feat: ship Tier 1 — auth, authz, rate limits, real notifications, CSV import, billing, backups/DR, privacy
Closes every block in docs/TIER1_PLAN.md from the Claude-scope side. The
homelab / cloud setup steps (SES verification, restore drill, lawyer-
drafted ToS) remain operator-owned but are unblocked.
Block A — Authentication
- Migration 0003: password_hash, email_verified, email_verification_tokens,
password_reset_tokens, refresh_tokens (with replaced_by family chain).
- Bcrypt hasher, HS256 JWT signer, single-use refresh tokens with rotation
+ replay-detection (revokes the family on reuse).
- /auth/signup, /login, /refresh, /logout, /verify-email,
/forgot-password, /reset-password — enumeration-safe.
- requireAuth middleware + GET /me.
- Frontend useAuth/useApi with auto-refresh-on-401, login/signup/verify/
forgot/reset pages, route-guard middleware.
Block B — Authorisation
- EventRepo.GetForHost; Update/Delete scoped by host_id.
- All host routes behind requireAuth + ownership; cross-tenant returns
404 (no enumeration). ?host_id removed.
- WS auth via short-lived single-use tickets (POST /auth/ws-ticket).
- Tests: TestCrossTenantIsolation — 9 probes.
Block C — Rate limiting
- Redis sliding-window via Lua (atomic ZADD+ZCARD+PEXPIRE).
- Per-route limits matching the plan (signup IP, login IP+email, RSVP/
access by token, events/guests/tokens by user_id).
- 429 with Retry-After header and JSON body.
- Auth lockout: 5 failed logins → account locked, only password reset
clears it.
- Frontend: useErrMessage normalises 429 + locked messaging.
Block D — Real notifications
- Migration 0004: provider_message_id, bounce_type, complained columns
+ unsubscribes (CITEXT) suppression table.
- Branded HTML + plaintext templates for verification, reset, invitation,
confirmation, reminder. Per-page templates avoid html/template's
contextual-escape collisions.
- Senders: SESv2, Twilio (SMS), SMTP (Mailpit-friendly), Resend HTTP.
- PickEmailSender priority Resend > SMTP > SES > Log — system boots
cleanly in dev with Mailpit; production flips one env var.
- Webhook endpoints (Twilio status + SES SNS) — bounces add to suppression;
signature verification stubbed pending creds.
- Auto-send: POST /tokens publishes invitation.send; notifier renders +
delivers via the configured backend; suppression list honoured.
- Bulk + per-row invitation flow: POST /events/{id}/guests/invitations/bulk
returns per-guest tokens so phone-only guests can be SMS'd manually.
- Unsubscribe: signed HMAC token (no TTL) + /unsubscribe/[token] page.
- WhatsApp Option A+: wa.me click-to-chat wizard with per-guest progress
tracking, isLikelyE164 validation, edit-from-wizard.
- Token rotate (POST /tokens/rotate) invalidates the old URL — used by
the regenerate-link flow.
- Mailpit added to docker-compose for dev inbox.
Block E — CSV import
- Streaming parser: tolerant header detection, UTF-8 BOM + UTF-16 LE/BE
decoding, row-level validation, 5,000-row cap.
- Strict E.164 phone validation with helpful error message.
- POST /preview + /import + GET /template; preview UI on event page;
atomic per-batch with dedup on existing emails.
Phone capture across UI
- PhoneInput component: country picker (~50 ISO codes) + national input +
live E.164 preview + inline length validation.
- Used in Add Guest and Edit Guest modals. Smart paste-handling extracts
country code from full E.164 strings.
Block F — Billing (Stripe)
- Migration 0005: subscriptions table (user_id → tier/status/period_end +
Stripe customer/sub ids). Partial unique index keeps one granting sub
per user.
- internal/billing: Tier + Limits model (Free 1/50, Pro 10/1000, Business
∞/5000), Stripe SDK wrapper with IgnoreAPIVersionMismatch for newer
account API versions.
- /billing/checkout-session, /billing/portal, /billing/status,
/webhooks/stripe (signature-verified, lifecycle events).
- Tier enforcement: 402 on POST /events, /guests, /import with
{error, reason, tier, used, limit, upgrade_url} body.
- Frontend: useBilling composable, /dashboard/billing page (current plan,
usage bars, tier cards), global UpgradeModal triggered by useApi's
402 interceptor.
- Customer portal kept for self-service cancel/payment-method changes.
Block G — Backups & DR (application side)
- Every migration has a tested .down.sql.
- TestMigrationRoundtrip applies all ups → all downs → all ups against a
fresh container; catches asymmetric down migrations.
- cmd/restore-verify: 28-check post-restore invariant tool (schema
presence, no orphans across 10 FK relationships, email uniqueness,
single-active subscription, row-count snapshot).
- docs/RUNBOOK_RESTORE.md: 9-step restore procedure with RTO/RPO
targets, drill instructions, rollback path.
Block H — Privacy compliance (application side)
- Migration 0006: deleted_at + terms_accepted_at + privacy_policy_accepted_at
on users. Partial index on email for live-only uniqueness.
- GET /me/data-export — synchronous JSON dump (user, events, guests,
tokens, rsvps, access_logs, notifications).
- DELETE /me — soft-delete with PII scrub + refresh-token revocation;
re-signup with same email works.
- POST /me/accept-terms — idempotent consent recording.
- Frontend /privacy + /terms placeholder pages with substantive (pending
legal review) copy; footer links; signup terms checkbox; TermsGateModal
for accounts created before the rollout; export + delete buttons on
/dashboard/billing.
Tests
- All migrations verified up/down/up.
- Integration suite: TestE2EHappyPath, TestAuthFlow, TestCrossTenantIsolation,
TestRateLimitSignup, TestLoginLockout, TestUnsubscribeFlow,
TestSESBounceWebhook, TestTwilioStatusWebhook, TestCsvImportFlow,
TestCsvImportAtomicRollback, TestBulkIssueInvitations, TestBulkIssueExplicitSubset,
TestTokenIssuePublishesInvitation, TestTokenIssueWithoutGuestEmailSkipsInvitation,
TestGuestUpdate, TestGuestDelete, TestTokenRotate, TestSMTPSenderAgainstMailpit,
TestFreeTierEventLimit, TestFreeTierGuestLimit, TestBusinessTierBypassesLimits,
TestDataExport, TestDeleteMe, TestAcceptTerms, TestMigrationRoundtrip.
Full suite runs in ~120s against real Postgres + NATS + Redis + Mailpit.
- Unit suite green across internal/auth, internal/csvimport,
internal/notification, internal/ratelimit, internal/domain.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Kwaku Danso
@@ -0,0 +1,213 @@
|
||||
//go:build integration
|
||||
|
||||
package integration_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
||||
// TestDataExport confirms GET /me/data-export returns a JSON payload
|
||||
// containing the user + their events + nested records, and rejects
|
||||
// unauthenticated callers.
|
||||
func TestDataExport(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test in -short mode")
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
|
||||
t.Cleanup(cancel)
|
||||
|
||||
srv, _, hostID, token := setupAuthedAPI(t, ctx)
|
||||
eventID := createEvent(t, srv.URL, token, "Export Event", "export-event")
|
||||
guestID, _ := createGuestWithEmail(t, srv.URL, token, eventID, "Export Guest")
|
||||
_ = issueToken(t, srv.URL, token, eventID, guestID)
|
||||
|
||||
// Unauthenticated → 401.
|
||||
resp, err := http.Get(srv.URL + "/me/data-export")
|
||||
must(t, err, "GET unauthed")
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusUnauthorized {
|
||||
t.Fatalf("unauthed export should 401, got %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// Authed → JSON dump with the expected shape.
|
||||
req, _ := http.NewRequest(http.MethodGet, srv.URL+"/me/data-export", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
resp, err = http.DefaultClient.Do(req)
|
||||
must(t, err, "GET authed")
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
t.Fatalf("authed export status=%d body=%s", resp.StatusCode, body)
|
||||
}
|
||||
if cd := resp.Header.Get("Content-Disposition"); cd == "" {
|
||||
t.Errorf("missing Content-Disposition header — browser won't offer download")
|
||||
}
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
|
||||
var out struct {
|
||||
Format string `json:"format"`
|
||||
User struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
Email string `json:"email"`
|
||||
} `json:"user"`
|
||||
Events []struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
} `json:"events"`
|
||||
Guests []struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
} `json:"guests"`
|
||||
Tokens []struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
} `json:"tokens"`
|
||||
}
|
||||
must(t, json.Unmarshal(body, &out), "decode export")
|
||||
|
||||
if out.Format != "guestguard.v1" {
|
||||
t.Errorf("format: got %q want guestguard.v1", out.Format)
|
||||
}
|
||||
if out.User.ID.String() != uuid.UUID(hostID).String() {
|
||||
t.Errorf("user id mismatch: got %s want %s", out.User.ID, uuid.UUID(hostID))
|
||||
}
|
||||
if len(out.Events) != 1 || out.Events[0].ID != eventID {
|
||||
t.Errorf("events: got %d entries, want 1 for the seeded event", len(out.Events))
|
||||
}
|
||||
if len(out.Guests) != 1 || out.Guests[0].ID != guestID {
|
||||
t.Errorf("guests: got %d entries, want 1", len(out.Guests))
|
||||
}
|
||||
if len(out.Tokens) != 1 {
|
||||
t.Errorf("tokens: got %d entries, want 1 (issued one above)", len(out.Tokens))
|
||||
}
|
||||
}
|
||||
|
||||
// TestDeleteMe walks the soft-delete flow: account row gets tombstoned,
|
||||
// subsequent /me requests fail because the user is no longer findable,
|
||||
// and re-signup with the same email succeeds (proves the unique index
|
||||
// only constrains live users).
|
||||
func TestDeleteMe(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test in -short mode")
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
|
||||
t.Cleanup(cancel)
|
||||
|
||||
srv, db, hostID, token := setupAuthedAPI(t, ctx)
|
||||
// Capture the original email so we can prove the tombstone scrubbed it.
|
||||
var originalEmail string
|
||||
must(t, db.Pool.QueryRow(ctx, `SELECT email FROM users WHERE id = $1`, uuid.UUID(hostID)).Scan(&originalEmail),
|
||||
"fetch original email")
|
||||
|
||||
// Hit DELETE /me.
|
||||
req, _ := http.NewRequest(http.MethodDelete, srv.URL+"/me", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
must(t, err, "DELETE /me")
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusNoContent {
|
||||
t.Fatalf("DELETE /me status=%d want 204", resp.StatusCode)
|
||||
}
|
||||
|
||||
// DB: row is soft-deleted with PII scrubbed.
|
||||
var deletedAt *time.Time
|
||||
var emailAfter, nameAfter string
|
||||
must(t, db.Pool.QueryRow(ctx,
|
||||
`SELECT deleted_at, email, name FROM users WHERE id = $1`, uuid.UUID(hostID),
|
||||
).Scan(&deletedAt, &emailAfter, &nameAfter), "fetch after delete")
|
||||
if deletedAt == nil {
|
||||
t.Fatal("expected deleted_at set")
|
||||
}
|
||||
if emailAfter == originalEmail {
|
||||
t.Errorf("expected email scrubbed, got %q", emailAfter)
|
||||
}
|
||||
if nameAfter != "Deleted user" {
|
||||
t.Errorf("expected name='Deleted user', got %q", nameAfter)
|
||||
}
|
||||
|
||||
// API: subsequent /me with the same JWT returns 401 (user not found
|
||||
// by GetByID since it filters on deleted_at).
|
||||
req, _ = http.NewRequest(http.MethodGet, srv.URL+"/me", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
resp, err = http.DefaultClient.Do(req)
|
||||
must(t, err, "GET /me after delete")
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusUnauthorized {
|
||||
t.Fatalf("post-delete /me should 401, got %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// Re-signup with the ORIGINAL email succeeds because the unique
|
||||
// index is partial — soft-deleted rows don't block new accounts.
|
||||
body := fmt.Sprintf(`{"email":%q,"name":"New owner","password":"correct-horse","accept_terms":true}`, originalEmail)
|
||||
resp, err = http.Post(srv.URL+"/auth/signup", "application/json", stringReader(body))
|
||||
must(t, err, "POST /auth/signup after delete")
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusCreated {
|
||||
t.Fatalf("re-signup status=%d (expected 201 — soft-deleted shouldn't block new signups)", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
// TestAcceptTerms confirms a user created without terms acceptance can
|
||||
// record it post-hoc via POST /me/accept-terms.
|
||||
func TestAcceptTerms(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test in -short mode")
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
|
||||
t.Cleanup(cancel)
|
||||
|
||||
srv, db, hostID, token := setupAuthedAPI(t, ctx)
|
||||
|
||||
// insertHost (in e2e_test.go) doesn't set the terms columns, so a
|
||||
// fresh host starts with NULLs. Confirm.
|
||||
var acceptedAt *time.Time
|
||||
must(t, db.Pool.QueryRow(ctx,
|
||||
`SELECT terms_accepted_at FROM users WHERE id = $1`, uuid.UUID(hostID),
|
||||
).Scan(&acceptedAt), "fetch pre")
|
||||
if acceptedAt != nil {
|
||||
t.Fatal("setup: expected fresh host to have no terms_accepted_at")
|
||||
}
|
||||
|
||||
// Hit the endpoint.
|
||||
req, _ := http.NewRequest(http.MethodPost, srv.URL+"/me/accept-terms", nil)
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
must(t, err, "POST /me/accept-terms")
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("accept-terms status=%d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// DB: timestamps now set on both columns.
|
||||
var terms, privacy *time.Time
|
||||
must(t, db.Pool.QueryRow(ctx,
|
||||
`SELECT terms_accepted_at, privacy_policy_accepted_at FROM users WHERE id = $1`, uuid.UUID(hostID),
|
||||
).Scan(&terms, &privacy), "fetch post")
|
||||
if terms == nil || privacy == nil {
|
||||
t.Errorf("expected both timestamps set: terms=%v privacy=%v", terms, privacy)
|
||||
}
|
||||
}
|
||||
|
||||
func stringReader(s string) *stringReadCloser {
|
||||
return &stringReadCloser{s: s}
|
||||
}
|
||||
|
||||
type stringReadCloser struct {
|
||||
s string
|
||||
pos int
|
||||
}
|
||||
|
||||
func (r *stringReadCloser) Read(p []byte) (int, error) {
|
||||
if r.pos >= len(r.s) {
|
||||
return 0, io.EOF
|
||||
}
|
||||
n := copy(p, r.s[r.pos:])
|
||||
r.pos += n
|
||||
return n, nil
|
||||
}
|
||||
func (r *stringReadCloser) Close() error { return nil }
|
||||
Reference in New Issue
Block a user