feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy
Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.
Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
+ replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
/forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
forgot/reset pages, route-guard middleware.
Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.
Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.
Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
+ unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
confirmation, reminder. Per-page templates avoid html/template's
contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.
Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
atomic per-batch with dedup on existing emails.
Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
country code from full E.164 strings.
Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
Stripe customer/sub ids). Partial unique index keeps one granting sub
per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
/webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
{error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
usage bars, tier cards), global UpgradeModal triggered by useApi's
402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.
Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
presence, no orphans across 10 FK relationships, email uniqueness,
single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
targets, drill instructions, rollback path.
Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
legal review) copy; footer links; signup terms checkbox; TermsGateModal
for accounts created before the rollout; export + delete buttons on
/dashboard/billing.
Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
internal/notification, internal/ratelimit, internal/domain.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Kwaku Danso
@@ -12,11 +12,56 @@ type Config struct {
|
||||
HTTPAddr string
|
||||
DatabaseURL string
|
||||
NATSURL string
|
||||
RedisAddr string
|
||||
FraudGRPCAddr string
|
||||
FraudGRPCTimeout time.Duration
|
||||
ShutdownTimeout time.Duration
|
||||
TokenSecret string
|
||||
TokenTTL time.Duration
|
||||
|
||||
// Auth
|
||||
JWTSecret string
|
||||
JWTIssuer string
|
||||
AccessTokenTTL time.Duration
|
||||
RefreshTokenTTL time.Duration
|
||||
EmailVerificationTTL time.Duration
|
||||
PasswordResetTTL time.Duration
|
||||
PublicBaseURL string
|
||||
RefreshCookieDomain string
|
||||
RefreshCookieSecure bool
|
||||
|
||||
// Notifications (Block D). Empty values leave the log-stub adapter in
|
||||
// place so the service still boots without AWS / Twilio creds.
|
||||
SESRegion string
|
||||
SESFromEmail string
|
||||
SESFromName string
|
||||
SESConfigurationSet string
|
||||
|
||||
SMTPHost string
|
||||
SMTPPort int
|
||||
SMTPUsername string
|
||||
SMTPPassword string
|
||||
SMTPFromEmail string
|
||||
SMTPFromName string
|
||||
SMTPTLS string // "starttls" | "implicit" | "none" (default starttls)
|
||||
|
||||
ResendAPIKey string
|
||||
ResendFromEmail string
|
||||
ResendFromName string
|
||||
|
||||
TwilioAccountSID string
|
||||
TwilioAuthToken string
|
||||
TwilioFromNumber string
|
||||
|
||||
// Billing (Block F). Empty StripeSecretKey leaves billing disabled —
|
||||
// all users get free-tier limits, /billing/* returns 503. Lets the
|
||||
// service boot in dev without Stripe creds.
|
||||
StripeSecretKey string
|
||||
StripeWebhookSecret string
|
||||
StripePricePro string // Stripe Price ID for Pro monthly
|
||||
StripePriceBusiness string // Stripe Price ID for Business monthly
|
||||
|
||||
UnsubscribeSecret string // HMAC key for signing unsubscribe links
|
||||
}
|
||||
|
||||
func Load() (*Config, error) {
|
||||
@@ -25,11 +70,50 @@ func Load() (*Config, error) {
|
||||
HTTPAddr: getenv("GG_HTTP_ADDR", ":8080"),
|
||||
DatabaseURL: getenv("GG_DATABASE_URL", "postgres://guestguard:guestguard@localhost:5432/guestguard?sslmode=disable"),
|
||||
NATSURL: getenv("GG_NATS_URL", "nats://localhost:4222"),
|
||||
RedisAddr: getenv("GG_REDIS_ADDR", "localhost:6379"),
|
||||
FraudGRPCAddr: getenv("GG_FRAUD_GRPC_ADDR", "fraud-engine:9091"),
|
||||
FraudGRPCTimeout: getenvDuration("GG_FRAUD_GRPC_TIMEOUT", 250*time.Millisecond),
|
||||
ShutdownTimeout: getenvDuration("GG_SHUTDOWN_TIMEOUT", 15*time.Second),
|
||||
TokenSecret: os.Getenv("GG_TOKEN_SECRET"),
|
||||
TokenTTL: getenvDuration("GG_TOKEN_TTL", 30*24*time.Hour),
|
||||
|
||||
JWTSecret: os.Getenv("GG_JWT_SECRET"),
|
||||
JWTIssuer: getenv("GG_JWT_ISSUER", "guestguard"),
|
||||
AccessTokenTTL: getenvDuration("GG_ACCESS_TOKEN_TTL", 15*time.Minute),
|
||||
RefreshTokenTTL: getenvDuration("GG_REFRESH_TOKEN_TTL", 30*24*time.Hour),
|
||||
EmailVerificationTTL: getenvDuration("GG_EMAIL_VERIFICATION_TTL", 24*time.Hour),
|
||||
PasswordResetTTL: getenvDuration("GG_PASSWORD_RESET_TTL", 1*time.Hour),
|
||||
PublicBaseURL: getenv("GG_PUBLIC_BASE_URL", "http://localhost:3000"),
|
||||
RefreshCookieDomain: os.Getenv("GG_REFRESH_COOKIE_DOMAIN"),
|
||||
RefreshCookieSecure: getenvBool("GG_REFRESH_COOKIE_SECURE", false),
|
||||
|
||||
SESRegion: getenv("GG_SES_REGION", "us-east-1"),
|
||||
SESFromEmail: os.Getenv("GG_SES_FROM_EMAIL"),
|
||||
SESFromName: getenv("GG_SES_FROM_NAME", "GuestGuard"),
|
||||
SESConfigurationSet: os.Getenv("GG_SES_CONFIGURATION_SET"),
|
||||
|
||||
SMTPHost: os.Getenv("GG_SMTP_HOST"),
|
||||
SMTPPort: getenvInt("GG_SMTP_PORT", 587),
|
||||
SMTPUsername: os.Getenv("GG_SMTP_USERNAME"),
|
||||
SMTPPassword: os.Getenv("GG_SMTP_PASSWORD"),
|
||||
SMTPFromEmail: os.Getenv("GG_SMTP_FROM_EMAIL"),
|
||||
SMTPFromName: getenv("GG_SMTP_FROM_NAME", "GuestGuard"),
|
||||
SMTPTLS: getenv("GG_SMTP_TLS", "starttls"),
|
||||
|
||||
ResendAPIKey: os.Getenv("GG_RESEND_API_KEY"),
|
||||
ResendFromEmail: os.Getenv("GG_RESEND_FROM_EMAIL"),
|
||||
ResendFromName: getenv("GG_RESEND_FROM_NAME", "GuestGuard"),
|
||||
|
||||
TwilioAccountSID: os.Getenv("GG_TWILIO_ACCOUNT_SID"),
|
||||
TwilioAuthToken: os.Getenv("GG_TWILIO_AUTH_TOKEN"),
|
||||
TwilioFromNumber: os.Getenv("GG_TWILIO_FROM_NUMBER"),
|
||||
|
||||
StripeSecretKey: os.Getenv("GG_STRIPE_SECRET_KEY"),
|
||||
StripeWebhookSecret: os.Getenv("GG_STRIPE_WEBHOOK_SECRET"),
|
||||
StripePricePro: os.Getenv("GG_STRIPE_PRICE_PRO"),
|
||||
StripePriceBusiness: os.Getenv("GG_STRIPE_PRICE_BUSINESS"),
|
||||
|
||||
UnsubscribeSecret: os.Getenv("GG_UNSUBSCRIBE_SECRET"),
|
||||
}
|
||||
|
||||
if cfg.Env == "production" && cfg.TokenSecret == "" {
|
||||
@@ -39,9 +123,52 @@ func Load() (*Config, error) {
|
||||
cfg.TokenSecret = "dev-only-insecure-secret-change-me"
|
||||
}
|
||||
|
||||
if cfg.Env == "production" && cfg.JWTSecret == "" {
|
||||
return nil, fmt.Errorf("GG_JWT_SECRET is required in production")
|
||||
}
|
||||
if cfg.JWTSecret == "" {
|
||||
cfg.JWTSecret = "dev-only-insecure-jwt-secret-change-me-32+bytes"
|
||||
}
|
||||
if len(cfg.JWTSecret) < 32 {
|
||||
return nil, fmt.Errorf("GG_JWT_SECRET must be at least 32 bytes")
|
||||
}
|
||||
|
||||
if cfg.UnsubscribeSecret == "" {
|
||||
// Same dev fallback shape as the other secrets — production refuses
|
||||
// to boot without it.
|
||||
if cfg.Env == "production" {
|
||||
return nil, fmt.Errorf("GG_UNSUBSCRIBE_SECRET is required in production")
|
||||
}
|
||||
cfg.UnsubscribeSecret = "dev-only-insecure-unsubscribe-secret-change-me"
|
||||
}
|
||||
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
func getenvInt(key string, fallback int) int {
|
||||
v, ok := os.LookupEnv(key)
|
||||
if !ok || v == "" {
|
||||
return fallback
|
||||
}
|
||||
n, err := strconv.Atoi(v)
|
||||
if err != nil {
|
||||
return fallback
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func getenvBool(key string, fallback bool) bool {
|
||||
v, ok := os.LookupEnv(key)
|
||||
if !ok || v == "" {
|
||||
return fallback
|
||||
}
|
||||
b, err := strconv.ParseBool(v)
|
||||
if err != nil {
|
||||
return fallback
|
||||
}
|
||||
return b
|
||||
}
|
||||
|
||||
func getenv(key, fallback string) string {
|
||||
if v, ok := os.LookupEnv(key); ok && v != "" {
|
||||
return v
|
||||
|
||||
Reference in New Issue
Block a user