? 'GET') as any,
|
||||
body: opts.body,
|
||||
query: opts.query,
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
})
|
||||
const auth = useAuth()
|
||||
|
||||
const request = async (token: string | null): Promise<T> => {
|
||||
const headers: Record<string, string> = {}
|
||||
// Let the browser set Content-Type (with the multipart boundary) when
|
||||
// the body is FormData / Blob; otherwise default to JSON.
|
||||
const isMultipart = typeof FormData !== 'undefined' && opts.body instanceof FormData
|
||||
if (!isMultipart) headers['Content-Type'] = 'application/json'
|
||||
if (token) headers.Authorization = `Bearer ${token}`
|
||||
return await $fetch<T>(path, {
|
||||
baseURL: base,
|
||||
method: (opts.method ?? 'GET') as any,
|
||||
body: opts.body as any,
|
||||
query: opts.query,
|
||||
headers,
|
||||
credentials: 'include',
|
||||
})
|
||||
}
|
||||
|
||||
try {
|
||||
return await request(auth.liveAccessToken())
|
||||
} catch (err: any) {
|
||||
const status = err?.response?.status ?? err?.statusCode
|
||||
|
||||
// 402 Payment Required — plan limit hit. Surface the backend's
|
||||
// upgrade payload on a global state slot; the UpgradeModal in
|
||||
// app.vue reads it and prompts the host to upgrade. We still
|
||||
// rethrow so the caller can stop its own UI flow if it wants.
|
||||
if (status === 402) {
|
||||
const data = err?.data
|
||||
if (data && data.upgrade_url) {
|
||||
useBilling().showUpgradePrompt(data)
|
||||
}
|
||||
throw err
|
||||
}
|
||||
|
||||
if (status !== 401) throw err
|
||||
// /auth/* endpoints set the cookie themselves — never retry-refresh them.
|
||||
if (path.startsWith('/auth/')) throw err
|
||||
const refreshed = await auth.refresh()
|
||||
if (!refreshed) throw err
|
||||
return await request(auth.liveAccessToken())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,147 @@
|
||||
// Auth state for the host-facing app.
|
||||
//
|
||||
// The access token lives only in memory (useState — Nuxt's SSR-safe wrapper).
|
||||
// The refresh token lives in an HttpOnly cookie set by the API at
|
||||
// `/auth/refresh` scope, so JavaScript here can never read it. On a hard
|
||||
// reload we lose the access token but the cookie survives, so `bootstrap()`
|
||||
// calls `/auth/refresh` to mint a fresh access token + reload the user.
|
||||
|
||||
interface AuthUser {
|
||||
id: string
|
||||
email: string
|
||||
name: string
|
||||
email_verified: boolean
|
||||
}
|
||||
|
||||
interface AuthSuccess {
|
||||
access_token: string
|
||||
expires_at: string
|
||||
user: AuthUser
|
||||
}
|
||||
|
||||
interface AuthState {
|
||||
user: AuthUser | null
|
||||
accessToken: string | null
|
||||
expiresAt: number | null // unix ms
|
||||
bootstrapped: boolean
|
||||
}
|
||||
|
||||
function emptyState(): AuthState {
|
||||
return { user: null, accessToken: null, expiresAt: null, bootstrapped: false }
|
||||
}
|
||||
|
||||
function apiBase(): string {
|
||||
return useRuntimeConfig().public.apiBase as string
|
||||
}
|
||||
|
||||
async function postJSON<T>(path: string, body?: unknown): Promise<T> {
|
||||
return await $fetch<T>(path, {
|
||||
baseURL: apiBase(),
|
||||
method: 'POST',
|
||||
body,
|
||||
credentials: 'include',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
})
|
||||
}
|
||||
|
||||
export function useAuth() {
|
||||
const state = useState<AuthState>('gg-auth', emptyState)
|
||||
|
||||
function setSession(s: AuthSuccess) {
|
||||
state.value = {
|
||||
user: s.user,
|
||||
accessToken: s.access_token,
|
||||
expiresAt: Date.parse(s.expires_at) || (Date.now() + 14 * 60 * 1000),
|
||||
bootstrapped: true,
|
||||
}
|
||||
}
|
||||
|
||||
function clearSession() {
|
||||
state.value = { ...emptyState(), bootstrapped: true }
|
||||
}
|
||||
|
||||
async function signup(email: string, name: string, password: string, acceptTerms = false) {
|
||||
return await postJSON<{ status: string }>('/auth/signup', {
|
||||
email, name, password,
|
||||
accept_terms: acceptTerms,
|
||||
})
|
||||
}
|
||||
|
||||
async function login(email: string, password: string) {
|
||||
const s = await postJSON<AuthSuccess>('/auth/login', { email, password })
|
||||
setSession(s)
|
||||
return s
|
||||
}
|
||||
|
||||
async function refresh(): Promise<boolean> {
|
||||
try {
|
||||
const s = await postJSON<AuthSuccess>('/auth/refresh')
|
||||
setSession(s)
|
||||
return true
|
||||
} catch {
|
||||
clearSession()
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
async function logout() {
|
||||
try {
|
||||
await postJSON<void>('/auth/logout')
|
||||
} catch {
|
||||
// Best-effort — clear local state regardless.
|
||||
}
|
||||
clearSession()
|
||||
}
|
||||
|
||||
async function verifyEmail(token: string) {
|
||||
return await postJSON<{ status: string }>('/auth/verify-email', { token })
|
||||
}
|
||||
|
||||
async function forgotPassword(email: string) {
|
||||
return await postJSON<{ status: string }>('/auth/forgot-password', { email })
|
||||
}
|
||||
|
||||
async function resetPassword(token: string, newPassword: string) {
|
||||
return await postJSON<{ status: string }>('/auth/reset-password', {
|
||||
token,
|
||||
new_password: newPassword,
|
||||
})
|
||||
}
|
||||
|
||||
// Call on app entry / route guards. Returns true if the caller has a valid
|
||||
// session by the time it resolves.
|
||||
async function bootstrap(): Promise<boolean> {
|
||||
if (!import.meta.client) return false
|
||||
if (state.value.bootstrapped && state.value.user) return true
|
||||
if (state.value.bootstrapped && !state.value.user) return false
|
||||
return await refresh()
|
||||
}
|
||||
|
||||
// Hint to useApi: returns the current token if not yet expired.
|
||||
function liveAccessToken(): string | null {
|
||||
if (!state.value.accessToken || !state.value.expiresAt) return null
|
||||
// 5s skew to avoid sending a just-expired token.
|
||||
if (Date.now() + 5000 >= state.value.expiresAt) return null
|
||||
return state.value.accessToken
|
||||
}
|
||||
|
||||
const isAuthenticated = computed(() => !!state.value.user)
|
||||
const user = computed(() => state.value.user)
|
||||
const bootstrapped = computed(() => state.value.bootstrapped)
|
||||
|
||||
return {
|
||||
user,
|
||||
isAuthenticated,
|
||||
bootstrapped,
|
||||
signup,
|
||||
login,
|
||||
refresh,
|
||||
logout,
|
||||
verifyEmail,
|
||||
forgotPassword,
|
||||
resetPassword,
|
||||
bootstrap,
|
||||
liveAccessToken,
|
||||
clearSession,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,151 @@
|
||||
// Billing client: fetches subscription status, kicks off checkout/portal
|
||||
// flows, and owns the global "upgrade required" prompt shown by the
|
||||
// 402 interceptor in useApi. State is shared across components via
|
||||
// useState so the prompt can be triggered from any handler.
|
||||
|
||||
export interface BillingStatus {
|
||||
tier: 'free' | 'pro' | 'business'
|
||||
status: string
|
||||
current_period_end?: string
|
||||
cancel_at_period_end: boolean
|
||||
limits: {
|
||||
events_per_month: number
|
||||
guests_per_event: number
|
||||
}
|
||||
usage: {
|
||||
events_this_month: number
|
||||
}
|
||||
portal_available: boolean
|
||||
}
|
||||
|
||||
// UpgradePrompt mirrors the 402 body the backend returns when a limit is
|
||||
// hit. Shown globally as a modal until dismissed or acted upon.
|
||||
export interface UpgradePrompt {
|
||||
error: string
|
||||
reason: string
|
||||
tier: string
|
||||
used: number
|
||||
limit: number
|
||||
upgrade_url: string
|
||||
}
|
||||
|
||||
const FREE_DEFAULT: BillingStatus = {
|
||||
tier: 'free',
|
||||
status: 'active',
|
||||
cancel_at_period_end: false,
|
||||
limits: { events_per_month: 1, guests_per_event: 50 },
|
||||
usage: { events_this_month: 0 },
|
||||
portal_available: false,
|
||||
}
|
||||
|
||||
export function useBilling() {
|
||||
const status = useState<BillingStatus | null>('gg-billing-status', () => null)
|
||||
const loading = useState<boolean>('gg-billing-loading', () => false)
|
||||
const prompt = useState<UpgradePrompt | null>('gg-upgrade-prompt', () => null)
|
||||
|
||||
async function fetchStatus(): Promise<BillingStatus> {
|
||||
loading.value = true
|
||||
try {
|
||||
const res = await useApi<BillingStatus>('/billing/status')
|
||||
status.value = res
|
||||
return res
|
||||
} catch (e: any) {
|
||||
// 401/refresh edge → caller redirected to /login by useApi. If the
|
||||
// backend has billing wired but the response is malformed, fall
|
||||
// back to free defaults so the page renders something usable.
|
||||
status.value = FREE_DEFAULT
|
||||
return FREE_DEFAULT
|
||||
} finally {
|
||||
loading.value = false
|
||||
}
|
||||
}
|
||||
|
||||
async function startCheckout(tier: 'pro' | 'business'): Promise<void> {
|
||||
const res = await useApi<{ url: string }>('/billing/checkout-session', {
|
||||
method: 'POST',
|
||||
body: { tier },
|
||||
})
|
||||
if (import.meta.client) window.location.href = res.url
|
||||
}
|
||||
|
||||
async function openPortal(): Promise<void> {
|
||||
const res = await useApi<{ url: string }>('/billing/portal', { method: 'POST' })
|
||||
if (import.meta.client) window.location.href = res.url
|
||||
}
|
||||
|
||||
function showUpgradePrompt(info: UpgradePrompt) {
|
||||
prompt.value = info
|
||||
}
|
||||
function dismissUpgradePrompt() {
|
||||
prompt.value = null
|
||||
}
|
||||
|
||||
return {
|
||||
status,
|
||||
loading,
|
||||
prompt,
|
||||
fetchStatus,
|
||||
startCheckout,
|
||||
openPortal,
|
||||
showUpgradePrompt,
|
||||
dismissUpgradePrompt,
|
||||
}
|
||||
}
|
||||
|
||||
// Static pricing copy. Keep in sync with internal/billing/tiers.go.
|
||||
// One source of truth for the marketing-page-style cards in
|
||||
// /dashboard/billing and the UpgradeModal.
|
||||
export interface TierCard {
|
||||
id: 'free' | 'pro' | 'business'
|
||||
name: string
|
||||
price: string
|
||||
priceSubtitle: string
|
||||
tagline: string
|
||||
features: string[]
|
||||
highlight?: boolean
|
||||
}
|
||||
|
||||
export const TIER_CARDS: TierCard[] = [
|
||||
{
|
||||
id: 'free',
|
||||
name: 'Free',
|
||||
price: '$0',
|
||||
priceSubtitle: 'forever',
|
||||
tagline: 'Try GuestGuard with a single event.',
|
||||
features: [
|
||||
'1 event per month',
|
||||
'Up to 50 guests per event',
|
||||
'Branded email invitations',
|
||||
'Real-time RSVP dashboard',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'pro',
|
||||
name: 'Pro',
|
||||
price: '$49',
|
||||
priceSubtitle: 'per month',
|
||||
tagline: 'For active hosts running several events.',
|
||||
features: [
|
||||
'10 events per month',
|
||||
'Up to 1,000 guests per event',
|
||||
'WhatsApp + email invitations',
|
||||
'CSV import + bulk send',
|
||||
'Priority email support',
|
||||
],
|
||||
highlight: true,
|
||||
},
|
||||
{
|
||||
id: 'business',
|
||||
name: 'Business',
|
||||
price: '$199',
|
||||
priceSubtitle: 'per month',
|
||||
tagline: 'For agencies and corporate events teams.',
|
||||
features: [
|
||||
'Unlimited events',
|
||||
'Up to 5,000 guests per event',
|
||||
'Everything in Pro',
|
||||
'Signed DPA on request',
|
||||
'SLA with response targets',
|
||||
],
|
||||
},
|
||||
]
|
||||
@@ -0,0 +1,28 @@
|
||||
// Friendly error messages for API failures, with first-class handling of
|
||||
// 429 (rate-limited) and 403 account-lockout responses.
|
||||
export function useErrMessage(e: any, fallback = 'Something went wrong'): string {
|
||||
const status: number | undefined = e?.response?.status ?? e?.statusCode
|
||||
const data = e?.data
|
||||
const serverMsg: string | undefined = data?.error
|
||||
|
||||
if (status === 429) {
|
||||
const retry: number | undefined = data?.retry_after
|
||||
if (typeof retry === 'number' && retry > 0) {
|
||||
return `You're going too fast — try again in ${formatSeconds(retry)}.`
|
||||
}
|
||||
return "You're going too fast — please try again in a moment."
|
||||
}
|
||||
|
||||
if (status === 403 && typeof serverMsg === 'string' && serverMsg.toLowerCase().includes('locked')) {
|
||||
return 'Your account is locked after too many failed sign-in attempts. Reset your password to unlock it.'
|
||||
}
|
||||
|
||||
if (serverMsg) return serverMsg
|
||||
return e?.message || fallback
|
||||
}
|
||||
|
||||
function formatSeconds(s: number): string {
|
||||
if (s < 60) return `${s} second${s === 1 ? '' : 's'}`
|
||||
const m = Math.ceil(s / 60)
|
||||
return `${m} minute${m === 1 ? '' : 's'}`
|
||||
}
|
||||
@@ -1,7 +1,12 @@
|
||||
// Subscribes to /ws/events/:id and emits per-message callbacks.
|
||||
//
|
||||
// Auto-reconnects with exponential backoff up to 30s. Returns a cleanup
|
||||
// fn the caller invokes (e.g. inside onUnmounted).
|
||||
// Authenticates via short-lived ticket: before each connect we POST
|
||||
// /auth/ws-ticket (bearer-authed) to mint a one-shot ticket, then pass it
|
||||
// on the WS handshake as `?ticket=…`. Tickets expire ~60s after mint, so we
|
||||
// always mint fresh — even on reconnects.
|
||||
//
|
||||
// Auto-reconnects with exponential backoff up to 30s. Returns a cleanup fn
|
||||
// the caller invokes (e.g. inside onUnmounted).
|
||||
|
||||
interface WSMessage {
|
||||
type: string
|
||||
@@ -10,21 +15,46 @@ interface WSMessage {
|
||||
timestamp: string
|
||||
}
|
||||
|
||||
interface WSTicket {
|
||||
ticket: string
|
||||
expires_at: string
|
||||
}
|
||||
|
||||
export function useEventWS(eventId: string, onMessage: (msg: WSMessage) => void) {
|
||||
if (import.meta.server) return () => {}
|
||||
|
||||
const config = useRuntimeConfig()
|
||||
const base = (config.public.wsBase as string) || ''
|
||||
const url = `${base}/ws/events/${eventId}`
|
||||
const wsBase = (config.public.wsBase as string) || ''
|
||||
|
||||
let ws: WebSocket | null = null
|
||||
let attempt = 0
|
||||
let stopped = false
|
||||
let reconnectTimer: ReturnType<typeof setTimeout> | null = null
|
||||
|
||||
function connect() {
|
||||
async function mintTicket(): Promise<string | null> {
|
||||
try {
|
||||
const t = await useApi<WSTicket>('/auth/ws-ticket', {
|
||||
method: 'POST',
|
||||
body: { event_id: eventId },
|
||||
})
|
||||
return t.ticket
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
async function connect() {
|
||||
if (stopped) return
|
||||
ws = new WebSocket(url)
|
||||
const ticket = await mintTicket()
|
||||
if (stopped) return
|
||||
if (!ticket) {
|
||||
// Couldn't get a ticket (likely 401 — session expired). Back off and
|
||||
// retry; useApi will have already attempted refresh on its own.
|
||||
const backoff = Math.min(30_000, 500 * Math.pow(2, attempt++))
|
||||
reconnectTimer = setTimeout(connect, backoff)
|
||||
return
|
||||
}
|
||||
ws = new WebSocket(`${wsBase}/ws/events/${eventId}?ticket=${encodeURIComponent(ticket)}`)
|
||||
|
||||
ws.onopen = () => {
|
||||
attempt = 0
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
// Demo-grade host bootstrap. Real auth would replace this entirely; for now
|
||||
// we upsert by email and stash the host id in localStorage.
|
||||
interface User {
|
||||
id: string
|
||||
email: string
|
||||
name: string
|
||||
}
|
||||
|
||||
const STORAGE_KEY = 'gg.host'
|
||||
|
||||
export function useHost() {
|
||||
const host = useState<User | null>('gg-host', () => null)
|
||||
|
||||
if (import.meta.client && !host.value) {
|
||||
const raw = window.localStorage.getItem(STORAGE_KEY)
|
||||
if (raw) {
|
||||
try {
|
||||
host.value = JSON.parse(raw)
|
||||
} catch {
|
||||
window.localStorage.removeItem(STORAGE_KEY)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async function bootstrap(email: string, name: string) {
|
||||
const u = await useApi<User>('/users', {
|
||||
method: 'POST',
|
||||
body: { email, name },
|
||||
})
|
||||
host.value = u
|
||||
if (import.meta.client) {
|
||||
window.localStorage.setItem(STORAGE_KEY, JSON.stringify(u))
|
||||
}
|
||||
return u
|
||||
}
|
||||
|
||||
function clear() {
|
||||
host.value = null
|
||||
if (import.meta.client) window.localStorage.removeItem(STORAGE_KEY)
|
||||
}
|
||||
|
||||
return { host, bootstrap, clear }
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
// Route guard: bootstraps the session (server -> client cookie roundtrip,
|
||||
// then optional /auth/refresh), and redirects to /login if no session.
|
||||
//
|
||||
// Skip on SSR: auth state lives entirely in the browser. Dashboard pages
|
||||
// render their own client-side loading state while we resolve.
|
||||
|
||||
export default defineNuxtRouteMiddleware(async (to) => {
|
||||
if (import.meta.server) return
|
||||
const auth = useAuth()
|
||||
const ok = await auth.bootstrap()
|
||||
if (!ok) {
|
||||
return navigateTo({ path: '/login', query: { redirect: to.fullPath } })
|
||||
}
|
||||
})
|
||||
Generated
+15
-4
@@ -5092,12 +5092,14 @@
|
||||
}
|
||||
},
|
||||
"node_modules/commander": {
|
||||
"version": "10.0.1",
|
||||
"resolved": "https://registry.npmjs.org/commander/-/commander-10.0.1.tgz",
|
||||
"integrity": "sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==",
|
||||
"version": "13.1.0",
|
||||
"resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
|
||||
"integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"engines": {
|
||||
"node": ">=14"
|
||||
"node": ">=18"
|
||||
}
|
||||
},
|
||||
"node_modules/common-path-prefix": {
|
||||
@@ -8500,6 +8502,15 @@
|
||||
"node": ">=8"
|
||||
}
|
||||
},
|
||||
"node_modules/lambda-local/node_modules/commander": {
|
||||
"version": "10.0.1",
|
||||
"resolved": "https://registry.npmjs.org/commander/-/commander-10.0.1.tgz",
|
||||
"integrity": "sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=14"
|
||||
}
|
||||
},
|
||||
"node_modules/lambda-local/node_modules/dotenv": {
|
||||
"version": "16.6.1",
|
||||
"resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
|
||||
|
||||
@@ -0,0 +1,393 @@
|
||||
<script setup lang="ts">
|
||||
definePageMeta({ middleware: ['auth'] })
|
||||
|
||||
const route = useRoute()
|
||||
const router = useRouter()
|
||||
const billing = useBilling()
|
||||
const auth = useAuth()
|
||||
const config = useRuntimeConfig()
|
||||
const switching = ref<'pro' | 'business' | null>(null)
|
||||
const portalLoading = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
const toast = ref<string | null>(null)
|
||||
let toastTimer: ReturnType<typeof setTimeout> | null = null
|
||||
|
||||
// Your data
|
||||
const exporting = ref(false)
|
||||
const deleteConfirmOpen = ref(false)
|
||||
const deleteConfirmation = ref('')
|
||||
const deleting = ref(false)
|
||||
const deleteError = ref<string | null>(null)
|
||||
|
||||
async function exportData() {
|
||||
exporting.value = true
|
||||
try {
|
||||
const apiBase = config.public.apiBase as string
|
||||
const token = auth.liveAccessToken()
|
||||
// Plain fetch (not useApi) so the response is treated as a download.
|
||||
const res = await fetch(`${apiBase}/me/data-export`, {
|
||||
headers: token ? { Authorization: `Bearer ${token}` } : {},
|
||||
credentials: 'include',
|
||||
})
|
||||
if (!res.ok) throw new Error(`HTTP ${res.status}`)
|
||||
const blob = await res.blob()
|
||||
const url = URL.createObjectURL(blob)
|
||||
const a = document.createElement('a')
|
||||
a.href = url
|
||||
a.download = 'guestguard-data-export.json'
|
||||
a.click()
|
||||
URL.revokeObjectURL(url)
|
||||
showToast('Export downloaded.')
|
||||
} catch (e: any) {
|
||||
showToast(useErrMessage(e, 'Export failed'))
|
||||
} finally {
|
||||
exporting.value = false
|
||||
}
|
||||
}
|
||||
|
||||
async function confirmDelete() {
|
||||
deleting.value = true
|
||||
deleteError.value = null
|
||||
try {
|
||||
await useApi('/me', { method: 'DELETE' })
|
||||
// Soft-delete revoked our refresh token; clear local session and
|
||||
// bounce to the marketing landing.
|
||||
auth.clearSession()
|
||||
await router.push('/')
|
||||
} catch (e: any) {
|
||||
deleteError.value = useErrMessage(e, 'Could not delete account')
|
||||
} finally {
|
||||
deleting.value = false
|
||||
}
|
||||
}
|
||||
|
||||
function showToast(text: string) {
|
||||
toast.value = text
|
||||
if (toastTimer) clearTimeout(toastTimer)
|
||||
toastTimer = setTimeout(() => { toast.value = null }, 5000)
|
||||
}
|
||||
|
||||
onMounted(async () => {
|
||||
await billing.fetchStatus()
|
||||
|
||||
// Handle return-from-Stripe query params. ?billing=success means the
|
||||
// checkout completed; Stripe also fires the webhook server-side so we
|
||||
// refetch status to pick up the new tier without a hard reload.
|
||||
const flag = route.query.billing
|
||||
if (flag === 'success') {
|
||||
showToast('Subscription updated — welcome aboard!')
|
||||
// Stripe's webhook may take ~1s to land. Poll a couple of times.
|
||||
for (let i = 0; i < 3; i++) {
|
||||
await new Promise((r) => setTimeout(r, 1500))
|
||||
await billing.fetchStatus()
|
||||
if (billing.status.value?.tier !== 'free') break
|
||||
}
|
||||
} else if (flag === 'cancelled') {
|
||||
showToast('No worries — your plan is unchanged.')
|
||||
}
|
||||
})
|
||||
|
||||
async function upgrade(tier: 'pro' | 'business') {
|
||||
switching.value = tier
|
||||
error.value = null
|
||||
try {
|
||||
await billing.startCheckout(tier)
|
||||
} catch (e: any) {
|
||||
if (e?.response?.status === 503) {
|
||||
error.value = 'Billing isn\'t enabled on this environment yet — contact support.'
|
||||
} else {
|
||||
error.value = useErrMessage(e, 'Could not start checkout')
|
||||
}
|
||||
} finally {
|
||||
switching.value = null
|
||||
}
|
||||
}
|
||||
|
||||
async function manageSubscription() {
|
||||
portalLoading.value = true
|
||||
error.value = null
|
||||
try {
|
||||
await billing.openPortal()
|
||||
} catch (e: any) {
|
||||
if (e?.response?.status === 503) {
|
||||
error.value = 'Billing isn\'t enabled on this environment yet.'
|
||||
} else {
|
||||
error.value = useErrMessage(e, 'Could not open the billing portal')
|
||||
}
|
||||
} finally {
|
||||
portalLoading.value = false
|
||||
}
|
||||
}
|
||||
|
||||
// Usage bar percentage — clamps to [0, 100] for the progress indicator.
|
||||
const eventsUsagePct = computed(() => {
|
||||
const s = billing.status.value
|
||||
if (!s) return 0
|
||||
const limit = s.limits.events_per_month
|
||||
if (limit < 0) return 0 // unlimited — show empty bar
|
||||
if (limit === 0) return 100
|
||||
return Math.min(100, Math.round((s.usage.events_this_month / limit) * 100))
|
||||
})
|
||||
|
||||
function formatLimit(n: number): string {
|
||||
return n < 0 ? 'Unlimited' : n.toLocaleString()
|
||||
}
|
||||
|
||||
function periodEndLabel(iso?: string): string {
|
||||
if (!iso) return ''
|
||||
try {
|
||||
return new Date(iso).toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' })
|
||||
} catch {
|
||||
return iso
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="space-y-6">
|
||||
<div>
|
||||
<NuxtLink to="/dashboard" class="mb-2 inline-block text-sm text-zinc-400 hover:text-zinc-200">
|
||||
← Back to dashboard
|
||||
</NuxtLink>
|
||||
<h1 class="text-2xl font-semibold">Billing & plan</h1>
|
||||
<p class="mt-1 text-sm text-zinc-400">
|
||||
Change your plan, see your usage, or update your payment method.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<ClientOnly>
|
||||
<!-- Current plan + usage -->
|
||||
<div class="card">
|
||||
<div class="flex flex-wrap items-start justify-between gap-4">
|
||||
<div>
|
||||
<p class="text-xs font-medium uppercase tracking-wider text-zinc-500">Current plan</p>
|
||||
<div class="mt-1 flex items-baseline gap-2">
|
||||
<span class="text-2xl font-semibold capitalize text-zinc-100">{{ billing.status.value?.tier || '—' }}</span>
|
||||
<span
|
||||
v-if="billing.status.value && billing.status.value.tier !== 'free'"
|
||||
class="rounded-full bg-zinc-800 px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide text-zinc-400"
|
||||
>{{ billing.status.value.status }}</span>
|
||||
</div>
|
||||
<p
|
||||
v-if="billing.status.value?.current_period_end && billing.status.value.tier !== 'free'"
|
||||
class="mt-1 text-xs text-zinc-500"
|
||||
>
|
||||
<template v-if="billing.status.value.cancel_at_period_end">
|
||||
Cancels on {{ periodEndLabel(billing.status.value.current_period_end) }}.
|
||||
</template>
|
||||
<template v-else>
|
||||
Renews on {{ periodEndLabel(billing.status.value.current_period_end) }}.
|
||||
</template>
|
||||
</p>
|
||||
</div>
|
||||
<button
|
||||
v-if="billing.status.value?.portal_available"
|
||||
type="button"
|
||||
class="rounded-md border border-zinc-700 px-3 py-1.5 text-sm text-zinc-200 transition hover:border-zinc-500 hover:bg-zinc-800 disabled:opacity-50"
|
||||
:disabled="portalLoading"
|
||||
@click="manageSubscription"
|
||||
>
|
||||
{{ portalLoading ? 'Opening…' : 'Manage subscription' }}
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<!-- Usage bar -->
|
||||
<div class="mt-5">
|
||||
<div class="mb-1.5 flex items-center justify-between text-xs">
|
||||
<span class="text-zinc-300">Events this month</span>
|
||||
<span class="tabular-nums text-zinc-400">
|
||||
{{ billing.status.value?.usage.events_this_month ?? 0 }}
|
||||
of
|
||||
{{ formatLimit(billing.status.value?.limits.events_per_month ?? 0) }}
|
||||
</span>
|
||||
</div>
|
||||
<div class="h-2 w-full overflow-hidden rounded-full bg-zinc-800">
|
||||
<div
|
||||
class="h-full rounded-full transition-all"
|
||||
:class="eventsUsagePct >= 90 ? 'bg-amber-400' : 'bg-brand-500'"
|
||||
:style="{ width: `${eventsUsagePct}%` }"
|
||||
></div>
|
||||
</div>
|
||||
<p class="mt-1.5 text-xs text-zinc-500">
|
||||
Guest cap per event: {{ formatLimit(billing.status.value?.limits.guests_per_event ?? 0) }}.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Pricing cards -->
|
||||
<div class="grid gap-4 md:grid-cols-3">
|
||||
<div
|
||||
v-for="t in TIER_CARDS"
|
||||
:key="t.id"
|
||||
class="card relative flex flex-col gap-4"
|
||||
:class="t.highlight ? 'border-brand-700/60 bg-brand-500/[0.04]' : ''"
|
||||
>
|
||||
<span
|
||||
v-if="t.id === billing.status.value?.tier"
|
||||
class="absolute right-3 top-3 rounded-full bg-zinc-800 px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide text-zinc-300"
|
||||
>Current</span>
|
||||
<span
|
||||
v-else-if="t.highlight"
|
||||
class="absolute right-3 top-3 rounded-full bg-brand-500 px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide text-zinc-950"
|
||||
>Most popular</span>
|
||||
|
||||
<div>
|
||||
<h3 class="text-lg font-semibold capitalize text-zinc-100">{{ t.name }}</h3>
|
||||
<p class="mt-1 text-xs text-zinc-500">{{ t.tagline }}</p>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<span class="text-3xl font-semibold tabular-nums text-zinc-100">{{ t.price }}</span>
|
||||
<span class="ml-1 text-xs text-zinc-500">{{ t.priceSubtitle }}</span>
|
||||
</div>
|
||||
|
||||
<ul class="space-y-1.5 text-sm text-zinc-300">
|
||||
<li v-for="f in t.features" :key="f" class="flex items-start gap-2">
|
||||
<svg class="mt-0.5 h-3.5 w-3.5 shrink-0 text-brand-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
|
||||
<path fill-rule="evenodd" d="M16.704 5.296a1 1 0 010 1.408l-8 8a1 1 0 01-1.408 0l-4-4a1 1 0 011.408-1.408L8 12.592l7.296-7.296a1 1 0 011.408 0z" clip-rule="evenodd" />
|
||||
</svg>
|
||||
<span>{{ f }}</span>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<div class="mt-auto pt-2">
|
||||
<button
|
||||
v-if="t.id === billing.status.value?.tier"
|
||||
type="button"
|
||||
class="w-full cursor-default rounded-md border border-zinc-800 px-3 py-2 text-sm text-zinc-500"
|
||||
disabled
|
||||
>Current plan</button>
|
||||
<button
|
||||
v-else-if="t.id === 'free'"
|
||||
type="button"
|
||||
class="w-full cursor-default rounded-md border border-zinc-800 px-3 py-2 text-sm text-zinc-500"
|
||||
disabled
|
||||
>Downgrade in the billing portal</button>
|
||||
<button
|
||||
v-else
|
||||
type="button"
|
||||
class="btn-primary w-full disabled:opacity-50"
|
||||
:disabled="switching === t.id"
|
||||
@click="upgrade(t.id)"
|
||||
>
|
||||
{{ switching === t.id ? 'Opening checkout…' : `Upgrade to ${t.name}` }}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p v-if="error" class="text-sm text-red-400">{{ error }}</p>
|
||||
|
||||
<p class="text-xs text-zinc-500">
|
||||
Receipts and invoices are emailed automatically by Stripe.
|
||||
Need to cancel? Use <a href="#" class="text-brand-400 hover:text-brand-300" @click.prevent="manageSubscription">Manage subscription</a> above.
|
||||
</p>
|
||||
|
||||
<!-- ===== Your data ===== -->
|
||||
<div class="card mt-2">
|
||||
<h2 class="mb-1 text-lg font-semibold">Your data</h2>
|
||||
<p class="mb-4 text-xs text-zinc-500">
|
||||
Export a copy of everything we hold about you, or delete your account.
|
||||
</p>
|
||||
<div class="space-y-3">
|
||||
<button
|
||||
type="button"
|
||||
class="flex w-full items-center justify-between rounded-md border border-zinc-700 bg-zinc-950 px-3 py-3 text-left transition hover:border-zinc-500 hover:bg-zinc-900 disabled:opacity-50"
|
||||
:disabled="exporting"
|
||||
@click="exportData"
|
||||
>
|
||||
<span>
|
||||
<span class="block text-sm font-medium text-zinc-100">Export my data</span>
|
||||
<span class="block text-xs text-zinc-500">
|
||||
Download a JSON file with your events, guests, RSVPs, and account info.
|
||||
</span>
|
||||
</span>
|
||||
<span class="text-xs text-zinc-400">{{ exporting ? '…' : '↓' }}</span>
|
||||
</button>
|
||||
|
||||
<button
|
||||
type="button"
|
||||
class="flex w-full items-center justify-between rounded-md border border-red-800/40 bg-red-950/10 px-3 py-3 text-left transition hover:border-red-700 hover:bg-red-950/20"
|
||||
@click="deleteConfirmOpen = true"
|
||||
>
|
||||
<span>
|
||||
<span class="block text-sm font-medium text-red-300">Delete my account</span>
|
||||
<span class="block text-xs text-red-400/70">
|
||||
Soft-deleted immediately, permanently erased after 30 days. You'll be signed out everywhere.
|
||||
</span>
|
||||
</span>
|
||||
<span class="text-xs text-red-400">→</span>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<template #fallback>
|
||||
<div class="card text-sm text-zinc-500">Loading…</div>
|
||||
</template>
|
||||
</ClientOnly>
|
||||
|
||||
<!-- Delete-account confirmation -->
|
||||
<Teleport to="body">
|
||||
<div
|
||||
v-if="deleteConfirmOpen"
|
||||
class="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm"
|
||||
@click.self="deleteConfirmOpen = false"
|
||||
>
|
||||
<div
|
||||
role="alertdialog"
|
||||
aria-modal="true"
|
||||
aria-labelledby="del-acct-title"
|
||||
class="w-full max-w-md rounded-lg border border-zinc-800 bg-zinc-900 p-5 shadow-2xl"
|
||||
>
|
||||
<h3 id="del-acct-title" class="mb-1 text-base font-semibold">Delete account?</h3>
|
||||
<p class="mb-3 text-sm text-zinc-400">
|
||||
Your account will be soft-deleted now and permanently erased
|
||||
after 30 days. All your events, guests, and RSVP history go
|
||||
with it. You'll be signed out from every device.
|
||||
</p>
|
||||
<p class="mb-3 text-xs text-zinc-500">
|
||||
Type <code class="rounded bg-zinc-800 px-1 py-0.5 font-mono text-zinc-300">delete</code>
|
||||
to confirm.
|
||||
</p>
|
||||
<input
|
||||
v-model="deleteConfirmation"
|
||||
type="text"
|
||||
placeholder="delete"
|
||||
class="input mb-3 font-mono"
|
||||
autocomplete="off"
|
||||
/>
|
||||
<div class="flex items-center justify-end gap-2">
|
||||
<button class="text-sm text-zinc-400 hover:text-zinc-200" :disabled="deleting" @click="deleteConfirmOpen = false">Cancel</button>
|
||||
<button
|
||||
class="rounded-md bg-red-500/90 px-3 py-1.5 text-sm font-medium text-white shadow-sm transition hover:bg-red-500 disabled:opacity-40"
|
||||
:disabled="deleting || deleteConfirmation.trim().toLowerCase() !== 'delete'"
|
||||
@click="confirmDelete"
|
||||
>
|
||||
{{ deleting ? 'Deleting…' : 'Delete forever' }}
|
||||
</button>
|
||||
</div>
|
||||
<p v-if="deleteError" class="mt-3 text-sm text-red-400">{{ deleteError }}</p>
|
||||
</div>
|
||||
</div>
|
||||
</Teleport>
|
||||
|
||||
<!-- Toast for return-from-Stripe -->
|
||||
<Transition
|
||||
enter-active-class="transition duration-200 ease-out"
|
||||
enter-from-class="translate-y-2 opacity-0"
|
||||
enter-to-class="translate-y-0 opacity-100"
|
||||
leave-active-class="transition duration-200 ease-in"
|
||||
leave-from-class="translate-y-0 opacity-100"
|
||||
leave-to-class="translate-y-2 opacity-0"
|
||||
>
|
||||
<button
|
||||
v-if="toast"
|
||||
type="button"
|
||||
class="fixed bottom-6 right-6 z-50 max-w-sm rounded-lg border border-brand-700/60 bg-brand-950/90 px-4 py-3 text-left text-sm text-brand-100 shadow-lg backdrop-blur"
|
||||
@click="toast = null"
|
||||
>
|
||||
<span aria-hidden="true" class="mr-2">✓</span>{{ toast }}
|
||||
</button>
|
||||
</Transition>
|
||||
</section>
|
||||
</template>
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,5 +1,8 @@
|
||||
<script setup lang="ts">
|
||||
const { host } = useHost()
|
||||
definePageMeta({ middleware: ['auth'] })
|
||||
|
||||
const auth = useAuth()
|
||||
const host = auth.user
|
||||
|
||||
const name = ref('')
|
||||
const slug = ref('')
|
||||
@@ -17,7 +20,6 @@ async function submit() {
|
||||
const created = await useApi<{ id: string }>('/events', {
|
||||
method: 'POST',
|
||||
body: {
|
||||
host_id: host.value.id,
|
||||
name: name.value,
|
||||
slug: slug.value,
|
||||
event_date: new Date(eventDate.value).toISOString(),
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
<script setup lang="ts">
|
||||
definePageMeta({ middleware: ['auth'] })
|
||||
|
||||
interface EventSummary {
|
||||
id: string
|
||||
name: string
|
||||
@@ -13,40 +15,28 @@ interface EventsResponse {
|
||||
events: EventSummary[]
|
||||
}
|
||||
|
||||
const { host, bootstrap } = useHost()
|
||||
|
||||
const email = ref('')
|
||||
const name = ref('')
|
||||
const bootstrapping = ref(false)
|
||||
const bootstrapError = ref<string | null>(null)
|
||||
|
||||
async function onBootstrap() {
|
||||
bootstrapError.value = null
|
||||
bootstrapping.value = true
|
||||
try {
|
||||
await bootstrap(email.value, name.value)
|
||||
} catch (e: any) {
|
||||
bootstrapError.value = e?.data?.error || e?.message || 'Failed to bootstrap'
|
||||
} finally {
|
||||
bootstrapping.value = false
|
||||
}
|
||||
}
|
||||
const auth = useAuth()
|
||||
|
||||
const events = ref<EventSummary[]>([])
|
||||
const loadingEvents = ref(false)
|
||||
const loadError = ref<string | null>(null)
|
||||
|
||||
async function loadEvents() {
|
||||
if (!host.value) return
|
||||
if (!auth.user.value) return
|
||||
loadingEvents.value = true
|
||||
loadError.value = null
|
||||
try {
|
||||
const res = await useApi<EventsResponse>('/events', { query: { host_id: host.value.id } })
|
||||
// host is derived server-side from the session — no query param needed.
|
||||
const res = await useApi<EventsResponse>('/events')
|
||||
events.value = res.events
|
||||
} catch (e: any) {
|
||||
loadError.value = e?.data?.error || e?.message || 'Failed to load events'
|
||||
} finally {
|
||||
loadingEvents.value = false
|
||||
}
|
||||
}
|
||||
|
||||
watch(host, loadEvents, { immediate: true })
|
||||
watch(() => auth.user.value, loadEvents, { immediate: true })
|
||||
|
||||
function fmtDate(iso: string) {
|
||||
try { return new Date(iso).toLocaleString() } catch { return iso }
|
||||
@@ -55,40 +45,22 @@ function fmtDate(iso: string) {
|
||||
|
||||
<template>
|
||||
<section>
|
||||
<!--
|
||||
The dashboard is auth-gated by a localStorage-backed host. Rendering
|
||||
that conditional on the server (where there's no localStorage) and
|
||||
then again on the client (where there is) causes a hydration
|
||||
mismatch that leaves the layout stuck at the bootstrap card's width
|
||||
after a hard refresh. Skipping SSR for this block fixes both the
|
||||
flash and the layout shrink.
|
||||
-->
|
||||
<ClientOnly>
|
||||
<div v-if="!host" class="card max-w-md">
|
||||
<h1 class="mb-2 text-xl font-semibold">Get started</h1>
|
||||
<p class="mb-4 text-sm text-zinc-400">
|
||||
Demo bootstrap — enter an email + name to provision a host. We don't store passwords.
|
||||
</p>
|
||||
<label class="label">Email</label>
|
||||
<input v-model="email" type="email" class="input mb-3" placeholder="you@example.com" />
|
||||
<label class="label">Name</label>
|
||||
<input v-model="name" type="text" class="input mb-4" placeholder="Your name" />
|
||||
<button class="btn-primary w-full" :disabled="bootstrapping || !email || !name" @click="onBootstrap">
|
||||
{{ bootstrapping ? 'Setting up…' : 'Continue' }}
|
||||
</button>
|
||||
<p v-if="bootstrapError" class="mt-3 text-sm text-red-400">{{ bootstrapError }}</p>
|
||||
<div v-if="!auth.bootstrapped.value || !auth.user.value" class="text-sm text-zinc-500">
|
||||
Loading dashboard…
|
||||
</div>
|
||||
|
||||
<div v-else>
|
||||
<div class="mb-6 flex items-center justify-between">
|
||||
<div>
|
||||
<h1 class="text-2xl font-semibold">Your events</h1>
|
||||
<p class="text-sm text-zinc-400">Signed in as {{ host.name }} ({{ host.email }})</p>
|
||||
<p class="text-sm text-zinc-400">Signed in as {{ auth.user.value.name }} ({{ auth.user.value.email }})</p>
|
||||
</div>
|
||||
<NuxtLink to="/dashboard/events/new" class="btn-primary">New event</NuxtLink>
|
||||
</div>
|
||||
|
||||
<div v-if="loadingEvents" class="text-sm text-zinc-500">Loading…</div>
|
||||
<div v-else-if="loadError" class="card text-sm text-red-400">{{ loadError }}</div>
|
||||
<div v-else-if="events.length === 0" class="card text-sm text-zinc-400">
|
||||
No events yet. Create one to get started.
|
||||
</div>
|
||||
|
||||
@@ -0,0 +1,49 @@
|
||||
<script setup lang="ts">
|
||||
const auth = useAuth()
|
||||
|
||||
const email = ref('')
|
||||
const submitting = ref(false)
|
||||
const sent = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
|
||||
async function submit() {
|
||||
error.value = null
|
||||
submitting.value = true
|
||||
try {
|
||||
await auth.forgotPassword(email.value)
|
||||
sent.value = true
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Request failed')
|
||||
} finally {
|
||||
submitting.value = false
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="mx-auto max-w-md py-12">
|
||||
<h1 class="mb-2 text-2xl font-semibold">Forgot your password?</h1>
|
||||
<p class="mb-6 text-sm text-zinc-400">
|
||||
Enter your email and we'll send a reset link if there's an account on file.
|
||||
</p>
|
||||
|
||||
<div v-if="sent" class="card text-sm">
|
||||
<p class="mb-2 font-medium text-brand-300">Check your inbox.</p>
|
||||
<p class="text-zinc-400">
|
||||
If <span class="text-zinc-200">{{ email }}</span> is registered, a reset link is on its way.
|
||||
</p>
|
||||
<NuxtLink to="/login" class="btn-ghost mt-4 w-full">Back to sign in</NuxtLink>
|
||||
</div>
|
||||
|
||||
<form v-else class="card space-y-4" @submit.prevent="submit">
|
||||
<div>
|
||||
<label class="label">Email</label>
|
||||
<input v-model="email" type="email" class="input" autocomplete="email" required />
|
||||
</div>
|
||||
<button class="btn-primary w-full" :disabled="submitting || !email">
|
||||
{{ submitting ? 'Sending…' : 'Send reset link' }}
|
||||
</button>
|
||||
<p v-if="error" class="text-sm text-red-400">{{ error }}</p>
|
||||
</form>
|
||||
</section>
|
||||
</template>
|
||||
@@ -0,0 +1,53 @@
|
||||
<script setup lang="ts">
|
||||
const auth = useAuth()
|
||||
const route = useRoute()
|
||||
|
||||
const email = ref('')
|
||||
const password = ref('')
|
||||
const submitting = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
|
||||
async function submit() {
|
||||
error.value = null
|
||||
submitting.value = true
|
||||
try {
|
||||
await auth.login(email.value, password.value)
|
||||
const redirect = (route.query.redirect as string) || '/dashboard'
|
||||
await navigateTo(redirect)
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Login failed')
|
||||
} finally {
|
||||
submitting.value = false
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="mx-auto max-w-md py-12">
|
||||
<h1 class="mb-2 text-2xl font-semibold">Sign in</h1>
|
||||
<p class="mb-6 text-sm text-zinc-400">Welcome back. Sign in to manage your events.</p>
|
||||
|
||||
<form class="card space-y-4" @submit.prevent="submit">
|
||||
<div>
|
||||
<label class="label">Email</label>
|
||||
<input v-model="email" type="email" class="input" autocomplete="email" required />
|
||||
</div>
|
||||
<div>
|
||||
<label class="label">Password</label>
|
||||
<input v-model="password" type="password" class="input" autocomplete="current-password" required />
|
||||
<div class="mt-1 text-right text-xs">
|
||||
<NuxtLink to="/forgot-password" class="text-zinc-400 hover:text-zinc-200">Forgot password?</NuxtLink>
|
||||
</div>
|
||||
</div>
|
||||
<button class="btn-primary w-full" :disabled="submitting || !email || !password">
|
||||
{{ submitting ? 'Signing in…' : 'Sign in' }}
|
||||
</button>
|
||||
<p v-if="error" class="text-sm text-red-400">{{ error }}</p>
|
||||
</form>
|
||||
|
||||
<p class="mt-6 text-center text-sm text-zinc-400">
|
||||
Don't have an account?
|
||||
<NuxtLink to="/signup" class="text-brand-400 hover:text-brand-300">Sign up</NuxtLink>
|
||||
</p>
|
||||
</section>
|
||||
</template>
|
||||
@@ -0,0 +1,51 @@
|
||||
<script setup lang="ts">
|
||||
useHead({ title: 'Privacy policy · GuestGuard' })
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<article class="prose prose-invert mx-auto max-w-2xl py-8 text-zinc-300">
|
||||
<h1 class="text-2xl font-semibold text-zinc-100">Privacy policy</h1>
|
||||
<p class="text-sm text-zinc-500">Last updated: <strong>placeholder — pending legal review</strong></p>
|
||||
|
||||
<p>
|
||||
This page is a placeholder while we have proper privacy copy
|
||||
reviewed by a lawyer. The substance below reflects how the
|
||||
product actually handles data today — the final wording will
|
||||
replace this page before public launch.
|
||||
</p>
|
||||
|
||||
<h2 class="mt-6 text-lg font-semibold text-zinc-100">What we collect</h2>
|
||||
<ul class="list-disc pl-6">
|
||||
<li><strong>Host account</strong>: email, name, hashed password.</li>
|
||||
<li><strong>Guest list</strong>: names, emails, phone numbers — only what
|
||||
the host enters or imports.</li>
|
||||
<li><strong>RSVP responses</strong>: the answer the guest sends back.</li>
|
||||
<li><strong>Access logs</strong>: IP, device fingerprint, and a fraud
|
||||
risk score, for each invitation-link open. Used to flag suspicious
|
||||
access (e.g. someone forwarded the link).</li>
|
||||
<li><strong>Billing</strong>: handled by Stripe — we store only the
|
||||
Stripe customer + subscription IDs locally, never card details.</li>
|
||||
</ul>
|
||||
|
||||
<h2 class="mt-6 text-lg font-semibold text-zinc-100">Your rights</h2>
|
||||
<ul class="list-disc pl-6">
|
||||
<li><strong>Export</strong>: download a full JSON dump of your data via
|
||||
Settings → "Export my data".</li>
|
||||
<li><strong>Delete</strong>: delete your account via Settings → "Delete
|
||||
account". Your row is soft-deleted immediately and hard-deleted 30
|
||||
days later (kept briefly in case of accidental clicks).</li>
|
||||
<li><strong>Question</strong>: email
|
||||
<a href="mailto:privacy@gg.k4scloud.com" class="text-brand-400">privacy@gg.k4scloud.com</a>.</li>
|
||||
</ul>
|
||||
|
||||
<h2 class="mt-6 text-lg font-semibold text-zinc-100">Sub-processors</h2>
|
||||
<p>We use these third parties to run the service:</p>
|
||||
<ul class="list-disc pl-6">
|
||||
<li><strong>Stripe</strong> — billing</li>
|
||||
<li><strong>Resend</strong> — transactional email delivery</li>
|
||||
<li><strong>AWS S3</strong> — encrypted database backups</li>
|
||||
</ul>
|
||||
|
||||
<NuxtLink to="/" class="mt-8 inline-block text-sm text-brand-400 hover:text-brand-300">← Back home</NuxtLink>
|
||||
</article>
|
||||
</template>
|
||||
@@ -0,0 +1,73 @@
|
||||
<script setup lang="ts">
|
||||
const auth = useAuth()
|
||||
const route = useRoute()
|
||||
|
||||
const password = ref('')
|
||||
const confirm = ref('')
|
||||
const submitting = ref(false)
|
||||
const done = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
|
||||
const token = computed(() => String(route.params.token || ''))
|
||||
|
||||
async function submit() {
|
||||
error.value = null
|
||||
if (password.value !== confirm.value) {
|
||||
error.value = 'Passwords do not match.'
|
||||
return
|
||||
}
|
||||
submitting.value = true
|
||||
try {
|
||||
await auth.resetPassword(token.value, password.value)
|
||||
done.value = true
|
||||
} catch (e: any) {
|
||||
error.value = e?.data?.error || e?.message || 'Reset failed'
|
||||
} finally {
|
||||
submitting.value = false
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="mx-auto max-w-md py-12">
|
||||
<h1 class="mb-6 text-2xl font-semibold">Choose a new password</h1>
|
||||
|
||||
<div v-if="done" class="card text-sm">
|
||||
<p class="mb-2 font-medium text-brand-300">Password updated.</p>
|
||||
<p class="mb-4 text-zinc-400">All previous sessions have been signed out. Sign in to continue.</p>
|
||||
<NuxtLink to="/login" class="btn-primary w-full">Sign in</NuxtLink>
|
||||
</div>
|
||||
|
||||
<form v-else class="card space-y-4" @submit.prevent="submit">
|
||||
<div>
|
||||
<label class="label">New password</label>
|
||||
<input
|
||||
v-model="password"
|
||||
type="password"
|
||||
class="input"
|
||||
autocomplete="new-password"
|
||||
minlength="8"
|
||||
maxlength="72"
|
||||
required
|
||||
/>
|
||||
<p class="mt-1 text-xs text-zinc-500">At least 8 characters.</p>
|
||||
</div>
|
||||
<div>
|
||||
<label class="label">Confirm password</label>
|
||||
<input
|
||||
v-model="confirm"
|
||||
type="password"
|
||||
class="input"
|
||||
autocomplete="new-password"
|
||||
minlength="8"
|
||||
maxlength="72"
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
<button class="btn-primary w-full" :disabled="submitting || password.length < 8 || !confirm">
|
||||
{{ submitting ? 'Updating…' : 'Update password' }}
|
||||
</button>
|
||||
<p v-if="error" class="text-sm text-red-400">{{ error }}</p>
|
||||
</form>
|
||||
</section>
|
||||
</template>
|
||||
@@ -0,0 +1,90 @@
|
||||
<script setup lang="ts">
|
||||
const auth = useAuth()
|
||||
|
||||
const email = ref('')
|
||||
const name = ref('')
|
||||
const password = ref('')
|
||||
const acceptTerms = ref(false)
|
||||
const submitting = ref(false)
|
||||
const error = ref<string | null>(null)
|
||||
const sent = ref(false)
|
||||
|
||||
async function submit() {
|
||||
error.value = null
|
||||
submitting.value = true
|
||||
try {
|
||||
await auth.signup(email.value, name.value, password.value, acceptTerms.value)
|
||||
sent.value = true
|
||||
} catch (e: any) {
|
||||
error.value = useErrMessage(e, 'Sign-up failed')
|
||||
} finally {
|
||||
submitting.value = false
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="mx-auto max-w-md py-12">
|
||||
<h1 class="mb-2 text-2xl font-semibold">Create your account</h1>
|
||||
<p class="mb-6 text-sm text-zinc-400">Start managing your event guest lists in minutes.</p>
|
||||
|
||||
<div v-if="sent" class="card text-sm">
|
||||
<p class="mb-2 font-medium text-brand-300">Check your inbox.</p>
|
||||
<p class="text-zinc-400">
|
||||
If <span class="text-zinc-200">{{ email }}</span> is reachable, we've sent a verification link.
|
||||
Click it to finish setting up your account.
|
||||
</p>
|
||||
<NuxtLink to="/login" class="btn-ghost mt-4 w-full">Back to sign in</NuxtLink>
|
||||
</div>
|
||||
|
||||
<form v-else class="card space-y-4" @submit.prevent="submit">
|
||||
<div>
|
||||
<label class="label">Name</label>
|
||||
<input v-model="name" type="text" class="input" autocomplete="name" required />
|
||||
</div>
|
||||
<div>
|
||||
<label class="label">Email</label>
|
||||
<input v-model="email" type="email" class="input" autocomplete="email" required />
|
||||
</div>
|
||||
<div>
|
||||
<label class="label">Password</label>
|
||||
<input
|
||||
v-model="password"
|
||||
type="password"
|
||||
class="input"
|
||||
autocomplete="new-password"
|
||||
minlength="8"
|
||||
maxlength="72"
|
||||
required
|
||||
/>
|
||||
<p class="mt-1 text-xs text-zinc-500">At least 8 characters.</p>
|
||||
</div>
|
||||
<label class="flex cursor-pointer items-start gap-2 text-xs text-zinc-400">
|
||||
<input
|
||||
v-model="acceptTerms"
|
||||
type="checkbox"
|
||||
class="mt-0.5 h-4 w-4 cursor-pointer accent-brand-500"
|
||||
required
|
||||
/>
|
||||
<span>
|
||||
I agree to GuestGuard's
|
||||
<NuxtLink to="/terms" target="_blank" class="text-brand-400 hover:text-brand-300">Terms of Service</NuxtLink>
|
||||
and
|
||||
<NuxtLink to="/privacy" target="_blank" class="text-brand-400 hover:text-brand-300">Privacy Policy</NuxtLink>.
|
||||
</span>
|
||||
</label>
|
||||
<button
|
||||
class="btn-primary w-full"
|
||||
:disabled="submitting || !email || !name || password.length < 8 || !acceptTerms"
|
||||
>
|
||||
{{ submitting ? 'Creating…' : 'Create account' }}
|
||||
</button>
|
||||
<p v-if="error" class="text-sm text-red-400">{{ error }}</p>
|
||||
</form>
|
||||
|
||||
<p class="mt-6 text-center text-sm text-zinc-400">
|
||||
Already have an account?
|
||||
<NuxtLink to="/login" class="text-brand-400 hover:text-brand-300">Sign in</NuxtLink>
|
||||
</p>
|
||||
</section>
|
||||
</template>
|
||||
@@ -0,0 +1,50 @@
|
||||
<script setup lang="ts">
|
||||
useHead({ title: 'Terms of service · GuestGuard' })
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<article class="prose prose-invert mx-auto max-w-2xl py-8 text-zinc-300">
|
||||
<h1 class="text-2xl font-semibold text-zinc-100">Terms of service</h1>
|
||||
<p class="text-sm text-zinc-500">Last updated: <strong>placeholder — pending legal review</strong></p>
|
||||
|
||||
<p>
|
||||
Placeholder copy while a lawyer drafts the real document. The points
|
||||
below capture the substance of how we'd like the relationship to
|
||||
work — the binding version will replace this page before public
|
||||
launch.
|
||||
</p>
|
||||
|
||||
<h2 class="mt-6 text-lg font-semibold text-zinc-100">Summary</h2>
|
||||
<ul class="list-disc pl-6">
|
||||
<li>You're responsible for your guest list — make sure you have
|
||||
permission to message the people on it.</li>
|
||||
<li>We're responsible for keeping the service running, your data
|
||||
backed up, and our handling of it transparent (see the privacy
|
||||
page).</li>
|
||||
<li>Either of us can end the relationship — you by deleting your
|
||||
account, us with reasonable notice if we have to wind down.</li>
|
||||
<li>The service is provided "as-is" — we don't promise zero downtime
|
||||
or that no spam-filter on earth will misfilter your invitations.
|
||||
We try hard, but we're not insurers.</li>
|
||||
</ul>
|
||||
|
||||
<h2 class="mt-6 text-lg font-semibold text-zinc-100">Acceptable use</h2>
|
||||
<ul class="list-disc pl-6">
|
||||
<li>Don't use GuestGuard to send unsolicited bulk mail (spam).</li>
|
||||
<li>Don't use it to harass, deceive, or impersonate.</li>
|
||||
<li>Don't poke at the security of the service — if you find a bug,
|
||||
please tell us at
|
||||
<a href="mailto:security@gg.k4scloud.com" class="text-brand-400">security@gg.k4scloud.com</a>.</li>
|
||||
</ul>
|
||||
|
||||
<h2 class="mt-6 text-lg font-semibold text-zinc-100">Payment</h2>
|
||||
<p>
|
||||
Subscriptions auto-renew until cancelled. Cancel any time from
|
||||
Billing → Manage subscription. Refunds: we'll consider them case by
|
||||
case — email
|
||||
<a href="mailto:support@gg.k4scloud.com" class="text-brand-400">support@gg.k4scloud.com</a>.
|
||||
</p>
|
||||
|
||||
<NuxtLink to="/" class="mt-8 inline-block text-sm text-brand-400 hover:text-brand-300">← Back home</NuxtLink>
|
||||
</article>
|
||||
</template>
|
||||
@@ -0,0 +1,69 @@
|
||||
<script setup lang="ts">
|
||||
const route = useRoute()
|
||||
const config = useRuntimeConfig()
|
||||
const apiBase = config.public.apiBase as string
|
||||
|
||||
const token = computed(() => String(route.params.token || ''))
|
||||
const status = ref<'loading' | 'ready' | 'done' | 'error'>('loading')
|
||||
const email = ref('')
|
||||
const error = ref<string | null>(null)
|
||||
const submitting = ref(false)
|
||||
|
||||
onMounted(async () => {
|
||||
try {
|
||||
const r = await $fetch<{ email: string }>(`/unsubscribe/${token.value}`, { baseURL: apiBase })
|
||||
email.value = r.email
|
||||
status.value = 'ready'
|
||||
} catch (e: any) {
|
||||
status.value = 'error'
|
||||
error.value = e?.data?.error || 'This link is invalid or has expired.'
|
||||
}
|
||||
})
|
||||
|
||||
async function confirm() {
|
||||
submitting.value = true
|
||||
error.value = null
|
||||
try {
|
||||
await $fetch(`/unsubscribe/${token.value}`, { baseURL: apiBase, method: 'POST' })
|
||||
status.value = 'done'
|
||||
} catch (e: any) {
|
||||
error.value = e?.data?.error || 'Something went wrong — please try again.'
|
||||
} finally {
|
||||
submitting.value = false
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="mx-auto max-w-md py-12">
|
||||
<h1 class="mb-6 text-2xl font-semibold">Unsubscribe</h1>
|
||||
|
||||
<div v-if="status === 'loading'" class="card text-sm text-zinc-400">Loading…</div>
|
||||
|
||||
<div v-else-if="status === 'ready'" class="card space-y-4 text-sm">
|
||||
<p>You'll stop receiving GuestGuard emails sent to:</p>
|
||||
<p class="font-mono text-zinc-200">{{ email }}</p>
|
||||
<p class="text-zinc-400">
|
||||
This includes RSVPs, reminders, and host messages. Account-related emails
|
||||
(security, password resets) will still reach you.
|
||||
</p>
|
||||
<button class="btn-primary w-full" :disabled="submitting" @click="confirm">
|
||||
{{ submitting ? 'Unsubscribing…' : 'Unsubscribe me' }}
|
||||
</button>
|
||||
<p v-if="error" class="text-sm text-red-400">{{ error }}</p>
|
||||
</div>
|
||||
|
||||
<div v-else-if="status === 'done'" class="card text-sm">
|
||||
<p class="mb-2 font-medium text-brand-300">Done.</p>
|
||||
<p class="text-zinc-400">
|
||||
We've added <span class="text-zinc-200">{{ email }}</span> to our suppression list.
|
||||
Future emails to that address will be silently dropped.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div v-else class="card text-sm">
|
||||
<p class="mb-2 font-medium text-red-400">Can't unsubscribe</p>
|
||||
<p class="text-zinc-400">{{ error }}</p>
|
||||
</div>
|
||||
</section>
|
||||
</template>
|
||||
@@ -0,0 +1,44 @@
|
||||
<script setup lang="ts">
|
||||
const auth = useAuth()
|
||||
const route = useRoute()
|
||||
|
||||
type Status = 'pending' | 'success' | 'error'
|
||||
const status = ref<Status>('pending')
|
||||
const error = ref<string | null>(null)
|
||||
|
||||
onMounted(async () => {
|
||||
const token = route.query.token
|
||||
if (typeof token !== 'string' || !token) {
|
||||
status.value = 'error'
|
||||
error.value = 'Missing verification token.'
|
||||
return
|
||||
}
|
||||
try {
|
||||
await auth.verifyEmail(token)
|
||||
status.value = 'success'
|
||||
} catch (e: any) {
|
||||
status.value = 'error'
|
||||
error.value = e?.data?.error || e?.message || 'Verification failed.'
|
||||
}
|
||||
})
|
||||
</script>
|
||||
|
||||
<template>
|
||||
<section class="mx-auto max-w-md py-12">
|
||||
<h1 class="mb-6 text-2xl font-semibold">Verify your email</h1>
|
||||
|
||||
<div class="card text-sm">
|
||||
<p v-if="status === 'pending'" class="text-zinc-400">Verifying…</p>
|
||||
<template v-else-if="status === 'success'">
|
||||
<p class="mb-3 font-medium text-brand-300">Email verified.</p>
|
||||
<p class="mb-4 text-zinc-400">You can now sign in to your account.</p>
|
||||
<NuxtLink to="/login" class="btn-primary w-full">Sign in</NuxtLink>
|
||||
</template>
|
||||
<template v-else>
|
||||
<p class="mb-3 font-medium text-red-400">We couldn't verify that link.</p>
|
||||
<p class="mb-4 text-zinc-400">{{ error }}</p>
|
||||
<NuxtLink to="/login" class="btn-ghost w-full">Back to sign in</NuxtLink>
|
||||
</template>
|
||||
</div>
|
||||
</section>
|
||||
</template>
|
||||
Reference in New Issue
Block a user