feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The homelab / cloud setup steps (SES verification, restore drill, lawyer- drafted ToS) remain operator-owned but are unblocked. Block A — Authentication - Migration 0003: password_hash, email_verified, email_verification_tokens, password_reset_tokens, refresh_tokens (with replaced_by family chain). - Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation + replay-detection (revokes the family on reuse). - /auth/signup, /login, /refresh, /logout, /verify-email, /forgot-password, /reset-password — enumeration-safe. - requireAuth middleware + GET /me. - Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/ forgot/reset pages, route-guard middleware. Block B — Authorisation - EventRepo.GetForHost; Update/Delete scoped by host_id. - All host routes behind requireAuth + ownership; cross-tenant returns 404 (no enumeration). ?host_id removed. - WS auth via short-lived single-use tickets (POST /auth/ws-ticket). - Tests: TestCrossTenantIsolation — 9 probes. Block C — Rate limiting - Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE). - Per-route limits matching the plan (signup IP, login IP+email, RSVP/ access by token, events/guests/tokens by user_id). - 429 with Retry-After header and JSON body. - Auth lockout: 5 failed logins → account locked, only password reset clears it. - Frontend: useErrMessage normalises 429 + locked messaging. Block D — Real notifications - Migration 0004: provider_message_id, bounce_type, complained columns + unsubscribes (CITEXT) suppression table. - Branded HTML + plaintext templates for verification, reset, invitation, confirmation, reminder. Per-page templates avoid html/template's contextual-escape collisions. - Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP. - PickEmailSender priority Resend > SMTP > SES > Log — system boots cleanly in dev with Mailpit; production flips one env var. - Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression; signature verification stubbed pending creds. - Auto-send: POST /tokens publishes invitation.send; notifier renders + delivers via the configured backend; suppression list honoured. - Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk returns per-guest tokens so phone-only guests can be SMS'd manually. - Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page. - WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress tracking, isLikelyE164 validation, edit-from-wizard. - Token rotate (POST /tokens/rotate) invalidates the old URL — used by the regenerate-link flow. - Mailpit added to docker-compose for dev inbox. Block E — CSV import - Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE decoding, row-level validation, 5,000-row cap. - Strict E.164 phone validation with helpful error message. - POST /preview + /import + GET /template; preview UI on event page; atomic per-batch with dedup on existing emails. Phone capture across UI - PhoneInput component: country picker (~50 ISO codes) + national input + live E.164 preview + inline length validation. - Used in Add Guest and Edit Guest modals. Smart paste-handling extracts country code from full E.164 strings. Block F — Billing (Stripe) - Migration 0005: subscriptions table (user_id → tier/status/period_end + Stripe customer/sub ids). Partial unique index keeps one granting sub per user. - internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer account API versions. - /billing/checkout-session, /billing/portal, /billing/status, /webhooks/stripe (signature-verified, lifecycle events). - Tier enforcement: 402 on POST /events, /guests, /import with {error, reason, tier, used, limit, upgrade_url} body. - Frontend: useBilling composable, /dashboard/billing page (current plan, usage bars, tier cards), global UpgradeModal triggered by useApi's 402 interceptor. - Customer portal kept for self-service cancel/payment-method changes. Block G — Backups & DR (application side) - Every migration has a tested .down.sql. - TestMigrationRoundtrip applies all ups → all downs → all ups against a fresh container; catches asymmetric down migrations. - cmd/restore-verify: 28-check post-restore invariant tool (schema presence, no orphans across 10 FK relationships, email uniqueness, single-active subscription, row-count snapshot). - docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO targets, drill instructions, rollback path. Block H — Privacy compliance (application side) - Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at on users. Partial index on email for live-only uniqueness. - GET /me/data-export — synchronous JSON dump (user, events, guests, tokens, rsvps, access_logs, notifications). - DELETE /me — soft-delete with PII scrub + refresh-token revocation; re-signup with same email works. - POST /me/accept-terms — idempotent consent recording. - Frontend /privacy + /terms placeholder pages with substantive (pending legal review) copy; footer links; signup terms checkbox; TermsGateModal for accounts created before the rollout; export + delete buttons on /dashboard/billing. Tests - All migrations verified up/down/up. - Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation, TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow, TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow, TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset, TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation, TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit, TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits, TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip. Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit. - Unit suite green across internal/auth, internal/csvimport, internal/notification, internal/ratelimit, internal/domain. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-16 23:54:22 +01:00
parent a0ed34f860
commit 59b8781659
124 changed files with 13702 additions and 445 deletions
@@ -0,0 +1,238 @@
+package notification
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net"
+	"net/smtp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// SMTPConfig describes one SMTP relay. Username/Password are optional —
+// local relays like Mailpit accept anonymous SMTP. TLS modes:
+//
+//   - "starttls"  upgrade after EHLO (most relays, default)
+//   - "implicit"  TLS handshake before SMTP (port 465)
+//   - "none"      plain socket — only acceptable on a trusted LAN
+type SMTPConfig struct {
+	Host      string
+	Port      int
+	Username  string
+	Password  string
+	FromEmail string
+	FromName  string
+	TLS       string
+}
+
+// SMTPEmailSender implements auth.EmailSender (verification/reset) AND
+// GuestEmailDispatcher (invitation/confirmation/reminder) on top of any
+// SMTP relay. Used for Mailpit in dev; works against Gmail, Fastmail, etc.
+// in production if the user prefers plain SMTP over an HTTP API.
+type SMTPEmailSender struct {
+	cfg  SMTPConfig
+	tpls *Templates
+	from string
+}
+
+func NewSMTPEmailSender(cfg SMTPConfig, tpls *Templates) (*SMTPEmailSender, error) {
+	if cfg.Host == "" {
+		return nil, errors.New("smtp: Host required")
+	}
+	if cfg.Port <= 0 {
+		cfg.Port = 587
+	}
+	if cfg.FromEmail == "" {
+		return nil, errors.New("smtp: FromEmail required")
+	}
+	if cfg.TLS == "" {
+		cfg.TLS = "starttls"
+	}
+	from := cfg.FromEmail
+	if cfg.FromName != "" {
+		from = fmt.Sprintf("%s <%s>", cfg.FromName, cfg.FromEmail)
+	}
+	return &SMTPEmailSender{cfg: cfg, tpls: tpls, from: from}, nil
+}
+
+// --- auth.EmailSender ---
+
+func (s *SMTPEmailSender) SendVerification(ctx context.Context, to, name, link string) error {
+	return s.sendTemplated(ctx, to, "Verify your GuestGuard email",
+		TmplVerification, map[string]any{"Name": name, "Link": link})
+}
+
+func (s *SMTPEmailSender) SendPasswordReset(ctx context.Context, to, name, link string) error {
+	return s.sendTemplated(ctx, to, "Reset your GuestGuard password",
+		TmplPasswordReset, map[string]any{"Name": name, "Link": link, "ExpiryHumane": "1 hour"})
+}
+
+// --- GuestEmailDispatcher ---
+
+func (s *SMTPEmailSender) SendGuest(ctx context.Context, to, subject string, name TemplateName, data map[string]any) (string, error) {
+	return s.sendTemplatedReturnID(ctx, to, subject, name, data)
+}
+
+// --- internals ---
+
+func (s *SMTPEmailSender) sendTemplated(ctx context.Context, to, subject string, name TemplateName, data map[string]any) error {
+	_, err := s.sendTemplatedReturnID(ctx, to, subject, name, data)
+	return err
+}
+
+func (s *SMTPEmailSender) sendTemplatedReturnID(ctx context.Context, to, subject string, name TemplateName, data map[string]any) (string, error) {
+	if data == nil {
+		data = map[string]any{}
+	}
+	data["Subject"] = subject
+	html, text, err := s.tpls.Render(name, data)
+	if err != nil {
+		return "", err
+	}
+	msgID := generateMessageID(s.cfg.FromEmail)
+	body := buildMIMEMessage(mimeMessage{
+		MessageID: msgID,
+		From:      s.from,
+		To:        to,
+		Subject:   subject,
+		Text:      text,
+		HTML:      html,
+	})
+	if err := s.dial(ctx, []string{to}, body); err != nil {
+		return "", err
+	}
+	return msgID, nil
+}
+
+func (s *SMTPEmailSender) dial(ctx context.Context, to []string, body []byte) error {
+	addr := net.JoinHostPort(s.cfg.Host, strconv.Itoa(s.cfg.Port))
+	d := &net.Dialer{Timeout: 10 * time.Second}
+	deadline, ok := ctx.Deadline()
+	if ok {
+		d.Deadline = deadline
+	}
+
+	var (
+		conn net.Conn
+		err  error
+	)
+	switch strings.ToLower(s.cfg.TLS) {
+	case "implicit":
+		conn, err = tls.DialWithDialer(d, "tcp", addr, &tls.Config{ServerName: s.cfg.Host})
+	default:
+		conn, err = d.DialContext(ctx, "tcp", addr)
+	}
+	if err != nil {
+		return fmt.Errorf("smtp: dial: %w", err)
+	}
+
+	c, err := smtp.NewClient(conn, s.cfg.Host)
+	if err != nil {
+		conn.Close()
+		return fmt.Errorf("smtp: new client: %w", err)
+	}
+	defer c.Close()
+
+	if strings.ToLower(s.cfg.TLS) == "starttls" {
+		if ok, _ := c.Extension("STARTTLS"); ok {
+			if err := c.StartTLS(&tls.Config{ServerName: s.cfg.Host}); err != nil {
+				return fmt.Errorf("smtp: starttls: %w", err)
+			}
+		}
+	}
+
+	if s.cfg.Username != "" {
+		auth := smtp.PlainAuth("", s.cfg.Username, s.cfg.Password, s.cfg.Host)
+		if err := c.Auth(auth); err != nil {
+			return fmt.Errorf("smtp: auth: %w", err)
+		}
+	}
+
+	if err := c.Mail(s.cfg.FromEmail); err != nil {
+		return fmt.Errorf("smtp: MAIL FROM: %w", err)
+	}
+	for _, rcpt := range to {
+		if err := c.Rcpt(rcpt); err != nil {
+			return fmt.Errorf("smtp: RCPT TO %s: %w", rcpt, err)
+		}
+	}
+	w, err := c.Data()
+	if err != nil {
+		return fmt.Errorf("smtp: DATA: %w", err)
+	}
+	if _, err := w.Write(body); err != nil {
+		_ = w.Close()
+		return fmt.Errorf("smtp: write body: %w", err)
+	}
+	if err := w.Close(); err != nil {
+		return fmt.Errorf("smtp: close body: %w", err)
+	}
+	return c.Quit()
+}
+
+type mimeMessage struct {
+	MessageID string
+	From      string
+	To        string
+	Subject   string
+	Text      string
+	HTML      string
+}
+
+// buildMIMEMessage assembles an RFC 5322 message with a multipart/alternative
+// body so receiving clients pick HTML when they can and fall back to text
+// otherwise.
+func buildMIMEMessage(m mimeMessage) []byte {
+	boundary := randomBoundary()
+	var b strings.Builder
+	b.WriteString("Message-ID: <" + m.MessageID + ">\r\n")
+	b.WriteString("Date: " + time.Now().UTC().Format(time.RFC1123Z) + "\r\n")
+	b.WriteString("From: " + m.From + "\r\n")
+	b.WriteString("To: " + m.To + "\r\n")
+	b.WriteString("Subject: " + m.Subject + "\r\n")
+	b.WriteString("MIME-Version: 1.0\r\n")
+	b.WriteString("Content-Type: multipart/alternative; boundary=" + boundary + "\r\n")
+	b.WriteString("\r\n")
+
+	b.WriteString("--" + boundary + "\r\n")
+	b.WriteString("Content-Type: text/plain; charset=UTF-8\r\n")
+	b.WriteString("Content-Transfer-Encoding: 8bit\r\n")
+	b.WriteString("\r\n")
+	b.WriteString(m.Text)
+	if !strings.HasSuffix(m.Text, "\n") {
+		b.WriteString("\r\n")
+	}
+
+	b.WriteString("--" + boundary + "\r\n")
+	b.WriteString("Content-Type: text/html; charset=UTF-8\r\n")
+	b.WriteString("Content-Transfer-Encoding: 8bit\r\n")
+	b.WriteString("\r\n")
+	b.WriteString(m.HTML)
+	if !strings.HasSuffix(m.HTML, "\n") {
+		b.WriteString("\r\n")
+	}
+
+	b.WriteString("--" + boundary + "--\r\n")
+	return []byte(b.String())
+}
+
+func randomBoundary() string {
+	var buf [16]byte
+	_, _ = rand.Read(buf[:])
+	return "gg=" + hex.EncodeToString(buf[:])
+}
+
+func generateMessageID(from string) string {
+	var buf [12]byte
+	_, _ = rand.Read(buf[:])
+	domain := "guestguard.local"
+	if at := strings.LastIndexByte(from, '@'); at >= 0 && at+1 < len(from) {
+		domain = from[at+1:]
+	}
+	return hex.EncodeToString(buf[:]) + "@" + domain
+}