feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy

Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.

Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
  password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
  + replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
  /forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
  forgot/reset pages, route-guard middleware.

Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
  404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.

Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
  access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
  clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.

Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
  + unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
  confirmation, reminder. Per-page templates avoid html/template's
  contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
  cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
  signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
  delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
  returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
  tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
  the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.

Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
  decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
  atomic per-batch with dedup on existing emails.

Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
  live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
  country code from full E.164 strings.

Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
  Stripe customer/sub ids). Partial unique index keeps one granting sub
  per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
  ∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
  account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
  /webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
  {error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
  usage bars, tier cards), global UpgradeModal triggered by useApi's
  402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.

Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
  fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
  presence, no orphans across 10 FK relationships, email uniqueness,
  single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
  targets, drill instructions, rollback path.

Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
  on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
  tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
  re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
  legal review) copy; footer links; signup terms checkbox; TermsGateModal
  for accounts created before the rollout; export + delete buttons on
  /dashboard/billing.

Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
  TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
  TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
  TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
  TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
  TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
  TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
  TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
  Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
  internal/notification, internal/ratelimit, internal/domain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

test/integration/bulk_invitation_test.go

@@ -0,0 +1,234 @@
+//go:build integration
+
+package integration_test
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/alchemistkay/guestguard/internal/api"
+	"github.com/alchemistkay/guestguard/internal/natspub"
+	"github.com/alchemistkay/guestguard/internal/storage"
+)
+
+// TestBulkIssueInvitations confirms the bulk endpoint:
+//   - mints tokens for guests without one
+//   - skips guests that already have a token
+//   - publishes invitation.send only for guests with an email
+//   - returns an accurate per-bucket summary
+func TestBulkIssueInvitations(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in -short mode")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	t.Cleanup(cancel)
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	dsn := startPostgres(t, ctx)
+	natsURL := startNATS(t, ctx)
+
+	db, err := storage.NewDB(ctx, dsn)
+	must(t, err, "connect db")
+	t.Cleanup(db.Close)
+	must(t, db.Migrate(ctx), "migrate")
+
+	natsClient, err := natspub.Connect(ctx, natsURL, logger)
+	must(t, err, "connect nats")
+	t.Cleanup(natsClient.Close)
+
+	var pubCount atomic.Int32
+	emails := make(chan string, 32)
+	sub, err := natspub.NewInvitationSendSubscriber(ctx, natsClient, "test-bulk-invitation",
+		func(_ context.Context, evt natspub.InvitationSend) error {
+			pubCount.Add(1)
+			select {
+			case emails <- evt.GuestEmail:
+			default:
+			}
+			return nil
+		}, logger)
+	must(t, err, "build subscriber")
+	cc, err := sub.Start(ctx)
+	must(t, err, "start subscriber")
+	t.Cleanup(cc.Stop)
+
+	apiSrv, err := api.NewServer(api.ServerDeps{
+		Logger:               logger,
+		DB:                   db,
+		AccessPublisher:      natsClient,
+		RSVPPublisher:        natsClient,
+		InvitationPublisher:  natsClient,
+		TokenTTL:             24 * time.Hour,
+		JWTSecret:            testJWTSecret,
+		JWTIssuer:            testJWTIssuer,
+		AccessTokenTTL:       5 * time.Minute,
+		RefreshTokenTTL:      24 * time.Hour,
+		EmailVerificationTTL: 1 * time.Hour,
+		PasswordResetTTL:     1 * time.Hour,
+		PublicBaseURL:        "https://gg.example.test",
+	})
+	must(t, err, "build api")
+	srv := httptest.NewServer(apiSrv.Handler())
+	t.Cleanup(srv.Close)
+
+	hostID := insertHost(t, ctx, db.Pool)
+	hostToken := issueHostToken(t, hostID)
+	eventID := createEvent(t, srv.URL, hostToken, "Bulk Event", "bulk-event")
+
+	// Three guests with emails, two without.
+	var withEmail []uuid.UUID
+	for i := 0; i < 3; i++ {
+		id, _ := createGuestWithEmail(t, srv.URL, hostToken, eventID, fmt.Sprintf("Email-%d", i))
+		withEmail = append(withEmail, id)
+	}
+	var noEmail []uuid.UUID
+	for i := 0; i < 2; i++ {
+		noEmail = append(noEmail, createGuest(t, srv.URL, hostToken, eventID, fmt.Sprintf("Phone-%d", i)))
+	}
+
+	// Pre-issue one token for the first email guest to test the
+	// skipped_existing path.
+	issueToken(t, srv.URL, hostToken, eventID, withEmail[0])
+
+	// Call bulk endpoint (empty body = "all eligible").
+	var result struct {
+		Issued          int `json:"issued"`
+		Queued          int `json:"queued"`
+		SkippedExisting int `json:"skipped_existing"`
+		SkippedNoEmail  int `json:"skipped_no_email"`
+		Errors          []struct {
+			GuestID string `json:"guest_id"`
+			Reason  string `json:"reason"`
+		} `json:"errors"`
+	}
+	postJSONAuthed(t, fmt.Sprintf("%s/events/%s/guests/invitations/bulk", srv.URL, eventID),
+		hostToken, map[string]any{}, http.StatusOK, &result)
+
+	if result.Issued != 4 {
+		t.Errorf("issued: got %d want 4 (2 emails + 2 no-email; the third email guest was pre-issued)", result.Issued)
+	}
+	if result.Queued != 2 {
+		t.Errorf("queued: got %d want 2", result.Queued)
+	}
+	if result.SkippedExisting != 1 {
+		t.Errorf("skipped_existing: got %d want 1", result.SkippedExisting)
+	}
+	if result.SkippedNoEmail != 2 {
+		t.Errorf("skipped_no_email: got %d want 2", result.SkippedNoEmail)
+	}
+	if len(result.Errors) != 0 {
+		t.Errorf("unexpected errors: %+v", result.Errors)
+	}
+
+	// Wait for the two NATS messages.
+	deadline := time.After(10 * time.Second)
+	received := 0
+loop:
+	for received < 2 {
+		select {
+		case <-emails:
+			received++
+		case <-deadline:
+			break loop
+		}
+	}
+	if received != 2 {
+		t.Fatalf("expected 2 invitation.send messages, got %d", received)
+	}
+
+	// Re-running bulk should be a no-op (everyone now has a token).
+	var second struct {
+		Issued          int `json:"issued"`
+		Queued          int `json:"queued"`
+		SkippedExisting int `json:"skipped_existing"`
+	}
+	postJSONAuthed(t, fmt.Sprintf("%s/events/%s/guests/invitations/bulk", srv.URL, eventID),
+		hostToken, map[string]any{}, http.StatusOK, &second)
+	if second.Issued != 0 || second.Queued != 0 || second.SkippedExisting != 5 {
+		t.Errorf("re-run: got issued=%d queued=%d skipped_existing=%d (want 0/0/5)",
+			second.Issued, second.Queued, second.SkippedExisting)
+	}
+}
+
+// TestBulkIssueExplicitSubset confirms guest_ids is honoured.
+func TestBulkIssueExplicitSubset(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in -short mode")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	t.Cleanup(cancel)
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+
+	dsn := startPostgres(t, ctx)
+	natsURL := startNATS(t, ctx)
+
+	db, err := storage.NewDB(ctx, dsn)
+	must(t, err, "connect db")
+	t.Cleanup(db.Close)
+	must(t, db.Migrate(ctx), "migrate")
+
+	natsClient, err := natspub.Connect(ctx, natsURL, logger)
+	must(t, err, "connect nats")
+	t.Cleanup(natsClient.Close)
+
+	apiSrv, err := api.NewServer(api.ServerDeps{
+		Logger:               logger,
+		DB:                   db,
+		AccessPublisher:      natsClient,
+		RSVPPublisher:        natsClient,
+		InvitationPublisher:  natsClient,
+		TokenTTL:             24 * time.Hour,
+		JWTSecret:            testJWTSecret,
+		JWTIssuer:            testJWTIssuer,
+		AccessTokenTTL:       5 * time.Minute,
+		RefreshTokenTTL:      24 * time.Hour,
+		EmailVerificationTTL: 1 * time.Hour,
+		PasswordResetTTL:     1 * time.Hour,
+		PublicBaseURL:        "https://gg.example.test",
+	})
+	must(t, err, "build api")
+	srv := httptest.NewServer(apiSrv.Handler())
+	t.Cleanup(srv.Close)
+
+	hostID := insertHost(t, ctx, db.Pool)
+	hostToken := issueHostToken(t, hostID)
+	eventID := createEvent(t, srv.URL, hostToken, "Subset Event", "subset-event")
+
+	var ids []uuid.UUID
+	for i := 0; i < 3; i++ {
+		id, _ := createGuestWithEmail(t, srv.URL, hostToken, eventID, fmt.Sprintf("G-%d", i))
+		ids = append(ids, id)
+	}
+
+	// Send to only the middle guest.
+	var result struct {
+		Issued int `json:"issued"`
+		Queued int `json:"queued"`
+	}
+	postJSONAuthed(t,
+		fmt.Sprintf("%s/events/%s/guests/invitations/bulk", srv.URL, eventID),
+		hostToken,
+		map[string]any{"guest_ids": []string{ids[1].String()}},
+		http.StatusOK, &result)
+	if result.Issued != 1 || result.Queued != 1 {
+		t.Fatalf("subset send: got issued=%d queued=%d, want 1/1", result.Issued, result.Queued)
+	}
+
+	// The other two should still be tokenless.
+	var hasToken int
+	must(t, db.Pool.QueryRow(ctx,
+		"SELECT COUNT(*) FROM tokens WHERE guest_id = ANY($1)", []uuid.UUID{ids[0], ids[2]},
+	).Scan(&hasToken), "count tokens for non-targets")
+	if hasToken != 0 {
+		t.Fatalf("expected 0 tokens for non-targets, got %d", hasToken)
+	}
+}