feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.

Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
  password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
  + replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
  /forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
  forgot/reset pages, route-guard middleware.

Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
  404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.

Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
  access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
  clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.

Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
  + unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
  confirmation, reminder. Per-page templates avoid html/template's
  contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
  cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
  signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
  delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
  returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
  tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
  the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.

Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
  decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
  atomic per-batch with dedup on existing emails.

Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
  live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
  country code from full E.164 strings.

Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
  Stripe customer/sub ids). Partial unique index keeps one granting sub
  per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
  ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
  account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
  /webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
  {error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
  usage bars, tier cards), global UpgradeModal triggered by useApi's
  402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.

Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
  fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
  presence, no orphans across 10 FK relationships, email uniqueness,
  single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
  targets, drill instructions, rollback path.

Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
  on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
  tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
  re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
  legal review) copy; footer links; signup terms checkbox; TermsGateModal
  for accounts created before the rollout; export + delete buttons on
  /dashboard/billing.

Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
  TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
  TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
  TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
  TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
  TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
  TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
  TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
  Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
  internal/notification, internal/ratelimit, internal/domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/composables/useApi.ts

@@ -1,16 +1,57 @@
 // Typed wrapper around $fetch with the configured API base.
-// Usage: const events = await useApi<EventList>('/events')
+//
+// Adds `Authorization: Bearer <access_token>` when the caller is signed in,
+// and on a 401 transparently asks `/auth/refresh` for a new token and retries
+// once. Failed refresh clears local auth state — pages can rely on the
+// returned error to redirect to /login.
+
 export async function useApi<T = unknown>(
   path: string,
   opts: { method?: string; body?: unknown; query?: Record<string, unknown> } = {},
 ): Promise<T> {
   const config = useRuntimeConfig()
   const base = config.public.apiBase as string
-  return await $fetch<T>(path, {
-    baseURL: base,
-    method: (opts.method ?? 'GET') as any,
-    body: opts.body,
-    query: opts.query,
-    headers: { 'Content-Type': 'application/json' },
-  })
+  const auth = useAuth()
+
+  const request = async (token: string | null): Promise<T> => {
+    const headers: Record<string, string> = {}
+    // Let the browser set Content-Type (with the multipart boundary) when
+    // the body is FormData / Blob; otherwise default to JSON.
+    const isMultipart = typeof FormData !== 'undefined' && opts.body instanceof FormData
+    if (!isMultipart) headers['Content-Type'] = 'application/json'
+    if (token) headers.Authorization = `Bearer ${token}`
+    return await $fetch<T>(path, {
+      baseURL: base,
+      method: (opts.method ?? 'GET') as any,
+      body: opts.body as any,
+      query: opts.query,
+      headers,
+      credentials: 'include',
+    })
+  }
+
+  try {
+    return await request(auth.liveAccessToken())
+  } catch (err: any) {
+    const status = err?.response?.status ?? err?.statusCode
+
+    // 402 Payment Required — plan limit hit. Surface the backend's
+    // upgrade payload on a global state slot; the UpgradeModal in
+    // app.vue reads it and prompts the host to upgrade. We still
+    // rethrow so the caller can stop its own UI flow if it wants.
+    if (status === 402) {
+      const data = err?.data
+      if (data && data.upgrade_url) {
+        useBilling().showUpgradePrompt(data)
+      }
+      throw err
+    }
+
+    if (status !== 401) throw err
+    // /auth/* endpoints set the cookie themselves — never retry-refresh them.
+    if (path.startsWith('/auth/')) throw err
+    const refreshed = await auth.refresh()
+    if (!refreshed) throw err
+    return await request(auth.liveAccessToken())
+  }
 }

frontend/composables/useAuth.ts

@@ -0,0 +1,147 @@
+// Auth state for the host-facing app.
+//
+// The access token lives only in memory (useState — Nuxt's SSR-safe wrapper).
+// The refresh token lives in an HttpOnly cookie set by the API at
+// `/auth/refresh` scope, so JavaScript here can never read it. On a hard
+// reload we lose the access token but the cookie survives, so `bootstrap()`
+// calls `/auth/refresh` to mint a fresh access token + reload the user.
+
+interface AuthUser {
+  id: string
+  email: string
+  name: string
+  email_verified: boolean
+}
+
+interface AuthSuccess {
+  access_token: string
+  expires_at: string
+  user: AuthUser
+}
+
+interface AuthState {
+  user: AuthUser | null
+  accessToken: string | null
+  expiresAt: number | null // unix ms
+  bootstrapped: boolean
+}
+
+function emptyState(): AuthState {
+  return { user: null, accessToken: null, expiresAt: null, bootstrapped: false }
+}
+
+function apiBase(): string {
+  return useRuntimeConfig().public.apiBase as string
+}
+
+async function postJSON<T>(path: string, body?: unknown): Promise<T> {
+  return await $fetch<T>(path, {
+    baseURL: apiBase(),
+    method: 'POST',
+    body,
+    credentials: 'include',
+    headers: { 'Content-Type': 'application/json' },
+  })
+}
+
+export function useAuth() {
+  const state = useState<AuthState>('gg-auth', emptyState)
+
+  function setSession(s: AuthSuccess) {
+    state.value = {
+      user: s.user,
+      accessToken: s.access_token,
+      expiresAt: Date.parse(s.expires_at) || (Date.now() + 14 * 60 * 1000),
+      bootstrapped: true,
+    }
+  }
+
+  function clearSession() {
+    state.value = { ...emptyState(), bootstrapped: true }
+  }
+
+  async function signup(email: string, name: string, password: string, acceptTerms = false) {
+    return await postJSON<{ status: string }>('/auth/signup', {
+      email, name, password,
+      accept_terms: acceptTerms,
+    })
+  }
+
+  async function login(email: string, password: string) {
+    const s = await postJSON<AuthSuccess>('/auth/login', { email, password })
+    setSession(s)
+    return s
+  }
+
+  async function refresh(): Promise<boolean> {
+    try {
+      const s = await postJSON<AuthSuccess>('/auth/refresh')
+      setSession(s)
+      return true
+    } catch {
+      clearSession()
+      return false
+    }
+  }
+
+  async function logout() {
+    try {
+      await postJSON<void>('/auth/logout')
+    } catch {
+      // Best-effort — clear local state regardless.
+    }
+    clearSession()
+  }
+
+  async function verifyEmail(token: string) {
+    return await postJSON<{ status: string }>('/auth/verify-email', { token })
+  }
+
+  async function forgotPassword(email: string) {
+    return await postJSON<{ status: string }>('/auth/forgot-password', { email })
+  }
+
+  async function resetPassword(token: string, newPassword: string) {
+    return await postJSON<{ status: string }>('/auth/reset-password', {
+      token,
+      new_password: newPassword,
+    })
+  }
+
+  // Call on app entry / route guards. Returns true if the caller has a valid
+  // session by the time it resolves.
+  async function bootstrap(): Promise<boolean> {
+    if (!import.meta.client) return false
+    if (state.value.bootstrapped && state.value.user) return true
+    if (state.value.bootstrapped && !state.value.user) return false
+    return await refresh()
+  }
+
+  // Hint to useApi: returns the current token if not yet expired.
+  function liveAccessToken(): string | null {
+    if (!state.value.accessToken || !state.value.expiresAt) return null
+    // 5s skew to avoid sending a just-expired token.
+    if (Date.now() + 5000 >= state.value.expiresAt) return null
+    return state.value.accessToken
+  }
+
+  const isAuthenticated = computed(() => !!state.value.user)
+  const user = computed(() => state.value.user)
+  const bootstrapped = computed(() => state.value.bootstrapped)
+
+  return {
+    user,
+    isAuthenticated,
+    bootstrapped,
+    signup,
+    login,
+    refresh,
+    logout,
+    verifyEmail,
+    forgotPassword,
+    resetPassword,
+    bootstrap,
+    liveAccessToken,
+    clearSession,
+  }
+}

frontend/composables/useBilling.ts

@@ -0,0 +1,151 @@
+// Billing client: fetches subscription status, kicks off checkout/portal
+// flows, and owns the global "upgrade required" prompt shown by the
+// 402 interceptor in useApi. State is shared across components via
+// useState so the prompt can be triggered from any handler.
+
+export interface BillingStatus {
+  tier: 'free' | 'pro' | 'business'
+  status: string
+  current_period_end?: string
+  cancel_at_period_end: boolean
+  limits: {
+    events_per_month: number
+    guests_per_event: number
+  }
+  usage: {
+    events_this_month: number
+  }
+  portal_available: boolean
+}
+
+// UpgradePrompt mirrors the 402 body the backend returns when a limit is
+// hit. Shown globally as a modal until dismissed or acted upon.
+export interface UpgradePrompt {
+  error: string
+  reason: string
+  tier: string
+  used: number
+  limit: number
+  upgrade_url: string
+}
+
+const FREE_DEFAULT: BillingStatus = {
+  tier: 'free',
+  status: 'active',
+  cancel_at_period_end: false,
+  limits: { events_per_month: 1, guests_per_event: 50 },
+  usage: { events_this_month: 0 },
+  portal_available: false,
+}
+
+export function useBilling() {
+  const status = useState<BillingStatus | null>('gg-billing-status', () => null)
+  const loading = useState<boolean>('gg-billing-loading', () => false)
+  const prompt = useState<UpgradePrompt | null>('gg-upgrade-prompt', () => null)
+
+  async function fetchStatus(): Promise<BillingStatus> {
+    loading.value = true
+    try {
+      const res = await useApi<BillingStatus>('/billing/status')
+      status.value = res
+      return res
+    } catch (e: any) {
+      // 401/refresh edge → caller redirected to /login by useApi. If the
+      // backend has billing wired but the response is malformed, fall
+      // back to free defaults so the page renders something usable.
+      status.value = FREE_DEFAULT
+      return FREE_DEFAULT
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function startCheckout(tier: 'pro' | 'business'): Promise<void> {
+    const res = await useApi<{ url: string }>('/billing/checkout-session', {
+      method: 'POST',
+      body: { tier },
+    })
+    if (import.meta.client) window.location.href = res.url
+  }
+
+  async function openPortal(): Promise<void> {
+    const res = await useApi<{ url: string }>('/billing/portal', { method: 'POST' })
+    if (import.meta.client) window.location.href = res.url
+  }
+
+  function showUpgradePrompt(info: UpgradePrompt) {
+    prompt.value = info
+  }
+  function dismissUpgradePrompt() {
+    prompt.value = null
+  }
+
+  return {
+    status,
+    loading,
+    prompt,
+    fetchStatus,
+    startCheckout,
+    openPortal,
+    showUpgradePrompt,
+    dismissUpgradePrompt,
+  }
+}
+
+// Static pricing copy. Keep in sync with internal/billing/tiers.go.
+// One source of truth for the marketing-page-style cards in
+// /dashboard/billing and the UpgradeModal.
+export interface TierCard {
+  id: 'free' | 'pro' | 'business'
+  name: string
+  price: string
+  priceSubtitle: string
+  tagline: string
+  features: string[]
+  highlight?: boolean
+}
+
+export const TIER_CARDS: TierCard[] = [
+  {
+    id: 'free',
+    name: 'Free',
+    price: '$0',
+    priceSubtitle: 'forever',
+    tagline: 'Try GuestGuard with a single event.',
+    features: [
+      '1 event per month',
+      'Up to 50 guests per event',
+      'Branded email invitations',
+      'Real-time RSVP dashboard',
+    ],
+  },
+  {
+    id: 'pro',
+    name: 'Pro',
+    price: '$49',
+    priceSubtitle: 'per month',
+    tagline: 'For active hosts running several events.',
+    features: [
+      '10 events per month',
+      'Up to 1,000 guests per event',
+      'WhatsApp + email invitations',
+      'CSV import + bulk send',
+      'Priority email support',
+    ],
+    highlight: true,
+  },
+  {
+    id: 'business',
+    name: 'Business',
+    price: '$199',
+    priceSubtitle: 'per month',
+    tagline: 'For agencies and corporate events teams.',
+    features: [
+      'Unlimited events',
+      'Up to 5,000 guests per event',
+      'Everything in Pro',
+      'Signed DPA on request',
+      'SLA with response targets',
+    ],
+  },
+]

frontend/composables/useErrMessage.ts

@@ -0,0 +1,28 @@
+// Friendly error messages for API failures, with first-class handling of
+// 429 (rate-limited) and 403 account-lockout responses.
+export function useErrMessage(e: any, fallback = 'Something went wrong'): string {
+  const status: number | undefined = e?.response?.status ?? e?.statusCode
+  const data = e?.data
+  const serverMsg: string | undefined = data?.error
+
+  if (status === 429) {
+    const retry: number | undefined = data?.retry_after
+    if (typeof retry === 'number' && retry > 0) {
+      return `You're going too fast — try again in ${formatSeconds(retry)}.`
+    }
+    return "You're going too fast — please try again in a moment."
+  }
+
+  if (status === 403 && typeof serverMsg === 'string' && serverMsg.toLowerCase().includes('locked')) {
+    return 'Your account is locked after too many failed sign-in attempts. Reset your password to unlock it.'
+  }
+
+  if (serverMsg) return serverMsg
+  return e?.message || fallback
+}
+
+function formatSeconds(s: number): string {
+  if (s < 60) return `${s} second${s === 1 ? '' : 's'}`
+  const m = Math.ceil(s / 60)
+  return `${m} minute${m === 1 ? '' : 's'}`
+}

frontend/composables/useEventWS.ts

@@ -1,7 +1,12 @@
 // Subscribes to /ws/events/:id and emits per-message callbacks.
 //
-// Auto-reconnects with exponential backoff up to 30s. Returns a cleanup
-// fn the caller invokes (e.g. inside onUnmounted).
+// Authenticates via short-lived ticket: before each connect we POST
+// /auth/ws-ticket (bearer-authed) to mint a one-shot ticket, then pass it
+// on the WS handshake as `?ticket=…`. Tickets expire ~60s after mint, so we
+// always mint fresh — even on reconnects.
+//
+// Auto-reconnects with exponential backoff up to 30s. Returns a cleanup fn
+// the caller invokes (e.g. inside onUnmounted).
 
 interface WSMessage {
   type: string
@@ -10,21 +15,46 @@ interface WSMessage {
   timestamp: string
 }
 
+interface WSTicket {
+  ticket: string
+  expires_at: string
+}
+
 export function useEventWS(eventId: string, onMessage: (msg: WSMessage) => void) {
   if (import.meta.server) return () => {}
 
   const config = useRuntimeConfig()
-  const base = (config.public.wsBase as string) || ''
-  const url = `${base}/ws/events/${eventId}`
+  const wsBase = (config.public.wsBase as string) || ''
 
   let ws: WebSocket | null = null
   let attempt = 0
   let stopped = false
   let reconnectTimer: ReturnType<typeof setTimeout> | null = null
 
-  function connect() {
+  async function mintTicket(): Promise<string | null> {
+    try {
+      const t = await useApi<WSTicket>('/auth/ws-ticket', {
+        method: 'POST',
+        body: { event_id: eventId },
+      })
+      return t.ticket
+    } catch {
+      return null
+    }
+  }
+
+  async function connect() {
     if (stopped) return
-    ws = new WebSocket(url)
+    const ticket = await mintTicket()
+    if (stopped) return
+    if (!ticket) {
+      // Couldn't get a ticket (likely 401 — session expired). Back off and
+      // retry; useApi will have already attempted refresh on its own.
+      const backoff = Math.min(30_000, 500 * Math.pow(2, attempt++))
+      reconnectTimer = setTimeout(connect, backoff)
+      return
+    }
+    ws = new WebSocket(`${wsBase}/ws/events/${eventId}?ticket=${encodeURIComponent(ticket)}`)
 
     ws.onopen = () => {
       attempt = 0

frontend/composables/useHost.ts

@@ -1,43 +0,0 @@
-// Demo-grade host bootstrap. Real auth would replace this entirely; for now
-// we upsert by email and stash the host id in localStorage.
-interface User {
-  id: string
-  email: string
-  name: string
-}
-
-const STORAGE_KEY = 'gg.host'
-
-export function useHost() {
-  const host = useState<User | null>('gg-host', () => null)
-
-  if (import.meta.client && !host.value) {
-    const raw = window.localStorage.getItem(STORAGE_KEY)
-    if (raw) {
-      try {
-        host.value = JSON.parse(raw)
-      } catch {
-        window.localStorage.removeItem(STORAGE_KEY)
-      }
-    }
-  }
-
-  async function bootstrap(email: string, name: string) {
-    const u = await useApi<User>('/users', {
-      method: 'POST',
-      body: { email, name },
-    })
-    host.value = u
-    if (import.meta.client) {
-      window.localStorage.setItem(STORAGE_KEY, JSON.stringify(u))
-    }
-    return u
-  }
-
-  function clear() {
-    host.value = null
-    if (import.meta.client) window.localStorage.removeItem(STORAGE_KEY)
-  }
-
-  return { host, bootstrap, clear }
-}