WIP: billing & payments (PARTIAL — agent stopped on credits) - #66
Closed
izzywdev wants to merge 12 commits into
Closed
WIP: billing & payments (PARTIAL — agent stopped on credits)#66izzywdev wants to merge 12 commits into
izzywdev wants to merge 12 commits into
Conversation
Add four new TOPICS constants (BILLING_USAGE_RECORDED, BILLING_SUBSCRIPTION_CHANGED, BILLING_TRIAL_ENDING, BILLING_PAYMENT_FAILED) to shared/src/kafka/types.ts. Add two new Zod payload schemas: - billingUsageRecordedSchemaV1 (entityId uuid, entityType enum, meterEventName, quantity int positive, occurredAt datetime) — no correlationId, it lives on the FuzeEvent envelope. - billingSubscriptionChangedSchemaV1 (entityId uuid, entityType enum, planTier, status, optional seatQuantity int, stripeSubscriptionId) — mirrors Stripe subscription status. Wire both schemas into shared/src/kafka/schemas/index.ts barrel. Add minimal Jest test runner to shared (jest + ts-jest mirroring email-service conventions). 18 new schema-parse tests cover valid parses and invalid rejections (bad uuid, negative quantity, wrong enum, bad datetime, missing required fields). TopicName type widens automatically from the updated TOPICS const — no manual changes needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds the billing-service microservice skeleton under services/billing-service/. Includes TDD health + config tests (5/5 passing), multi-stage Dockerfile (Docker build verified), and lerna.json registration. Deviations from email-service pattern (documented): - @fuzefront/shared uses file:../../shared (not registry version) for local dev without GitHub token — same as provisioning-service - Dockerfile uses `cd X && npm install` instead of `npm ci --workspace=X` because billing-service is not in root workspaces; `npm ci --workspace` fails for services not declared in root package.json workspaces - Shared built with `npm run build:kafka` (not `npm run build`) to avoid socket.io-client / React DOM dep that blocks full-barrel tsc in Docker Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Wrap the callback-based server.close in a Promise so later tasks (Kafka/DB teardown) can sequence async cleanup before process.exit. Addresses T2 review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- src/migrations/001_billing_schema.sql: idempotent DDL for all 5 billing.* tables (customers, subscriptions, stripe_events, usage_events, plans) with FK, UNIQUE constraints, and pgcrypto extension guard - src/db.ts: createPool (pg.Pool factory) + runMigrations (reads + executes SQL) - src/index.ts: call runMigrations at boot, guarded by config.databaseUrl - tests/db.test.ts: SQL-shape assertions (28 passing, no live DB needed) + skipped integration suite for when DATABASE_URL is present Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds four billing hot-path cache columns to both the `users` and `organizations` tables (public schema): - stripe_customer_id TEXT, nullable - billing_plan_tier TEXT NOT NULL DEFAULT 'free' - billing_plan_status TEXT NOT NULL DEFAULT 'active' - trial_ends_at TIMESTAMPTZ, nullable Each column addition is guarded with hasColumn so the migration is idempotent. down() drops all eight columns with matching guards. Added to both backend/src/migrations/ and backend/security/src/migrations/ (byte-identical) per the dual-location lock-step policy (001–010 identical across both dirs). Extended the security migration integration test to assert all 8 billing columns exist with correct nullability and defaults after the chain runs. The test skips cleanly when Postgres is unreachable (CI-safe). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
izzywdev
force-pushed
the
feature/billing-payments
branch
from
June 21, 2026 20:30
af5d0b7 to
c28c7f6
Compare
Contributor
CI failure root cause — Playwright sign-in flowRoot cause: The Postgres service health check in The health check is: --health-cmd "pg_isready -U fuzeinfra"When on every health-check interval, the container is marked unhealthy after 5 retries, and the entire job is aborted before the backend even starts. This bug was introduced by commit 5166412 (PR #48) when Fix — one character change in - --health-cmd "pg_isready -U fuzeinfra"
+ --health-cmd "pg_isready -U fuzeinfra -d fuzefront_platform"I prepared this fix on branch |
Contributor
CI Fix InvestigationRoot cause:
The Fix: Ran The fix is on branch 🤖 Generated with Claude Code |
…es, kafka, helm/values, release wiring (incomplete; types pending) [skip ci]
… validation, dockerignore Resolves the salvage checkpoint's "types pending" item. The billing-service TypeScript production build now passes (verified via docker build of services/billing-service/Dockerfile, EXIT=0). - Route input validation: add validateBody() helper returning a non-union ValidationResult so routes read .data/.details without discriminated-union narrowing, which does not fire under the service's strict:false tsconfig (mirrors the cast workaround in sms-service). Refactor setup-intent, subscriptions, credits routes onto it. - @fuzefront/shared kafka imports already resolve via /dist/kafka subpath (classic node resolution can't read the package "exports" map). - Add root .dockerignore excluding **/node_modules + **/.git so a host (Windows) node_modules cannot shadow the in-image install and corrupt the build (was producing a truncated typescript binary). - Add run-tests-in-docker.sh: runs jest in a clean node:18 Linux container (local Windows npm install is unreliable here; CI runs jest natively). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
CI fix — branch
|
The CustomerRepository interface gained findByStripeCustomerId (used by the webhook handlers' reverse lookup). The customer.service unit test's in-memory fake must implement it to satisfy the interface. Fixes the one failing suite (9/10 → 10/10; other 9 suites and 51 tests already passed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
CI fix pushed — branch `claude-auto-fix-ci-feature/billing-payments-27919987064`Root cause of the "Playwright sign-in flow" failure: `shared/dist/kafka/` was compiled with the main `tsconfig.json` (`module: esnext`), producing ESM output with bare specifiers: ```js When the backend starts and loads `@fuzefront/shared/kafka` via `require()`, Node.js 20 encounters ESM syntax and tries ESM resolution rules — which require explicit `.js` extensions. `./types` can't be found without the extension, so the process crashes immediately: ``` Fix: Re-ran `npm run build:kafka` (which uses `tsconfig.kafka.json` with `module: commonjs`) to produce the correct CJS output. 11 files under `shared/dist/kafka/` were updated and committed. The `tsconfig.kafka.json` already existed precisely for this purpose — it just wasn't used when the kafka dist was committed. |
The identity track also adds a 010_* migration (010_api_tokens). Add an in-file note that final integration must renumber one of the two 010 migrations. PR body carries the same warning. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
CI Fix — Branch:
|
Contributor
CI Fix — branch pushed for reviewRoot cause: The
Fix: Removed Branch with the fix:
|
Contributor
CI Fix: Kafka dist rebuilt as CommonJSRoot cause: The `shared/dist/kafka/*.js` files committed to the repo were compiled with `module: "esnext"` (the main tsconfig), producing ESM-style exports like: ```js Node.js's ESM loader requires explicit `.js` extensions on relative imports, so at backend startup it threw: ``` This crashed the backend before it could respond to `/health`, causing the E2E "Build & start backend" step to time out and fail. Fix: The shared package already has `tsconfig.kafka.json` (`module: "commonjs"`) for building the kafka sub-tree for server consumption. Rebuilt the 11 `shared/dist/kafka/*.js` files with that config — they now use `require()`/`exports` which Node.js resolves without needing explicit extensions. Branch pushed: `claude-auto-fix-ci-feature/billing-payments-27920108200` — the fix is one commit: `ab6e5dd`. Please create a PR from that branch into `feature/billing-payments` to unblock the CI check. |
Contributor
CI fix pushed — branch
|
The committed lock referenced @types/jest in the manifest mirror but lacked the node_modules/@types/jest install entry, so `npm ci` failed with 'Missing: @types/jest from lock file' in CI and Docker builds. Regenerate the lock so ci/build install deterministically. Verified in node:18-alpine (mirrors CI): - billing-service: npm ci OK, tsc --noEmit (src+tests) OK, jest 54 passed/3 skipped - billing-client: npm ci OK, tsc --noEmit (src+tests) OK, jest 6 passed - stripe 17.7.0 (bundled types), no live Stripe calls (mocked) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
CI fix pushed — branch
|
Contributor
CI fix pushed — branch
|
… frontend (draft) (#81) * fix(e2e): repair Playwright sign-in flow (#71) * fix(e2e): seed provisioned personal org so the sign-in shell renders The authenticated shell renders behind WorkspaceProvisioningGate, which only mounts the app layout once the user has a personal org. The e2e seeds a bare admin user and relied on async login self-heal provisioning to create that org within the test window; it never appeared, so the gate stayed on the 'Creating your workspace…' card and the .app-layout/.top-bar/.main-content (and .app-grid-button) the specs assert never rendered. Seed the personal org + active owner membership directly (mirroring ensurePersonalOrg) so the gate opens immediately and the test is deterministic. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): stop 500 on GET /organizations from double-parsing jsonb settings/metadata are jsonb columns; the pg driver returns them already parsed as objects, so JSON.parse(org.settings) throws ('[object Object]' is not valid JSON) and the route 500s as soon as any org row is returned. That 500 also breaks WorkspaceProvisioningGate: its getOrganizations() poll rejects, the gate flips to its error state, and the authenticated shell never mounts. Add parseJsonColumn() that passes objects through and only JSON.parse()s strings (sqlite/json-column paths), falling back to {} on invalid input. Apply it to all four settings/metadata reads in the organizations routes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * style(e2e): use _ for unused seq loop var (actionlint SC2034 clean) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): GET /organizations hid all active orgs (boolean default vs string compare) The is_active query param defaults to the boolean `true` when not sent, but the filter compared it with `is_active === 'true'` — true === 'true' is false, so with no param the route filtered WHERE is_active = false and returned ZERO active orgs. The frontend WorkspaceProvisioningGate calls GET /organizations with no params, so it never saw the user's (active) personal org and stayed stuck on the 'Creating your workspace…' card — the actual reason the sign-in e2e never reached the app shell. Coerce both shapes: boolean true and string 'true' mean active. Verified against Postgres: old filter returns 0 rows / no personal org; new filter returns the personal org. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(prod-cd): app.fuzefront.com on Contabo k3s — overlay, app config, kafka topics, observability, CI gate (#69) * wip(prodcd): watchdog salvage checkpoint — unpushed agent work [skip ci] * feat(prod-cd): kafka topic pre-create Job (Phase D) Idempotent Helm post-install/post-upgrade hook Job that creates the identity/notify/billing prefixed topics with explicit partitions + retention, gated behind kafkaTopics.enabled (on in values-prod). Topic set reconciled from @fuzefront/shared TOPICS plus planned billing/chat events. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(prod-cd): observability + helm-validate + prod-smoke (Phases E, G, H part) - E: backend /metrics via prom-client (defensive require); prometheus.io scrape annotations on backend/security/applications pods; FuzeFront Grafana dashboard + Prometheus alert rules shipped as labeled ConfigMaps. - G: helm-validate.yml — helm lint + kubeconform (strict, k8s 1.29) of the chart vs values-local/prod on PRs touching deploy/helm/**. - H: prod-smoke.yml — poll app.fuzefront.com/api/health for 200 after a release: tag-bump. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(prod-cd): Contabo runbook + BUILDING_ON_FUZEFRONT guide (Phase H) - CONTABO_DEPLOYMENT.md → operational runbook: release flow, rollback via git revert of the tag-bump commit, prune:false data safety, 2nd-node join, sealed-secret rotation, kafka topics, observability. - BUILDING_ON_FUZEFRONT.md: downstream products on FuzeFront — Module-Federation app registration, @fuzefront/* packages, Authentik OIDC SSO, Permit scopes, the API, fuse-seam design language. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ci): add prom-client to lockfile so npm ci passes (#69 metrics dep) * fix(frontend): remove unused fireEvent import (TS6133) blocking Lint & Test * ci(claude): add @claude handler + companion auto-PR workflow (issue->PR autonomy) Mirrors FuzeInfra's claude.yml; claude-auto-pr opens a draft PR from pushed claude/** branches (claude-code-action only pushes+links, doesn't open PRs). Requires repo secret ANTHROPIC_API_KEY. --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(ci): backend image build needs repo-root context (Dockerfile COPYs shared/ + backend/) (#73) Co-authored-by: AppHub Developer <developer@apphub.dev> * feat(billing-contract): OpenAPI 3.1 spec from real routes + spectral + generated client types [skip ci] * feat(infra): declarative node-request + dispatch-to-FuzeInfra reconcile loop (#76) * feat(infra): declarative node-request + dispatch-to-FuzeInfra loop FuzeFront declares infra needs (deploy/terraform node-request, references a FuzeInfra-owned contabo-k3s-node module) + Argo apps; CI path-watch fires a repository_dispatch to FuzeInfra (sole credential holder) to reconcile. FuzeFront holds no Contabo/cluster creds — only a scoped FUZEINFRA_DISPATCH_TOKEN. Decoupled IaC-as-a-service via git; gating = whitelist auto-apply on the FuzeInfra side. * fix(lint): remove unused react-hooks/exhaustive-deps disable in WorkspaceProvisioningGate (master lint was red) --------- Co-authored-by: AppHub Developer <developer@apphub.dev> * wip(billing-ui): scaffold @fuzefront/billing-ui package (tsup dual build, vitest, private publishConfig) [skip ci] * wip(billing-ui): i18n layer, status helpers, token-only stylesheet; add --scrim DS token [skip ci] * wip(billing-ui): primitives, accessible Modal, PlanCard, PlanPicker [skip ci] * wip(billing-ui): CheckoutModal (Stripe Payment Element), SubscriptionManager, UsagePanel, PaymentMethodPanel, barrel [skip ci] * wip(billing-ui): vitest unit + a11y + RTL tests (plans, checkout w/ mocked Stripe, subscription, panels, modal, status) [skip ci] * fix(billing-ui): named React event/type imports (no React namespace under jsx-runtime); ignore .npm-cache [skip ci] * test(billing-ui): scope plan-card assertions by region/selector (28→29 green) [skip ci] * build(billing-ui): wire @fuzefront/billing-ui into lerna publish pipeline + README * feat(agents): single-responsibility domain agents + contract-designer gate + honest-done contract (#82) * feat(agents): add single-responsibility domain agents + scope/done contract Adds five domain-scoped agent definitions (.claude/agents/) plus a README, each with an exclusive scope, explicit NOT-scope (named for the orchestrator), and a MANDATORY honest-"done" contract: SCOPE DONE (verified): <commands/results> OUT OF SCOPE — NOT DONE: <named unbuilt sibling layers> - backend-engineer — API/services/DB/migrations/events + own unit tests - frontend-engineer — design-system-first UI npm package vs the contract - test-engineer — INDEPENDENT acceptance/contract/e2e tests vs the spec - devops-engineer — Helm/Argo/CI/infra-request/sealed-secrets - docs-maintainer — consumer/integration docs only No agent ever declares the *feature* done/green — only its slice. A feature is complete only when every slice's PR is green and merged (orchestrator's call). Fixes the failure mode where one feature-agent reported DONE/GREEN while the UI and tests were unbuilt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(agents): add contract-designer — the detailed-design phase before fan-out No prior agent owned *creating* the contract; backend/frontend/test all only consume it. contract-designer runs FIRST and alone: user story → frozen OpenAPI/Swagger + Kafka Zod event schemas + generated @fuzefront/<svc>-client, PR'd as the gate the parallel fan-out depends on. Designs the interface; does not implement behind it. README + sequence updated to make it the sequential gate before backend/frontend/test/devops/docs fan out. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(agents): equip each domain agent with its best-fit skills Wire the strongest available skills into each agent's How section: - contract-designer: + writing-plans, well-architected - backend-engineer: + test-driven-development, systematic-debugging, security-review, verification-before-completion - frontend-engineer: + a11y-debugging, web-perf, verification-before-completion - test-engineer: + test-driven-development, systematic-debugging, a11y-debugging, verification-before-completion - devops-engineer: + observability, well-architected, verification-before-completion - docs-maintainer: + writing-rules, verification-before-completion verification-before-completion is wired into every implementer so the honest-"done" report is backed by an actual verification pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(fuzeone): family onboarding toolkit — "set me up as a FuzeOne member" (#83) * feat(fuzeone): toolkit skeleton — manifest, dependency-free sync.mjs, CLAUDE block, .npmrc, caller workflows [skip ci] WIP: reusable hub workflows + README + fuzefront-expert onboarding flow next. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(fuzeone): finish toolkit — real workflow bodies, generic helm-validate, README, shims - Caller workflows mirror the hub's actual workflows: claude/claude-auto-pr/auto-merge/ infra-dispatch self-contained; claude-ci-autofix + telegram call the izzywdev/AITools reusable workflows (the real hybrid — central fixes propagate). - helm-validate generalized to discover any chart under deploy/helm/. - Dropped deliverable-verify (no implementation exists yet). - README (FuzeOne layering + onboarding), cross-platform bin shims. - Verified: dry-run, conditional gating (has-helm/has-infra), var substitution, CLAUDE.md region merge, idempotent re-run, --check drift exit code. Depends on #82 (.claude/agents/*) merging — sync reads the canonical agents from the hub. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(agents): frontend-engineer owns design-system; add frontend-test-engineer (#85) Fixes the cross-branch design-system duplication that stranded features (identity #65, i18n #72, billing #81 each independently re-edited design-system/ → merge conflicts → nothing converges). - frontend-engineer is now the SOLE owner of design-system/: derive components from the user story → add missing primitives to the DS FIRST (landed as a foundation; one PR when features run in parallel) → then build the feature UI. - All other agents: never edit design-system/ (consume only) — added to NOT-scope. - New frontend-test-engineer: INDEPENDENT UI verification via Playwright, pre-prod (ephemeral stack, gates merge) AND post-prod (smoke vs live app). Split out from test-engineer, which is now scoped to API/contract/integration/event tests. - README roles + sequence updated (DS foundation step; fe-test after fe-engineer). Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat(chat): chat-service (RAG) backend + @fuzefront/chat-client (#68) * feat(chat): chat-service helm template, litellm argo app, permit Docs/Chat resources Unit 1 of the AI Chat (RAG) feature — deployment + authz foundation. A. Helm: add chat-service Deployment+Service template gated by chatService.enabled (default false). Port 3006 (3005 taken by provisioningService). Env includes LITELLM_URL, CHROMA_URL, BACKEND_URL, PERMIT_PDP_URL, KAFKA_BROKERS, DB_* and JWT_SECRET from chart Secret. Conditional ANTHROPIC_API_KEY / OPENAI_API_KEY / LITELLM_MASTER_KEY from Secret when set. Add chatService: block to values.yaml and three new empty-placeholder secret keys. B. Argo: add deploy/argocd/applications/litellm.yaml pointing at FuzeInfra/helm/litellm (companion FuzeInfra PR creates that chart). app-of-apps needs no change (directory sweep). No separate Argo app for chat-service (umbrella fuzefront chart handles it). C. Docs: docs/ai-chat/fuzeinfra-companion-spec.md — precise spec for the FuzeInfra companion PR: full LiteLLM Helm chart templates + model config, ChromaDB enablement (flip chromadb.enabled + template spec if missing), and fuzeinfra-ai-keys Secret spec. D. Permit: add Docs (action: read) and Chat (actions: stream, manage) resources to both backend/src and backend/security/src schema.ts files. Grant all three roles Docs:read and Chat:stream; restrict Chat:manage to admin only. Extend permit-schema.test.ts with 8 tests total (3 new role-grant assertions + updated resource list + idempotency paths). Helm: lint passes, template renders correctly (gated off by default, renders on enable). Tests: 8/8 permit-schema tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(chat): clarify FuzeInfra submodule bump in companion spec; restore viewer manage guard Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(shared): add billing.llm.usage kafka topic + zod schema - Add BILLING_LLM_USAGE to TOPICS const in shared/src/kafka/types.ts - Create billingLlmUsageSchemaV1 with uuid/int/datetime validators; no version in payload (lives on FuzeEvent envelope) - Export BillingLlmUsagePayloadV1 inferred type - Wire export through schemas/index.ts - Add 5-case describe block in email-service/tests/schemas.test.ts; update TOPICS count assertion Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(chat-client): @fuzefront/chat-client SSE+HTTP client for chat-service Implements Unit 3 of the AI Chat RAG feature plan (tasks T1.1, T1.2, T1.3). - New package packages/chat-client (@fuzefront/chat-client v1.0.0, MIT) - src/types.ts: ChatStreamRequest, ChatStreamEvent union (7 variants), RagSource, Conversation, ConversationMessage, ConversationWithMessages - src/streaming.ts: parseSSEStream() generator — accepts ReadableStream<Uint8Array> or AsyncIterable<string>; uses eventsource-parser v1.x; yields typed ChatStreamEvent; stops at {type:'done'}; skips malformed JSON lines - src/client.ts: ChatServiceClient class — streamChat (SSE), confirmTool, listConversations, getConversation, submitFeedback; yields {type:'error'} on streamChat errors, throws on others - src/index.ts: barrel re-export - Registered in lerna.json packages array and root package.json workspaces array - 22/22 tests pass (streaming.test.ts 8, client.test.ts 14); tsc --noEmit clean Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(chat-client): untrack built dist/ (CI/publish builds it) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(chat-service): scaffold service - config, health, jwt auth, rate-limit, chat db migrations - New services/chat-service package (@fuzefront/chat-service 1.0.0, private:true) - Express app with GET /health (unauthenticated), graceful SIGTERM/SIGINT shutdown - config.ts reads all env vars set by Helm chat-service.yaml template; REDIS_URL falls back to fuzeinfra default (no Helm mismatch that requires template edits) - Stateless JWT auth middleware: jwt.verify -> req.userId + req.orgId; no DB lookup; no console.log noise (§10d) - Rate-limit middleware: express-rate-limit 7.x + rate-limit-redis 4.x; three factory fns (stream 20/min, confirm 60/min, global 100/min §10f); Redis injectable for tests; degrades to in-memory if Redis unavailable (lazyConnect, no startup crash) - DB knexfile mirrors backend/knexfile.ts; 001_create_chat_tables migration with exact SQL from plan §6e (4 tables: chat_conversations, chat_messages, chat_audit_log, chat_feedback); idempotent up/down - 4 test suites, 11 passing, 2 skipped (live-DB migration, no Postgres in env) - Dockerfile mirrors email-service (multi-stage node:18-alpine, user chatservice, port 3006) - services/chat-service added to lerna.json packages (not root workspaces — matches email-service pattern) - tsc --noEmit: clean Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * wip(chat): watchdog salvage checkpoint — unpushed agent work [skip ci] * feat(chat-service): RAG retrieval, agent loop, chat routes, billing emitter Implements the read-only RAG path + streaming chat backend on top of the scaffold (Plan F / AI chat RAG): - llm/litellm: OpenAI-compat LiteLLM client (chat completions + embeddings, streaming SSE chunk parse); adopts the gateway, no provider SDK. - rag/{chunker,embedder,chroma,indexer,retriever}: deterministic chunking, ChromaDB REST client, content-hash idempotent indexer, top-k retriever. - rag/index-docs: CLI entrypoint for the chat-doc-indexer Job. - db/repositories/{conversations,messages,feedback}: scoped by JWT userId, never request body (§10d). - agent/prompt: injection-resistant system prompt, <doc>-wrapped context, input sanitization (§10a/§10b). - agent/{permit,confirmation,tools}: fail-closed PDP client, owner-scoped confirmation state machine, read-only search_docs tool (mutating tools deferred). - agent/loop: retrieve -> rag_sources -> text_delta... -> done, usage report. - billing/emitter: emits billing.llm.usage to Kafka, non-blocking on failure. - routes/chat: POST /chat/stream (SSE), conversations, feedback, confirm/:id; behind auth + per-route limiters; persists + bills. - app/index: composition root wiring all of the above. - helm: chat-doc-indexer Job template; chatService.resources limits + docIndexer/embeddingModel values. Dockerfile copies docs corpus. - shared/dist: regenerate kafka .d.ts (billing.llm.usage) + barrel export. Wire format = chat-client's SSE event union (text_delta/rag_sources/done/ error), a deliberate deviation from plan §6f (AI-SDK data stream). Verification: tsc --noEmit clean; jest 85 tests (83 pass, 2 skipped live-DB). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(chat): extract deploy wiring to chat-devops slice #68 is now the chat-service backend + @fuzefront/chat-client only. The Helm templates (chat-service, doc-indexer), LiteLLM Argo app, and chat secret/values moved to the chat-devops PR (devops slice), which merges after this backend lands. Also merges origin/master so this branch no longer reverts the prod-CD work (observability, kafka-topics-job, node-request) it was behind on. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(deploy): chat-service + doc-indexer Helm templates, LiteLLM Argo app, chat secret/values (#84) Devops slice extracted from #68 (the chat feature was bundling deploy wiring). Owned/reviewed as the devops slice; merges after the chat-service backend (#68). Chart renders coherently (chat-service template + values + secret keys together). Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * ci: enforce in-repo packages resolve from source (prevent PR #65 404 class) (#86) Adds scripts/check-workspace-deps.mjs + a Workspace deps CI gate that fails when a consumer references an in-repo package by a registry spec (e.g. "^0.1.0") without it resolving as a local workspace — exactly the PR #65 break where frontend listed "@fuzefront/identity-ui": "^0.1.0" for an unbuilt in-repo package and `npm ci` 404'd against the registry. The check is dependency-free (no install), passes on master, and fails the #65-class violation with an actionable fix message. Also exposed as `npm run check:workspace-deps`. Pairs with fuzefront-ui-package skill rule #7. Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * WIP: identity-management UI + API tokens (@fuzefront/identity-ui) (#65) * feat(security): add organization members CRUD endpoints Implements GET/POST/PUT/DELETE for /api/organizations/:id/members in the security service. GET returns a bare member array with nested user objects (firstName/lastName camelCase) to match the existing frontend contract in MembersManagement and OrganizationPage. POST creates a pending invitation row (same path as /:id/invitations). PUT/DELETE guard owner memberships with 403. Permit role assignment is non-blocking on all mutating routes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): filter members list to active + assert user.id in test Add .where('organization_memberships.status', 'active') to the GET /:id/members list query so only active members are returned. Add assertion on member.user.id in the GET happy-path test. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(security): add api_tokens migration (010) Creates the api_tokens table with SHA-256-hashed opaque tokens, polymorphic owner_id (no FK), created_by FK with ON DELETE SET NULL, scopes jsonb, and expiry/revocation timestamps. Enum creation guarded by DO $$ ... EXCEPTION block. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(security): implement API token service with TDD Add backend/security/src/services/api-token.ts with full token lifecycle: generateToken (ff_live_ format, base62 prefix, base64url body), hashToken, extractParts, createToken, verifyToken (timingSafeEqual, VerifyResult discriminated union), revokeToken, listTokensForOwner, getTokenById, updateLastUsed, and mapScopesToPermitRole (minimal-role algorithm from permitSchema). 48 unit tests cover all pure functions and mocked-DB operations including security invariants. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): parse api-token scopes on read; tighten ApiTokenRow type; add base62 test - Add parseScopes() helper (handles pg string or already-array mock) and call it on all four read paths: createToken return, verifyToken valid branch, listTokensForOwner map, getTokenById return — so callers always receive scopes as string[] not a JSON string. - Split ApiTokenRow into internal ApiTokenDbRow (includes token_hash) and exported ApiTokenRow = Omit<ApiTokenDbRow,'token_hash'|'scopes'> & { scopes: string[] } so callers cannot believe token_hash is present. - Export encodeBase62 and add describe('encodeBase62') with 6 tests including pinned known-vector (0xdeadbeef -> '44pZgF') to catch silent algorithm regressions. - Add scopes round-trip tests for createToken and verifyToken with mock DB returning scopes as a JSON string (real pg behaviour). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(security): API-token auth middleware + req.apiToken typing + rate limiting - Add authenticateFlexible middleware that branches on ff_live_ bearer tokens vs JWTs (JWT path delegates to core's authenticateToken unchanged) - PAT path: loads user row from DB, builds same User shape as core JWT middleware - Service-token path: synthetic svc_token:<id> principal with roles ['service'] - Add tokenAuthRateLimiter (express-rate-limit 7.2.0, skipSuccessfulRequests:true, 10 failed attempts per IP per 60s → 429) - Extend Express.Request with apiToken?: { id, scopes, ownerType, ownerId } - 11 tests covering all paths incl. rate-limit 11th-request 429 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(security): API token routes, Permit sync helpers, scope enforcement - Add syncServiceTokenToPermit / removeServiceTokenFromPermit to user-sync.ts - Create routes/api-tokens.ts: POST/GET/DELETE /api/tokens, GET /:orgId/tokens via orgTokensRouter, and the requireTokenScope middleware export - Mount /api/tokens + /api/organizations (org-tokens sub-route) in index.ts with tokenAuthRateLimiter - 28 tests covering all brief cases (create, 403, 400, ownership, org-admin, list, revoke, Permit-sync, requireTokenScope) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): deterministic token-route test + mount order + surface permit-sync false I-1: Replace setTimeout(20) timing hacks in api-tokens.routes.test.ts with deterministic microtask flushes (triple Promise.resolve()) for both the org-token create and org-token revoke fire-and-forget assertions. I-2: In index.ts, mount orgTokensRouter BEFORE organizationsRoutes so the specific /:orgId/tokens path cannot be shadowed by future wildcards. M-2: Change syncServiceTokenToPermit and removeServiceTokenFromPermit fire-and-forget calls from .catch-only to .then(ok=>warn-if-false).catch so false-return failures are surfaced in logs, not silently dropped. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(design-system): add Modal, DataTable, Textarea, FileDropZone + tokens - New tokens: --modal-max-w (560px), --modal-max-w-lg (720px) in spacing.css; --drop-active (rgba indigo 0.18) in colors.css (both themes) - Modal: accessible dialog shell in new overlay/ category — focus trap, Escape close, backdrop close, fuse-seam top bar, role/aria-modal/labelledby - DataTable: semantic table shell in new data/ category — headless-friendly (consumer renders <tbody>); sort carets + aria-sort; 5-row skeleton with --bg-quaternary pulse; emptyState slot - Textarea: mirrors Input.jsx exactly but renders <textarea> with vertical resize - FileDropZone: drag-drop target in forms/; keyboard-activatable (Enter/Space); --drop-active dragover fill; visible --accent-soft focus ring - Regenerated _ds_manifest.json and index.js: 18→22 components, 144→147 tokens Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * wip checkpoint: @fuzefront/design-system package + identity-ui scaffold start; SDD ledger [skip ci] * wip(identity): watchdog salvage — token/members/invite UI components (unverified) [skip ci] * feat(frontend): mount IdentityPage in OrganizationPage members tab + MF shared scope Wire @fuzefront/identity-ui into the host shell: replace MembersManagement with <IdentityPage>, add the package to frontend deps and Module Federation shared scope. Frontend build/type-check verified in CI (Windows-local Vite build is the documented os=linux gotcha). [skip ci] * fix(identity-ui): regenerate lockfile for new workspaces + tsc jest-dom types + CI coverage - package-lock.json was stale: it predated the `packages/identity-ui` and `design-system` workspace members being added to the root `workspaces`, so root `npm ci` failed ("Missing ... from lock file"). Regenerated cross-platform (lockfileVersion 3) so it includes both new workspaces, their deps (vitest, @tanstack/react-table, react-hook-form, papaparse, zod) and both linux-x64 and win32-x64 native binaries — `npm ci` now works on Linux CI and Windows. - identity-ui test setup: import `@testing-library/jest-dom/vitest` (not the bare entrypoint) so jest-dom augments vitest's `Assertion` interface — `tsc --noEmit` (the `type-check` script, which includes `src/**/*.test.tsx`) now recognises `toBeInTheDocument`. - ci.yml: add an `identity-ui-and-security` job (Linux) that runs the @fuzefront/identity-ui type-check + vitest + library build (asserting es/cjs/d.ts artifacts), plus the security-service API-token jest suite (DB-mocked, no Postgres). This is the canonical clean-Linux verification for PR #65. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(identity-ui,design-system): label/control association + EmptyState title + member test fixture [skip ci] * fix(identity-ui): assert exact 'Name is required' validation, not ambiguous /required|name/ The /required|name/i query matched both the 'Token name' label and the error, failing the empty-name unit test with 'found multiple elements'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(frontend): resolve @fuzefront/identity-ui + design-system from source [skip ci] Remove unpublished @fuzefront/identity-ui from frontend deps (was 404ing npm ci); alias both @fuzefront UI packages to source in vite/vitest/tsconfig. Keep identity-ui in Module-Federation shared list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(identity-ui): remove unused imports; consume built d.ts in frontend type-check Two real type errors remained after the source-resolution fix: 1. TS6133 unused React imports (5 files) + unused IconButton (TokenList) — noUnusedLocals + react-jsx automatic runtime. Removed. 2. TS2322 csstype CSSProperties clash in TokenList: the frontend's tsc was compiling identity-ui SOURCE, so identity-ui's React types (root @types/react) clashed with the frontend's own @types/react/csstype copy (frontend is not a root workspace, so it gets its own). Fix (2) mirrors @fuzefront/design-system: frontend/tsconfig.json now resolves @fuzefront/identity-ui to its built dist/index.d.ts instead of src, so tsc consumes validated types (skipLibCheck) rather than recompiling source under a duplicate csstype. vite/vitest still resolve from source via their aliases for bundling and tests. CI builds identity-ui before the frontend type-check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(build): declare socket.io-client in shared; drop @fuzefront UI from federation shared - @fuzefront/shared/src/hooks/useSocketBus.ts imports socket.io-client but it was never declared (latent since initial commit; #65 CI now builds shared and TS2307'd). Add socket.io-client ^4.7.5 (matches backend socket.io server) + regen lockfile. - frontend vite federation `shared` listed @fuzefront/identity-ui + design-system, which are aliased to source FILES — the plugin read `<file>/package.json` → ENOTDIR and failed `vite build`. They are host-bundled; only react/react-dom stay shared. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(billing-ui): regenerate lockfiles on linux (avoid win32 EBADPLATFORM on CI) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(billing-ui): register billing-client + packages/billing-ui in root workspaces The agent's workspace registration was left unstaged; the merge commit omitted it, so CI's workspace-deps gate saw @fuzefront/billing-client (a peerDep ^1.0.0) as an unregistered in-repo package. Register both so it resolves from source. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(billing): renumber backend/security migration 010->011 (collision with identity 010_api_tokens) #65 (on master) added backend/security migration 010_create_api_tokens_table; billing's 010_add_billing_to_entities collided. Renumbered to 011 to restore a unique ordering. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: AppHub Developer <developer@apphub.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Owner
Author
|
Superseded by #88 (merged). Verified: every billing file — services/billing-service (53), @fuzefront/billing-ui, @fuzefront/billing-client — is byte-for-byte identical to master (0 differing files). The billing & payments development from this branch is fully on master via #88; closing this redundant container PR discards no code. Branch retained for reference. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WIP: Billing & Payments (Stripe) — draft
Implements the billing-service microservice, a typed client package, and GitOps
wiring per
docs/superpowers/plans/2026-06-19-billing-payments.md. Provider =Stripe (locked decision in the spec — adopted
stripe@^17, not reinvented).Keep as DRAFT — UI package + email templates + DB role are not yet done.
Done (verified this session)
plan sync + cache, subscription create/update(proration)/cancel, SetupIntent &
credits routes, webhook receiver (raw-body signature verify + idempotent dedup),
webhook handlers (subscription updated/deleted, invoice paid/failed, trial-ending),
Permit.io plan sync (graceful), metering buffer→Stripe Billing Meter flush
(correlationId idempotency), internal-token auth middleware, full app/index wiring.
@fuzefront/billing-clienttyped axios client —publishConfig→ GitHubPackages,
access: restricted,repositoryfield, registered inlerna.json.billing-service.yaml(Deployment+Service,enabledgate, secret refs),
values.yaml/values-local.yaml/values-prod.yamlblocks,secret.yamlSTRIPE_* + BILLING_INTERNAL_TOKEN,skaffold.yamlartifact +setValueTemplate,
release.ymlbuild/push step + path trigger, dedicated ArgoApplication
deploy/argocd/applications/billing.yaml(hybrid structure — billingis independently-lifecycled).
billing.usage.recorded,billing.subscription.changed).billing.*tables) + migration010(billingcolumns on
users/organizations)..dockerignore(hostnode_moduleswas shadowing the in-imageinstall and corrupting the build).
How verified (exact commands + results)
docker build -f services/billing-service/Dockerfile .→ EXIT 0 (productionTypeScript build green; resolves the prior "types pending" salvage item).
run-tests-in-docker.sh)→ 51 passed / 3 skipped, 10 suites (customer, plan, subscription, permit,
metering services; webhook route dedup/sig; subscription-updated handler; app/db/config).
@fuzefront/billing-client:tsc --noEmitEXIT 0;jest→ 6/6 passed.shared:tsc -p tsconfig.kafka.json→ EXIT 0.helm template ... --set billingService.enabled=true -f values-local.yaml→EXIT 0 (Deployment+Service + STRIPE_*/BILLING_INTERNAL_TOKEN secret keys render).
billing.yaml,skaffold.yaml,release.yml, all values files → valid YAML.Remaining for completion
@fuzefront/billing-uiReact package (T15–T17) — design-system-aligned PaymentElement / PlanCard / CheckoutModal etc. (specs in the plan).
email-servicebilling templates (T19):billing-trial-ending,billing-payment-failed.billing_svcDB role indb-bootstrap-job(T20); until then theservice connects as
fuzefront_user.@fuzefront/billing-clientintobackendfor inline entitlement reads.billingService.enabledstaysfalsein prod values until Stripe secrets +webhook + DB role are provisioned (flip via GitOps, never hand-deploy).
Risks / notes
010_*migration(
010_api_tokens). This branch keeps010_add_billing_to_entities.ts. Finalintegration must renumber one of the two
010migrations.webhook forwarding (Stripe CLI) are out-of-band setup items (see plan §11).
npm installfor billing-service is unreliable in this env;verification was done via Docker (Linux). CI runs jest/tsc natively on Linux.
🤖 Generated with Claude Code