feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.

Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
  password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
  + replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
  /forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
  forgot/reset pages, route-guard middleware.

Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
  404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.

Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
  access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
  clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.

Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
  + unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
  confirmation, reminder. Per-page templates avoid html/template's
  contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
  cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
  signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
  delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
  returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
  tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
  the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.

Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
  decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
  atomic per-batch with dedup on existing emails.

Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
  live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
  country code from full E.164 strings.

Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
  Stripe customer/sub ids). Partial unique index keeps one granting sub
  per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
  ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
  account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
  /webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
  {error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
  usage bars, tier cards), global UpgradeModal triggered by useApi's
  402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.

Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
  fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
  presence, no orphans across 10 FK relationships, email uniqueness,
  single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
  targets, drill instructions, rollback path.

Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
  on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
  tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
  re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
  legal review) copy; footer links; signup terms checkbox; TermsGateModal
  for accounts created before the rollout; export + delete buttons on
  /dashboard/billing.

Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
  TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
  TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
  TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
  TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
  TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
  TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
  TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
  Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
  internal/notification, internal/ratelimit, internal/domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/stripe_webhook.go

@@ -0,0 +1,163 @@
+package api
+
+import (
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/stripe/stripe-go/v82"
+
+	"github.com/alchemistkay/guestguard/internal/billing"
+	"github.com/alchemistkay/guestguard/internal/storage"
+)
+
+// stripeWebhookHandler accepts and verifies Stripe events, then
+// projects subscription lifecycle changes onto the subscriptions table.
+// We track only what middleware needs to decide access — tier + status +
+// period bounds. Invoice events (payment failed / succeeded) are logged
+// for observability; dunning automation lands in Block F3.
+type stripeWebhookHandler struct {
+	logger *slog.Logger
+	stripe *billing.Client
+	subs   *storage.SubscriptionRepo
+}
+
+// POST /webhooks/stripe — signature-verified Stripe event sink.
+func (h *stripeWebhookHandler) handle(w http.ResponseWriter, r *http.Request) {
+	if h.stripe == nil || !h.stripe.Enabled() {
+		// Not configured on this instance — reject so a misrouted event
+		// isn't silently swallowed. Stripe will retry which is harmless.
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return
+	}
+
+	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "read body")
+		return
+	}
+	defer r.Body.Close()
+
+	event, err := h.stripe.VerifyWebhook(body, r.Header.Get("Stripe-Signature"))
+	if err != nil {
+		h.logger.Warn("stripe webhook signature failed", "err", err)
+		writeError(w, http.StatusBadRequest, "invalid signature")
+		return
+	}
+
+	switch event.Type {
+	case "customer.subscription.created", "customer.subscription.updated":
+		h.applySubscription(r, event)
+	case "customer.subscription.deleted":
+		h.applySubscriptionDeleted(r, event)
+	case "invoice.payment_succeeded":
+		// Clear past_due if Stripe says payment caught up. Most flows are
+		// already covered by the subscription.updated event Stripe also
+		// fires — this is belt-and-braces.
+		h.applySubscription(r, event)
+	case "invoice.payment_failed":
+		h.logger.Warn("stripe invoice payment failed", "event_id", event.ID)
+		// Subscription.status will flip to past_due via the
+		// subscription.updated event Stripe fires alongside.
+	default:
+		h.logger.Debug("stripe event ignored", "type", event.Type)
+	}
+
+	w.WriteHeader(http.StatusOK)
+}
+
+// applySubscription patches the subscriptions row keyed by Stripe
+// customer id. Best-effort — failures here are logged but don't NACK
+// the webhook (Stripe would retry forever and the row would never
+// converge).
+func (h *stripeWebhookHandler) applySubscription(r *http.Request, event stripe.Event) {
+	var sub stripe.Subscription
+	if err := json.Unmarshal(event.Data.Raw, &sub); err != nil {
+		// Some invoice events carry an Invoice payload — try to extract
+		// the subscription id from there and short-circuit on status.
+		h.logger.Debug("stripe webhook: not a subscription payload", "type", event.Type, "err", err)
+		return
+	}
+	if sub.Customer == nil || sub.Customer.ID == "" {
+		h.logger.Warn("stripe webhook: subscription has no customer", "subscription", sub.ID)
+		return
+	}
+
+	tier := tierFromSubscription(&sub)
+	status := string(sub.Status)
+	cancelAtPeriodEnd := sub.CancelAtPeriodEnd
+
+	// As of API 2024-10-28, current_period_end lives on the subscription
+	// item, not the subscription. We pick the earliest item's end — for
+	// single-item subscriptions (our case) that's the canonical one.
+	var periodEnd *time.Time
+	for _, item := range sub.Items.Data {
+		if item.CurrentPeriodEnd > 0 {
+			t := time.Unix(item.CurrentPeriodEnd, 0).UTC()
+			if periodEnd == nil || t.Before(*periodEnd) {
+				periodEnd = &t
+			}
+		}
+	}
+	subID := sub.ID
+	if err := h.subs.UpdateByCustomer(r.Context(), sub.Customer.ID, storage.UpsertParams{
+		StripeSubscriptionID: &subID,
+		Tier:                 stringPtr(string(tier)),
+		Status:               &status,
+		CurrentPeriodEnd:     periodEnd,
+		CancelAtPeriodEnd:    &cancelAtPeriodEnd,
+	}); err != nil {
+		h.logger.Error("stripe webhook: update subscription failed", "err", err)
+	}
+}
+
+func (h *stripeWebhookHandler) applySubscriptionDeleted(r *http.Request, event stripe.Event) {
+	var sub stripe.Subscription
+	if err := json.Unmarshal(event.Data.Raw, &sub); err != nil {
+		h.logger.Warn("stripe webhook: bad deleted payload", "err", err)
+		return
+	}
+	if sub.Customer == nil {
+		return
+	}
+	status := "canceled"
+	if err := h.subs.UpdateByCustomer(r.Context(), sub.Customer.ID, storage.UpsertParams{
+		Status: &status,
+	}); err != nil {
+		h.logger.Error("stripe webhook: mark canceled failed", "err", err)
+	}
+}
+
+// tierFromSubscription inspects the Stripe price metadata to figure out
+// which GuestGuard tier this subscription corresponds to. We read a
+// price-level metadata key `gg_tier` (set in the Stripe dashboard when
+// you create the Price). Fallback: free.
+func tierFromSubscription(sub *stripe.Subscription) billing.Tier {
+	if sub == nil || len(sub.Items.Data) == 0 {
+		return billing.TierFree
+	}
+	for _, item := range sub.Items.Data {
+		if item.Price == nil {
+			continue
+		}
+		if v, ok := item.Price.Metadata["gg_tier"]; ok {
+			t := billing.Tier(v)
+			if t.Valid() {
+				return t
+			}
+		}
+		// Heuristic fallback for tests / unconfigured prices: look at the
+		// recurring interval and amount tier.
+		if item.Price.Recurring != nil && item.Price.UnitAmount >= 19900 {
+			return billing.TierBusiness
+		}
+		if item.Price.Recurring != nil && item.Price.UnitAmount >= 4900 {
+			return billing.TierPro
+		}
+	}
+	return billing.TierFree
+}
+
+func stringPtr(s string) *string { return &s }