56 Commits

Author	SHA1	Message	Date
BilalG1	57ff5d3ce9	feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) ... ## Summary **Stacked on [#1475](https://github.com/hexclave/stack-auth/pull/1475)** (`cl/hexclave-pr1`, the invisible compatibility layer). Diff vs that base = the actual PR 2 code. This is **PR 2 of the Stack Auth → Hexclave rebrand: the visible flip**. Old wire identifiers (cookies, request/response headers, Bearer prefix, JWT issuers, MCP tool name) keep working indefinitely via PR 1's dual-accept. This PR flips every user-visible surface — package names taught in docs, SDK class names in code examples, dashboard setup snippets, page titles, error messages, email content, CLI binary, default base URLs, GitHub repo slug, contributor guidance — to the Hexclave brand. See [`RENAME-TO-HEXCLAVE.md`](./RENAME-TO-HEXCLAVE.md) → *"PR 2: Rebrand to Hexclave (visible)"* for the full per-work-area spec. ## What's implemented (per the plan's PR 2 scope) - **SDK base URLs** flipped: `defaultBaseUrl` and `defaultAnalyticsBaseUrl` in [common.ts](packages/template/src/lib/stack-app/apps/implementations/common.ts:127) → `https://api.hexclave.com` / `https://r.hexclave.com`. PR 1's [`getHardcodedFallbackUrls`](packages/stack-shared/src/utils/urls.tsx:199) table now keys on the Hexclave domain. - **Domain inventory sweep** (16 subdomains from the plan): every `api/app/docs/discord/demo/mcp/skill/feedback/test/preview/r/api2/api.staging/idp-jwk-audience/built-with.stack-auth.com` reference in production code, docs-mintlify, examples, READMEs, and contributor guidance flipped to `*.hexclave.com`. Carve-outs: PR 1's intentional JWT issuer dual-accept table in [tokens.tsx](apps/backend/src/lib/tokens.tsx), the legacy `./docs/` folder, the `unified-docs-widget` allowlist (deliberately accepts both during DNS transition), and `url-targets.ts` hosted-component default (baked into existing customer deploys). - **`@deprecated` JSDoc** on every `Stack*` public export ([packages/template/src/lib/stack-app/index.ts](packages/template/src/lib/stack-app/index.ts) + [packages/template/src/index.ts](packages/template/src/index.ts)) — `StackClientApp`, `StackServerApp`, `StackAdminApp` + every constructor/options/JSON type, `StackHandler`, `StackProvider`, `StackTheme`, `useStackApp`, `defineStackConfig`, `StackConfig`. Hexclave\* aliases are now canonical. - **Runtime `console.warn`** ([packages/template/src/internal/deprecation-warning.ts](packages/template/src/internal/deprecation-warning.ts)) — once-per-process when the SDK is loaded from a `@stackframe/*` artifact. Detection uses the existing `STACK_COMPILE_TIME_CLIENT_PACKAGE_VERSION_SENTINEL` (rewritten at build time to e.g. `js @stackframe/stack@2.8.92` or `js @hexclave/next@1.0.0`); `@hexclave/*` mirror artifacts short-circuit the warning. - **Tier 3 data migration**: new idempotent SQL migration [`20260523000000_rename_internal_project_to_hexclave`](apps/backend/prisma/migrations/20260523000000_rename_internal_project_to_hexclave/migration.sql) — updates the internal Project `displayName` 'Stack Dashboard' → 'Hexclave Dashboard' and `description` only if both still hold the pre-rebrand defaults. Operator-renamed projects untouched, missing row no-ops, re-runs are no-ops. [`seed.ts`](apps/backend/prisma/seed.ts:87) default flipped. `getSharedEmailConfig("Stack Auth")` → `("Hexclave")`. - **Tier 4 brand strings** (mechanical sweep, ~340 files): - Page + OpenAPI titles (Hexclave API / Dashboard / REST API / Webhooks API / Documentation). OpenAPI `info.description` documents `X-Hexclave-*` headers as canonical with compat note on `X-Stack-*`. - `HexclaveAssertionError` message text ([errors.tsx:71](packages/stack-shared/src/utils/errors.tsx:71)) — "an error in Stack." → "an error in Hexclave." - Known-error message templates ([known-errors.tsx](packages/stack-shared/src/known-errors.tsx)) flipped to lead with `x-hexclave-*` + the new `docs.hexclave.com` URL; legacy `x-stack-*` mentioned as compat aliases. **25 e2e test files updated in lockstep**. - Email content: failed-emails-digest body, sendTestEmail recipient (now `sent-with-hexclave.com`), test-email-recipient default. - `CHANGELOG.md` title → "Hexclave Changelog". - `AGENTS.md` env var convention: new vars prefix `HEXCLAVE_` / `NEXT_PUBLIC_HEXCLAVE_` for Category A/B; legacy `STACK_*` explicitly noted as accepted via PR 1's dual-read. - **CLI / init wizard**: - Every dashboard setup snippet, init-stack template, and docs-mintlify page teaches `npx @hexclave/cli@latest init` (was `@stackframe/stack-cli`). [setup-page.tsx](apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/(overview)/setup-page.tsx) + [link-existing-onboarding](apps/dashboard/src/app/(main)/(protected)/(outside-dashboard)/new-project/page-client-parts/link-existing-onboarding.tsx). - [init-stack](packages/init-stack/src/index.ts:634) `STACK_*_INSTALL_PACKAGE_NAME_OVERRIDE` defaults flipped to `@hexclave/*`. - Generated `stack/client.ts` / `stack/server.ts` import from `@hexclave/next` and reference `HexclaveClientApp` / `HexclaveServerApp`. - Internal `StackAuthKeys` dashboard component renamed to `HexclaveKeys`. - **docs-mintlify rewrite** (legacy `./docs/` intentionally untouched per scoping decision): - **78 MDX files swept**. `@stackframe/{react,stack,js,tanstack-start,...}` → `@hexclave/{react,stack,js,...}` in install snippets and code blocks; `Stack*` SDK class names → `Hexclave*` in all code examples; 'Stack Auth' brand phrase → 'Hexclave'. - `openapi/{server,admin,client,webhooks}.json` titles → 'Hexclave REST API' / 'Hexclave Webhooks API'. - **Generators flipped before regeneration**: - [`packages/stack-shared/src/helpers/init-prompt.ts`](packages/stack-shared/src/helpers/init-prompt.ts), [`/ai/prompts.ts`](packages/stack-shared/src/ai/prompts.ts), [`apps/backend/src/lib/ai/prompts.ts`](apps/backend/src/lib/ai/prompts.ts), [`apps/backend/src/lib/ai/tools/create-email-{template,draft}.ts`](apps/backend/src/lib/ai/tools/create-email-template.ts), [`apps/skills/src/app/route.ts`](apps/skills/src/app/route.ts) (taught MCP tool → `ask_hexclave` with compat note; CLI binary teach → `hexclave`), [`docs-mintlify/snippets/home-prompt-island.jsx`](docs-mintlify/snippets/home-prompt-island.jsx), [`packages/template/README.md`](packages/template/README.md) + integrations/convex/component/README.md. - `generate-sdks` propagated changes to `packages/{react,stack,js}`. - **OpenAPI dual-documentation**: [`apps/backend/src/app/api/latest/route.ts`](apps/backend/src/app/api/latest/route.ts) now lists `X-Hexclave-*` headers as primary documented schemas with `X-Stack-*` duplicates marked `.optional()` (both accepted at runtime by PR 1's normalize-at-proxy shim). - **`@stackframe/emails` virtual module**: dual-aliased to `@hexclave/emails` at the bundler boundary ([email-rendering.tsx:89](apps/backend/src/lib/email-rendering.tsx:89)). Stored email templates continue to import from either name; new AI-generated templates and the system prompt teach `@hexclave/emails`. - **Tier 2 mirror-publish wiring** (new this PR, lays the groundwork for `@hexclave/*` first publish): - [`scripts/rewrite-packages-to-hexclave.ts`](scripts/rewrite-packages-to-hexclave.ts) — rewrites 9 publishable `@stackframe/*` → `@hexclave/*` `package.json` files (reads `HEXCLAVE_VERSION` env or `--version=` flag), pins cross-deps to the shared `@hexclave` version, registers `hexclave` bin alongside `stack` for `@hexclave/cli`. - [`.github/workflows/npm-publish.yaml`](.github/workflows/npm-publish.yaml) appended with rewrite-then-republish step. `pnpm publish` skips already-on-npm versions so reruns are safe. - **Sender email domain**: `noreply@stackframe.co` → `noreply@sent-with-hexclave.com` (the dedicated transactional-sender domain split per the plan, to isolate bulk deliverability from `hexclave.com` reputation); `security@` / `team@stack-auth.com` inbound mailboxes → `@hexclave.com`. - **Self-host docs**: docker network / container names in the bash examples flipped from `stack-auth` to `hexclave` (`hexclave-postgres`, `hexclave-clickhouse`, `hexclave.env`). The docker image tag `stackauth/server:latest` stays per the plan's locked decision. - **GitHub repo slug**: `hexclave/stack-auth` → `hexclave/hexclave` in every `package.json` `repository` field, README link, CHANGELOG raw-asset URL. ## Carve-outs (deliberately untouched) - **[`apps/backend/src/lib/tokens.tsx`](apps/backend/src/lib/tokens.tsx)** JWT issuer dual-accept table — PR 1 intentional infrastructure, kept indefinitely. - **Legacy `./docs/` folder** — per scoping decision (only `docs-mintlify/` rewritten). - **`unified-docs-widget` hostname allowlist** — accepts both `.hexclave.com` (canonical) and `.stack-auth.com` (transition window) for DNS rollout. - **`url-targets.ts`** hosted-domain default `.built-with-stack-auth.com` — wire identifier baked into existing customer deploys; indefinite read-fallback. - **Binary visual assets** (logos, favicons, OG images, README screenshots) — out of scope for this PR. Need design work; tracked separately. ## Verification - **`pnpm typecheck`** on `packages/{template,stack-shared,react,stack,js}` + `apps/dashboard`: **all green**. The remaining backend / e-commerce-demo typecheck errors are pre-existing (Prisma codegen output + `./generated/api-versions.json` not present in fresh worktrees without `pnpm run codegen-prisma` + a live DB) and unrelated to this diff. - **`pnpm lint`** on the same 6 packages: all green. - **Final grep** for residual `Stack Auth` / `stack-auth.com` / `@stackframe/stack-cli@latest` references: zero outside the intentional carve-outs above. - **25 e2e test files updated in lockstep** with the known-error message changes (asserted strings flipped to match the new x-hexclave-* + compat-note messages). ## Deploy blockers (ops sequencing before this rebrand goes live) This PR is code-complete, but the rebrand's visible surfaces (SDK default URLs, dashboard links, npm READMEs, REST error messages, runtime deprecation warning) all point at `*.hexclave.com` / `@hexclave/*` resources that don't exist yet. None of these are fixable from a PR — they're ops/registrar/npm work that has to be sequenced before merging this to a release tag. Suggested ordering, hardest blockers first: ### Tier 1 — required before customer-facing deploy (everything below this line *will visibly break customers on day 1* if skipped) 1. **DNS + TLS for `api.hexclave.com` + `api1./api2.hexclave.com`** → must point at the same backend that serves `api.stack-auth.com` (or a backend that mirrors PR 1's dual-accept). The SDK's new `defaultBaseUrl` is `https://api.hexclave.com`; every customer that relied on the old default and upgrades to a post-PR2 SDK build sends API requests here. Until this resolves, every default-config customer's API call NXDOMAINs. 2. **DNS for `app.hexclave.com`** → the dashboard. Referenced in the SDK's default-error messages ("Please create a project on the Hexclave dashboard at https://app.hexclave.com"), the init-stack flow's `wizard-congrats` redirect, and the OAuth dashboard handoff. 3. **DNS for `docs.hexclave.com`** + Mintlify deploy → the SDK runtime deprecation warning (`https://docs.hexclave.com/migration`), every README, every "Learn more" link in the dashboard, and every REST API error body (`/api/overview#authentication`) points here. The MDX is in this PR; the docs build target needs DNS. 4. **DNS for `mcp.hexclave.com`** → the MCP server endpoint that every taught agent integration (`claude mcp add ...`, `cursor`, `codex`, `vscode`) registers. Until this resolves, every `npx @hexclave/cli@latest init` MCP-registration step fails. 5. **Reserve the `@hexclave` npm scope + set repo variable `HEXCLAVE_VERSION`** → the mirror-publish step in `.github/workflows/npm-publish.yaml` is gated on this variable. Without it, the entire taught onboarding command `npx @hexclave/cli@latest init` 404s from the npm registry, *and* every README that says "install `@hexclave/next`" leads to install failure. Pick the initial version intentionally (`1.0.0` or aligned to `@stackframe/stack`); don't accept a silent default. ### Tier 2 — required before announcing the rebrand publicly (lookalike or low-traffic surfaces, but visibly broken) 6. **DNS for `r.hexclave.com`** → the analytics beacon `defaultAnalyticsBaseUrl`. Silent failure if missing (analytics drops), but should land alongside Tier 1. 7. **Register `sent-with-hexclave.com` + full email auth (SPF / DKIM / DMARC)** → the new default sender domain for shared-sender transactional emails. Without it the dashboard "send test email" path emits bounces, and shared-sender flows (`getSharedEmailConfig("Hexclave")`) deliver to spam at best. 8. **MX + SPF / DMARC for `hexclave.com`** → `team@hexclave.com` and `security@hexclave.com` mailboxes. The security disclosure mailbox is referenced in [`.github/SECURITY.md`](.github/SECURITY.md); `team@hexclave.com` is the actual recipient of internal feedback emails sent at runtime by [`apps/backend/src/lib/internal-feedback-emails.tsx`](apps/backend/src/lib/internal-feedback-emails.tsx). Today, every runtime feedback email bounces. 9. **DNS for `skill.hexclave.com`** → the canonical AI-agent skill fetch URL (the agent bootstrap pivot). Without it, the entire "agent downloads `SKILL.md` from a known URL" flow taught in [`packages/stack-shared/src/helpers/init-prompt.ts`](packages/stack-shared/src/helpers/init-prompt.ts) fails. 10. **Create `github.com/hexclave/hexclave` as a public repo** (even as a redirect to `hexclave/stack-auth`) **OR** rewrite every `package.json` `"repository"` field + dashboard footer "view on GitHub" link to point at `hexclave/stack-auth` (which already exists). Currently every npm package page's "Repository" link is dead, and the dashboard's GitHub button + dev-tool repo link are dead. ### Tier 3 — broken but low-visibility / low-traffic 11. **DNS for `discord.hexclave.com`** → Discord invite redirect, used in every README's chip and the dashboard footer. 12. **DNS for `demo.hexclave.com`** → "✨ Demo" badge in every npm package README. Broken-image badge on the package page. 13. **DNS + TLS for `built-with-hexclave.com`** → optional hosted-handler domain (the default reverted to `.built-with-stack-auth.com` in this PR's carve-outs, so this only matters for projects that manually flip). ## Other follow-ups (not deploy-blocking) - **E2E snapshot regen across the full suite** for the dual-emitted `x-hexclave-*` response headers (PR 1 follow-up; `vitest -u` in CI absorbs). - **Binary visual assets** — logos, favicons, OG images, README screenshots; need design pass. - **Backend OpenAPI fumadocs regen** in CI flow — the JSON files in `docs-mintlify/openapi/` are committed but regen runs in CI. Verify the workflow that does this still works against the post-PR2 source. - **Backend typecheck infra debt** — needs `codegen-prisma` + `codegen-route-info` to clear; pre-existing, unaffected by this PR. ## Test plan - [ ] CI runs full e2e suite (with `vitest -u` to absorb residual snapshot deltas, then committed back). - [ ] Spot-check: new `@hexclave/cli init` (once published) generates `hexclave.config.ts` and works against a fresh project. - [ ] Spot-check: existing customer with `@stackframe/stack` import sees the once-per-process `console.warn` recommending `@hexclave/next` on SDK init. - [ ] Manual: dashboard setup page renders the `npx @hexclave/cli@latest init` snippet and the `x-hexclave-publishable-client-key` API header in the curl example. - [ ] Manual: a fresh `pnpm run prisma migrate` against a clean DB sets the internal project displayName to 'Hexclave Dashboard'. --------- Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>	2026-05-26 19:18:20 -07:00
BilalG1	f7e389809e	feat(hexclave): PR 1 — wire compatibility layer (invisible) (#1475) ... ## Summary **Stacked on #1468** (`docs/hexclave-rename-plan` — the plan doc). Diff vs that base = the actual PR 1 code. This is **PR 1 of the Hexclave rebrand: the invisible compatibility layer**. Everything is additive. Old SDKs, old wire identifiers, and old env var names keep working unchanged. The backend dual-accepts and dual-emits; new SDK code emits `x-hexclave-*` headers and the `hexclave_` Bearer prefix; cookies dual-write; env vars dual-read across every category. **No user-visible rebranding lands here** — that's PR 2. See [`RENAME-TO-HEXCLAVE.md`](./RENAME-TO-HEXCLAVE.md) → *"PR 1 implementation guide"* for the full per-work-area spec, file pointers, and chosen approach. ## What's implemented (all 14 PR-1 work-areas) - **SDK export aliases** — `Hexclave*` aliases for the user-facing `Stack*` exports added in `packages/template`; codegen propagates them to `@stackframe/{js,stack,react,tanstack-start}`. React-only aliases correctly excluded from `@stackframe/js`. (`e60550a2`) - **JWT issuer dual-accept** — `decodeAccessToken` accepts both `api.stack-auth.com` and `api.hexclave.com` issuers. Signing unchanged. (`fc781def`) - **Request-header dual-accept** — backend + dashboard proxies normalize `x-hexclave-*` → `x-stack-*` at the existing empty proxy hook (so `smart-request.tsx` and every route schema keep working unchanged); CORS allowlists extended via a derive-once helper. (`2a056eac`) - **MCP `ask_hexclave`** — registered alongside `ask_stack_auth` via a shared helper; `ask_stack_auth` behavior byte-identical. (`30ffd604`) - **Dev-tool** — DOM ids + header emit switched. `window.HexclaveDevTool` exposed alongside `window.StackDevTool`. (`32131ea7`) - **The big consolidated commit** (`7fed864a`): - **Env vars** — central `getEnvVariable` prefix-transform (HEXCLAVE first, STACK fallback); dashboard + template client env files dual-read; `turbo.json` globalEnv; `NEXT_PUBLIC_STACK_PORT_PREFIX` renamed outright across ~82 files including docker. - **Cookies** — dual-write/dual-read auth (`stack-access`/`-refresh-*` and custom-domain variants), OAuth-state (`stack-oauth-{inner,outer}-*`), and low-risk cookies (`stack-is-https`, `stack-last-seen-changelog-version`). Bypass sites patched (backend OAuth callback, dashboard remote-dev auth route, impersonation snippets, snapshot serializer). - **Bearer prefix** — SDK token parser accepts both `stackauth_` and `hexclave_`; emits `hexclave_`. Discovery correction: this is purely SDK-internal — the backend never parses it. - **Response headers** — backend dual-emits `x-hexclave-{request-id,actual-status,known-error}`; SDKs dual-read (new first, stack fallback). - **SDK request-header emit switch** — `client/server/admin-interface.ts` + dashboard `api-headers.ts` + `internal-project-headers.ts` + `feedback-form.tsx` switched to `x-hexclave-*`. Plus `stack_response_mode` query param. - **Storage keys** — dev-tool / cli-auth / oauth-button / docs keys renamed (straight); `stack:session-replay:v1` dual-read so in-progress recordings survive SDK upgrades; `stack_mfa_attempt_code` dual-read. - **Query params** — cross-domain params dual-emit/dual-accept via shared helpers; backend `oauth/authorize` accepts `hexclave_response_mode` and `stack_response_mode`; `stack-init-id` renamed. - **`Symbol.for`** — app-internals symbol gets a parallel `Symbol.for("Hexclave--app-internals")` getter on each attach site (no read-site churn — old symbol still attached). 3 file-private symbols renamed outright. - **Config discovery** — prefer `hexclave.config.ts`, fall back to `stack.config.ts` at every discovery site (CLI / dashboard / backend / local-emulator); `init` writes the new filename; CLI credentials path migrates. - **Internal renames** — `StackAssertionError`, `StackClient/Server/AdminInterface` renamed outright (no alias, per the "internal-only → rename" rule). ~264 files touched. - **Review-pass fixes** (`21217fbe`) — three real bugs found by parallel review agents and fixed: - `snapshot-serializer.ts` was interpolating the whole `keyedCookieNamePrefixes` array (`${arr}`) — adding a second prefix would have corrupted **every** OAuth-cookie snapshot, not just new ones. - **Docker port-prefix producer/consumer mismatch** — `entrypoint.sh`/`run-emulator.sh`/cloud-init `user-data` were still producing `NEXT_PUBLIC_STACK_PORT_PREFIX` while the dashboard sentinel + consumers had been renamed; silent self-host regression (custom port prefix would be ignored). - **Missing `hexclave-oauth-inner-*` dual-write** in the OAuth authorize route — callback's fallback masked it but the dual-write was specified by the plan. - Plus: `mcp.test.ts` tool-list assertions updated to include `ask_hexclave`; two dashboard header-emit sites switched to `x-hexclave-*` for consistency. - **E2E snapshot serializer follow-up** (`4b16cc5d`) — `x-hexclave-request-id` added to the hidden-headers list (mirroring `x-stack-request-id` treatment), and 2 sample inline snapshots regenerated in `projects.test.ts` to include the new dual-emitted headers. ## Verification - **`pnpm typecheck`** — clean (the fresh-worktree `@/.source` / Prisma codegen gap in `stack-docs` is pre-existing and unrelated). - **`pnpm lint`** — 29/29 packages green. - **`pnpm exec turbo run build --filter=./packages/*`** — 13/13 packages build (including `@stackframe/stack-cli` once the dashboard standalone is present). - **Live E2E** against a running backend on `cl/hexclave-pr1`: - `pnpm test run apps/e2e/tests/backend/endpoints/api/v1/internal/mcp.test.ts` — **6/6 pass** (verifies the new `ask_hexclave` tool — the hand-written inline snapshot matched actual MCP server output). - `pnpm test run apps/e2e/tests/backend/endpoints/api/v1/internal/projects.test.ts` — **11/11 pass** (verifies wire dual-accept + dual-emit end-to-end; the snapshot serializer fix was found and applied during this check). A four-agent parallel **review pass** also audited the full diff for logic/runtime bugs across the work-areas (wire headers + JWT, cookies + bearer + symbols, env vars, query params + config + MCP + aliases). All in-slice review verdicts were ✓ except the three bugs listed above, which are now fixed. ## Known follow-ups (out of scope for this PR) - **E2E snapshots across the rest of the suite** — backend now dual-emits `x-hexclave-{known-error,actual-status}` alongside `x-stack-*`, which legitimately appears in inline snapshots throughout `apps/e2e`. Two were regenerated here as a sample; the rest should regen with `vitest -u` in CI. - **Docker shell env vars beyond `PORT_PREFIX`** — `entrypoint.sh` still reads `STACK_*` env vars directly (the JS-side `getEnvVariable` transform doesn't help the shell). JS consumers dual-read so it works in practice; full shell-level dual-read is a deeper self-host follow-up. - **`@stackframe/stack-cli` build ordering** — pre-existing; needs `build:rde-standalone` first. Not affected by this PR. ## Test plan - [ ] CI runs full e2e suite (with `vitest -u` to absorb dual-emit snapshot deltas, then committed back) - [ ] Spot-check: an old SDK build (emitting only `x-stack-*`) still authenticates against the new backend - [ ] Spot-check: a new SDK (emitting `x-hexclave-*` / `Bearer hexclave_*`) still authenticates against an old backend during deploy ordering - [ ] Manual: `npx @stackframe/stack-cli@latest init` (new onboarding entrypoint) generates `hexclave.config.ts` - [ ] Manual: existing `stack.config.ts`-only project still resolves (no migration required) --------- Co-authored-by: bilal <bilal@stack-auth.com>	2026-05-23 17:24:55 -07:00
Konstantin Wohlwend	f6ef49a3dc	Remove source-of-truth logic	2026-05-23 01:06:42 -07:00
Konsti Wohlwend	0df594abe7	Handle payout.created and payout.reconciliation_completed Stripe webhook events (#1461)	2026-05-21 14:11:36 -07:00
Aman Ganapathy	c01c052ac9	[Refactor][Feat] Implement Plan Limits for Hard-and-Soft Item Caps (#1215) ... ### Suggested Review Areas Please see `plans.ts` and `seed.ts` to verify whether the item caps are where they should be. Outside of that, each commit should be atomic so stepping through the commits should give you an idea of how I implemented each limit. ### Discussion Something to discuss: when a user cancels team/growth we regrant free fine, but any extra-seats they had just keeps billing. So they end up paying ~$29/mo per extra-seat on top of free's 1 seat, which is strictly worse than just staying on team. This surfaced while manually testing this PR, we only enforce the add-on base requirement at purchase time, nothing cascades on cancel. Should we cascade cancel add ons? ### Context Now that we have a stable suite of products for stack-auth, we want to limit the items under each product a customer has access to based on their plan. So for example, a free plan user has a certain amount of emails they can send out each month, and so on. We try to implement limits in this PR. ### Summary of Changes Implemented hard limits for dashboard admins, analytics per-query timeouts, sent email monthly capacity, events, and session replays. Implemented a soft cap for auth users (where if there's a signup beyond the limit, we log it to sentry so we can manually choose to email that user/team). For auth users, we do not block new user sign ups once plan limit has been hit. We also don't degrade or impact the customer experience. It logs to sentry and it is up to us to take manual action to email the user to upgrade the plan. Also, implementation wise, we count all the users across all the projects for this team and compare it to their plan item limit, rather than debiting items like we do for other approaches. As a soft cap, this should be fine plus this is a better source of truth. For email capacity, we operate a monthly limit of emails. Once this is hit, no more emails can be sent until the next month/ a plan upgrade. These emails will be treated as a send error, so they can be manually resent once the capacity is reset. With respect to the `email-queue` state engine, they go from `SENDING`->`SERVER_ERROR`, hooking into the existing state engine flow, with an external error that shows it's because of the rate limit. This is cleaner than inventing a new state that is identical for all intents and purposes to `SERVER_ERROR`. We check in processSingleEmail since that maps to the sending state. For analytics query timeouts, the backend route accepts a timeout parameter with the request. The way we implement the timeout for each query is by taking the `min(request_timeout,plan_timeout)` and using that. This determines how long a query can run for. For analytics events, there are server-side events (like refresh token refreshes or sign up rule triggers) and client side events (like page views or clicks). When these events occur, they are written to the events table in clickhouse. We choose to implement a hard cap for the total events, not just server side or client side. Once the cap is hit, we stop storing the events and display a banner on the analytics page. A different banner renders when we are at >=80% of total plan capacity. For session replays, we stop creating new session replays when the limit is hit. Old replays can still have chunks appended to them. The source of truth here is the session replay table- a new replay corresponds to a new row in the table. We have similar banners as to the events. Dashboard admins should be 4 for both team and unlimited. #### Implementation Caveats For debiting items across these limits, we now use `tryDecreaseQuantity` at the beginning. This means we debit first if possible before conducting the action (like writing events to clickhouse). In practice, this means that if clickhouse fails, then the user is debited for something that doesn't happen. However trying to build a refund workaround would be very clunky, and also, clickhouse is reliable. For debits that are very small in the order of things (say, 200 items on a 100k plan), it doesn't mean much. For emails, we don't debit items if it's a retry. This prevents the user for being charged multiple times for effectively one email. ### UI Changes The only UI changes in this PR are having certain banners render in analytics when a customer is approaching/ is at their monthly limit of session replays or events. ### Out of Scope for this PR We do not have metered pricing yet, so events/session replays/ email use beyond the limits cannot be charged yet. This is why for this implementation, we rely on hard and soft caps. We do not implement payment per-transaction pricing yet. That is deferred to a followup PR. The UI for the onboarding call will be set up as part of the overall onboarding flow which doesn't exist yet, so it has been deferred. Since the UI for the dashboard home page and project/account settings is currently being reworked, finding a better spot for plan upgrades is not handled in this PR. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Session replays added as a monthly included entitlement; onboarding calls added to Team/Growth plans. Dashboard banners warn about analytics-event and session-replay limits. Projects page adds extra-seat flow and improved invitation error handling. * **Behavior Changes** * Monthly renewal semantics for emails-per-month and analytics-events; analytics query timeouts now respect plan limits and are clamped. Email sends, analytics events, and new session creation are blocked when quotas are exhausted. Growth plan seats set to 4. * **Tests** * E2E and unit tests added to verify quota enforcement and free-plan regranting. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Mantra <87142457+mantrakp04@users.noreply.github.com>	2026-05-04 18:25:13 -07:00
BilalG1	0621ad2032	ai proxy fix (#1343) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Request sanitization now includes an extra proxy-specific preprocessing step for safer AI proxying. * **New Features** * Initialization prompts centralized into a shared helper, with a web-specific prompt variant. * Authenticated requests can optionally route via a provided external API key to access alternate models. * **Chores** * Added and exposed a preprocessing hook with a default no-op implementation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-19 22:57:38 -07:00
Aman Ganapathy	1de8a17183	Payments bulldozer txn rework (#1315) ... ### Object of this PR This PR is NOT a monolithic series of fixes for the payments suite + a complete rework. Its aims were a) introducing and robustly testing the bulldozer db system b) reworking the payments underlying architecture to use bulldozer for correctness and scalability c) Achieving parity with the old payments system excepting a few changes like ensuring correctness of the ledger algo There may still be some work to do with handling refunds, decoupling the concepts of purchases from that of products, and some other things. ### Ledger Algorithm This has been tuned and fixed. Item removals i.e negative item quantity changes will apply to the soonest expiring item grant i.e positive item quantity change. This is what is best for the user. Item grants can also expire, and when they expire we obviate whatever is left of their original capacity (meaning after all the removals that were applied to it). Our ledger algo is applied via Bulldozer, so automatic re-computation is handled when a new grant/ removal is inserted in the middle of the existing ones. ### Things we got rid of * No more automatic support for default products. You can use $0 plan provisions to accomplish the same effect but it's manual * Negative item quantity changes (i.e item removals) no longer can have expiries <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced payment processing pipeline with improved data consistency and state management. * Advanced refund handling with comprehensive transaction tracking. * Better tracking and management of customer item quantities and owned products. * Improved subscription lifecycle management including period-end handling. * **Bug Fixes** * Fixed payment data integrity verification. * Improved handling of edge cases in refund scenarios. * **Chores** * Updated cSpell configuration with additional words. * Expanded developer documentation for linting workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com> Co-authored-by: Aadesh Kheria <kheriaaadesh@gmail.com> Co-authored-by: Mantra <87142457+mantrakp04@users.noreply.github.com>	2026-04-17 22:11:21 +00:00
Mantra	55b14bb409	dev tool indicator (#1272) ... - Updated package versions for '@supabase/*' libraries to 2.99.2 and '@supabase/ssr' to 0.9.0. - Added new devDependencies for 'rimraf' and 'framer-motion' in the pnpm-lock file. - Modified Next.js configuration to conditionally omit 'X-Frame-Options' in development mode for better integration with Stack Auth dev tools. - Refactored component exports in the template package to include tracking for dev tools. - Introduced new dev tool components and context for improved logging and state management. - Added styles for the dev tool indicator and panel, ensuring a consistent dark theme. - Implemented fetch interception to log API calls and user authentication events in the dev tool. <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added comprehensive Developer Tools interface with tabs for Overview, Components, AI Chat, Console, Dashboard, and Support. * Integrated AI Chat assistant within Developer Tools for enhanced debugging. * Added component version tracking and update notifications. * Implemented API request logging and event monitoring. * Enhanced feedback system with support for bug reports and feature requests. * **Bug Fixes** * Fixed Content Security Policy headers for local development environments. * **Dependencies** * Added AI SDK integration packages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>	2026-04-13 17:43:03 -07:00
BilalG1	c2a5b5b40a	universal ai route through ai-proxy (#1312) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance Improvements** * Redesigned AI request processing to operate efficiently at the backend level, providing faster responses and improved reliability for AI-powered features * **Enhanced AI Capabilities** * Improved model validation and selection with explicit allowlist of supported models, enabling broader model availability and better feature stability * **Developer Updates** * Refreshed local development environment configuration <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-07 11:09:23 -07:00
Aman Ganapathy	7335040168	[Fix]: Deal with Result Admin Validation Sentry Noise for TrustedDomains by Nixing Read Validation (#1264) ... ### Context We get a lot of noise on sentry about the result admin validation failing from the onList handler. However, we no longer care about validating reads for trustedDomains. Via config pushes, people can set them to anything anyway. There's no value in being stricter on reads than on writes. ### Summary of Changes We scope our schema changes to just the onList and read handlers for trusted domains for the most part, though relaxing the params validation also affects delete. In practice, delete needs to do an exact match to find what needs to be deleted so this is fine. Also, without relaxing it for delete, you wouldn't be able to delete a domain you had previously put in.	2026-03-18 11:19:51 -07:00
BilalG1	f016cd8993	CLI init (#1242) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Interactive init workflow (create, link-config, link-cloud) with safe non-interactive behavior; writes/updates project config and .env, and prints STACK AUTH setup instructions. * CLI assistant/agent with a progress UI for long-running tasks. * Backend AI proxy endpoint that validates and forwards AI requests to an external provider. * **Tests** * End-to-end tests covering all init modes, outputs, env linking, and error cases. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-03-13 10:55:22 -07:00
BilalG1	b701fdfb0a	Managed email provider (#1222) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Managed email domain onboarding: setup, DNS provisioning, verification, status checks, and apply flow (Resend-backed). * **UI** * Project email settings: managed-provider setup dialog, managed sender fields, status display, and test-send mapping. * **Integrations** * DNS provider automation and Resend webhook handling for domain status updates; scoped keys for sending. * **API** * Admin endpoints / client APIs to setup, check, list, and apply managed email domains. * **Tests** * End-to-end tests covering the full onboarding flow. * **Chores** * Added environment variables and config schema support for Resend and DNS integrations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-03-09 20:23:11 -07:00
Aman Ganapathy	e9886bc45a	[Fix] [Refactor] Implement Base Settings for Stack-Auth Plans and Move Metadata from Stripe Webhook Event to Table (#1214) ... ### Context We're looking at implementing plan pricing. While doing so, we encountered a problem with Stripe. **Problem:** when we run a stripe operation (purchase), the product info is encoded as part of the stripe metadata request. Stripe encodes metadata as key-value pairs, and the [value has a limit of 500 chars](https://docs.stripe.com/metadata#data). We do this because once we run the stripe operation, stripe fires a webhook event which is caught by our stripe webhook handler syncStripeSubscriptions. This gets the stripe metadata info from the event and then updates our db in prisma. ### Summary of Changes We add a `ProductVersion` table and only pass the `productVersionId` via stripe metadata instead of the whole product json. This `productVersionId` is created by hashing the `productJson`. Since the same product may be ordered differently without being intrinsically different, we add a helper function for ensuring a canonical order to the json. We also pass tenancy id and product id to the table. Since there are existing subscriptions which used to pass the productJson via metadata, we ensure backwards compatibility.	2026-02-23 22:09:27 -08:00
Bilal Godil	7328ef2984	stripe webhook handling	2026-02-13 11:59:35 -08:00
Konstantin Wohlwend	43bb5fb48f	Add unknown Stripe webhook type to title	2026-01-27 17:30:28 -08:00
BilalG1	373fb48e7f	payment email templates (#1106) ... <img width="553" height="471" alt="Screenshot 2026-01-14 at 12 16 36 PM" src="https://github.com/user-attachments/assets/9f32473d-5294-4cf7-b527-0668fb04ae47" /> <img width="630" height="514" alt="Screenshot 2026-01-14 at 12 17 06 PM" src="https://github.com/user-attachments/assets/b17f57f7-148d-4438-b337-df7516d1793e" /> <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Expanded Stripe webhooks: handles invoice and one‑time/subscription events, sends templated payment receipt and failure emails, posts chargeback alerts to Telegram. * Customer invoices API plus client and UI support for listing invoices; backend stores invoice status, total, and hosted URL. * **Tests** * Added end‑to‑end tests for new webhook scenarios (receipts, failures, chargebacks) and invoices API with email outbox checks. * **Chores** * Centralized Telegram helpers and improved formatting, validation, and reliability. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > Introduces end-to-end invoice visibility and payment notifications. > > - **Emails:** Adds default `payment_receipt` and `payment_failed` templates and sends them from Stripe webhooks for one-time and subscription payments (skips non‑uncollectible failures); resolves recipients for users/teams. > - **Webhooks:** Expands handled events; upserts invoices on `invoice.*`; stricter unknown-type handling; adds Telegram chargeback alert; refactors init script Telegram sending. > - **Data model:** Extends `SubscriptionInvoice` with `status`, `amountTotal`, `hostedInvoiceUrl` and writes them via `upsertStripeInvoice`. > - **API/SDK/UI:** New paginated `GET /payments/invoices/{customer_type}/{customer_id}`; client interface (`listInvoices`, hooks) and template Payments panel render an invoices table. > - **Tests:** E2E for invoices access, webhook behaviors, and email delivery. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit edc8fe5651. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY -->	2026-01-20 18:45:01 -08:00
Konsti Wohlwend	b4ae80874e	Upgrade Prisma to v7 (#1064)	2025-12-26 08:13:34 -08:00
Konsti Wohlwend	e7e792d462	Email outbox backend (#1030)	2025-12-12 10:26:38 -08:00
Konstantin Wohlwend	95279a6a8f	Disallow invalid wildcard protocols	2025-11-18 17:19:00 -08:00
BilalG1	243caf9a23	Payment transactions (#990) ... https://www.loom.com/share/db645a1799454ec6b0234c55ee28cee9 <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Multi-currency, entry-based transaction model; unified transaction builders. - Refund API for subscriptions and one-time purchases; Stripe invoice handling and webhook invoice-paid processing. - **Refactor** - Admin UI and SDK migrated to the new transaction shape; table rendering simplified with summary-driven columns and avatar cells. - **Bug Fixes** - Improved aggregation, sorting and cursor pagination across mixed transaction sources; refund state handling. - **Tests** - Expanded end-to-end tests, webhook simulation helpers, and snapshot updates. - **Chores** - Database migrations for subscription invoices and refundedAt fields. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > Replaces AdminTransaction with a unified, entry-based Transaction model, updates the backend route/builders, admin SDK, dashboard table, and tests (incl. filtering and serializer tweaks). > > - **Backend**: > - **Entry-based transactions**: Add `transaction-builder.ts` to build `Transaction` objects (product grants, money transfers, item quantity changes) with multi-currency amounts and `effective_at_millis`/`adjusted_by`. > - **API**: `/internal/payments/transactions` now returns `transactionSchema`, supports filtering by `TRANSACTION_TYPES`, merges sources, and preserves concatenated-cursor pagination. > - **Shared (stack-shared)**: > - Add `transactionEntrySchema`, `transactionSchema`, `TRANSACTION_TYPES`, and `TransactionType`; remove `AdminTransaction` surface. > - **Admin SDK/Template**: > - Update `listTransactions` signatures, caches, and types to use `Transaction`/`TransactionType` across interfaces and app implementations. > - **Dashboard UI**: > - Refactor transaction table to new model: iconified type, avatar customer cells, amount/details columns, and filters for type and customer. > - **Tests**: > - Update e2e snapshots to new `Transaction` shape; add tests for type/customer filters and server-granted subscriptions; serializer now strips `effective_at_millis`. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit c914d11c0f. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-11-18 12:11:01 -08:00
Konsti Wohlwend	8a77e07f19	Rename offer to product, offer group to product catalog (#914) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- RECURSEML_SUMMARY:START --> ## High-level PR Summary This PR implements a comprehensive renaming of "offer" to "product" and "offer group" to "product catalog" throughout the codebase. The changes include database migrations, schema updates, API compatibility layers, function renames, and updates to client and server implementations. Backwards compatibility is maintained through migration layers that handle requests using the old terminology, translating them to the new terminology before processing. The PR includes documentation of this approach in CLAUDE-KNOWLEDGE.md. This rename affects multiple parts of the system including the database schema, API endpoints, error types, and SDK interfaces. ⏱️ Estimated Review Time: 1-3 hours <details> <summary>💡 Review Order Suggestion</summary> | Order | File Path | |-------|-----------| | 1 | `apps/backend/prisma/migrations/20250923191615_rename_offers_to_products/migration.sql` | | 2 | `apps/backend/src/app/api/migrations/v2beta1/payments/purchases/offers-compat.ts` | | 3 | `apps/backend/src/app/api/migrations/v2beta1/payments/purchases/create-purchase-url/route.ts` | | 4 | `apps/backend/src/app/api/migrations/v2beta1/payments/purchases/validate-code/route.ts` | | 5 | `apps/backend/src/lib/payments.tsx` | | 6 | `.claude/CLAUDE-KNOWLEDGE.md` | | 7 | `packages/stack-shared/src/schema-fields.ts` | | 8 | `packages/stack-shared/src/known-errors.tsx` | | 9 | `packages/stack-shared/src/config/schema.ts` | | 10 | `packages/template/src/lib/stack-app/customers/index.ts` | | 11 | `packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts` | | 12 | `packages/template/src/lib/stack-app/apps/implementations/server-app-impl.ts` | </details> [](https://discord.gg/n3SsVDAW6U) <!-- RECURSEML_SUMMARY:END --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Renames 'offer' to 'product' and 'offer group' to 'product catalog' across the codebase, updating database schema, API endpoints, and application logic for consistency and backward compatibility. > > - **Database**: > - Rename columns `offer` to `product` and `offerId` to `productId` in `OneTimePurchase` and `Subscription` tables in `migration.sql`. > - **API & Migrations**: > - Update API endpoints to accept `product_id`/`product_inline` instead of `offer_id`/`offer_inline`. > - Add `v2beta5` compatibility layer to map legacy `offer` fields to `product` equivalents. > - **Shared Schemas**: > - Rename `offerSchema` to `productSchema` and related schemas in `schema-fields.ts`. > - **Server Implementation**: > - Update `createCheckoutUrl` method in `server-app-impl.ts` to use `productId`/`InlineProduct`. > - **Tests**: > - Update tests to reflect renaming in `backend-helpers.ts` and other test files. > - **Miscellaneous**: > - Remove dummy data related to offers in `dummy-data.tsx`. > - Update documentation and comments to reflect terminology changes. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for e3227bcbd2. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Backwards-compatibility: legacy offer_id/offer_inline requests are accepted, normalized, and routed to product-based handlers. * **Refactor** * Global rename from Offer/Group → Product/Catalog across UI, APIs, types, client/server interfaces, and error codes. * **Bug Fixes** * Responses, webhooks and UI consistently surface product_display_name and product-related metadata. * **Documentation** * Migration notes and docs updated to explain compatibility and parameter changes. * **Tests** * Unit and E2E suites updated to cover product/catalog flows. * **Chores** * Database schema migration, seed and config updates applied. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > Renames offers→products and groups→catalogs end-to-end (DB, APIs, schemas, UI, SDK, docs), adding v2beta5 compatibility to accept legacy offer fields while updating all internals. > > - **Backend/DB**: > - Prisma migration: rename `offer`/`offerId`→`product`/`productId` in `OneTimePurchase` and `Subscription`. > - Update Stripe webhook, purchase-session, and internal test-mode flows to use `product*` metadata/fields. > - **API & Migrations**: > - Latest endpoints now accept `product_id`/`product_inline`. > - Add `v2beta5` compat layer mapping legacy `offer_id`/`offer_inline` to product equivalents; responses alias conflicting products. > - **Shared Schemas/Errors/Config**: > - `offerSchema`→`productSchema`, `inlineOfferSchema`→`inlineProductSchema`, prices/types renamed. > - KnownErrors renamed (e.g., `PRODUCT_DOES_NOT_EXIST`). > - Config: `groups`→`catalogs`, defaults/migrations updated; improved override validation messages; ID regex loosened; formatter tweaks; add schema fuzzer tests. > - **Payments Lib**: > - Rename APIs and logic (`offers`→`products`, `groupId`→`catalogId`), subscription and item-quantity computation updated. > - **Dashboard/UI**: > - Routes, dialogs, editors, tables, and code samples switched to products/catalogs; removed offers dummy data. > - **SDK/Template**: > - Client/server `createCheckoutUrl` now uses `productId`/`InlineProduct`. > - **Tests/Docs/Utilities**: > - E2E and unit tests updated; add legacy (pre-rename) tests. > - Docs and knowledge base revised; minor script tweaks (recent-first, limits). > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit e6e20ecd72. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: BilalG1 <bg2002@gmail.com>	2025-10-04 02:28:28 -07:00
BilalG1	ad34cfecc2	Transactions page (#900) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- RECURSEML_SUMMARY:START --> ## High-level PR Summary This PR adds a new `priceId` field to the `OneTimePurchase` and `Subscription` models in the database to store Stripe price identifiers. The change includes database schema updates, corresponding migration files, and modifications to payment processing logic to properly track and store price IDs throughout the purchase flow. The implementation consistently propagates the price ID from Stripe's API responses through various payment processing endpoints and webhooks handlers, ensuring the data is properly stored and synced with the database models. ⏱️ Estimated Review Time: 15-30 minutes <details> <summary>💡 Review Order Suggestion</summary> | Order | File Path | |-------|-----------| | 1 | `apps/backend/prisma/schema.prisma` | | 2 | `apps/backend/prisma/migrations/20250917193043_store_price_id/migration.sql` | | 3 | `apps/backend/src/lib/stripe.tsx` | | 4 | `apps/backend/src/app/api/latest/payments/purchases/purchase-session/route.tsx` | | 5 | `apps/backend/src/app/api/latest/internal/payments/test-mode-purchase-session/route.tsx` | | 6 | `apps/backend/src/app/api/latest/integrations/stripe/webhooks/route.tsx` | | 7 | `apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts` | </details> <!-- RECURSEML_SUMMARY:END --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Add `priceId` field to track Stripe price identifiers in purchase and subscription models, updating schema, payment logic, and tests. > > - **Database Changes**: > - Add `priceId` field to `OneTimePurchase` and `Subscription` models in `schema.prisma`. > - Update database schema with migration `20250917193043_store_price_id/migration.sql`. > - **Payment Processing**: > - Update `processStripeWebhookEvent()` in `webhooks/route.tsx` to handle `priceId`. > - Modify `POST` handlers in `purchase-session/route.tsx` and `test-mode-purchase-session/route.tsx` to include `priceId` in metadata. > - Update `syncStripeSubscriptions()` in `stripe.tsx` to sync `priceId`. > - **Testing**: > - Add tests in `stripe-webhooks.test.ts` to validate `priceId` handling in webhook and purchase flows. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 4950494d62. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- RECURSEML_ANALYSIS:START --> ## Review by RecurseML _🔍 Review performed on [e48ffa6..4950494](e48ffa67ee...4950494d62)_ | &nbsp; Severity &nbsp; | &nbsp; Location &nbsp; | &nbsp; Issue &nbsp; | &nbsp; Delete &nbsp; | |:----------:|----------|-------|:--------:| |  | [apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts:153](https://github.com/stack-auth/stack-auth/pull/900#discussion_r2356623574) | The field `priceId` uses camelCase instead of the required snake_case for API parameters | [ | |  | [apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts:245](https://github.com/stack-auth/stack-auth/pull/900#discussion_r2356623664) | The field `priceId` uses camelCase instead of the required snake_case for API parameters | [ | |  | [apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts:358](https://github.com/stack-auth/stack-auth/pull/900#discussion_r2356623721) | The field `priceId` uses camelCase instead of the required snake_case for API parameters | [ | <details> <summary>✅ Files analyzed, no issues (4)</summary> • `apps/backend/src/lib/stripe.tsx` • `apps/backend/src/app/api/latest/payments/purchases/purchase-session/route.tsx` • `apps/backend/src/app/api/latest/integrations/stripe/webhooks/route.tsx` • `apps/backend/src/app/api/latest/internal/payments/test-mode-purchase-session/route.tsx` </details> <details> <summary>⏭️ Files skipped (trigger manually) (2)</summary> | &nbsp; Locations &nbsp; | &nbsp; Trigger Analysis &nbsp; | |-----------|:------------------:| `apps/backend/prisma/migrations/20250917193043_store_price_id/migration.sql` | [ `apps/backend/prisma/schema.prisma` | [ </details> [](https://discord.gg/n3SsVDAW6U) <!-- RECURSEML_ANALYSIS:END --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Persist the selected price ID with one-time purchases and subscriptions. - Carry the price ID through payment flows and Stripe metadata for better tracking and reporting. - Test mode purchases now also record the price ID. - Chores - Database migration adds a price ID field to purchase and subscription records. - Tests - Updated end-to-end tests to validate price ID handling in webhook and purchase flows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2025-09-20 07:01:07 +00:00
BilalG1	b2f8b96d41	one time payments (#865) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Add support for one-time payments alongside subscriptions, including database, API, and test updates. > > - **Behavior**: > - Support for one-time purchases added alongside subscriptions. > - Purchase sessions now accept a quantity parameter for both normal and test-mode flows. > - Dashboard checkout auto-selects payment or subscription mode based on price. > - **Database**: > - New `OneTimePurchase` table created in `migration.sql`. > - `PurchaseCreationSource` enum replaces `SubscriptionCreationSource` in `schema.prisma`. > - **API**: > - `processStripeWebhookEvent()` in `route.tsx` handles one-time purchase webhooks. > - `purchase-session/route.tsx` and `test-mode-purchase-session/route.tsx` updated for one-time purchases. > - **Tests**: > - E2E tests added for one-time payments, stackability, and webhook handling in `purchase-session.test.ts` and `stripe-webhooks.test.ts`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 726ebe2328. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * One-time purchases persisted and supported end-to-end; purchase sessions accept quantity (default 1). Dashboard checkout auto-selects payment vs subscription mode. * **Bug Fixes** * Centralized Stripe webhook handling with deduplication for retried payment intents. Improved conflict resolution when switching offers within groups; add-on and group rules enforced. * **Tests** * Expanded E2E and unit tests covering one-time flows, stackability, test-mode paths, and webhook scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>	2025-09-12 17:14:09 -07:00
BilalG1	99c69b9c2f	encrypt neon connection strings, update connections route (#879) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Add secure Neon connection string handling and update connection routes with new APIs and tests. > > - **Features**: > - Add Neon integration APIs in `route.tsx` for project provisioning and branch connection string registration. > - Securely store Neon connection strings in a data vault in `prisma-client.tsx` and `seed.ts`. > - Automatically run migrations on provision/update in `route.tsx`. > - **Refactor**: > - Change schema resolution to asynchronous in `crud.tsx` and `metrics/route.tsx`. > - **Chores**: > - Add backend environment variables for various services in `package.json`. > - Add new backend dependency `@stackframe/stack` in `package.json`. > - **Tests**: > - Add end-to-end tests for Neon provisioning and updates in `provision.test.ts`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 4cd96a74ff. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Added Neon integration APIs to provision projects and register branch connection strings. - Securely store Neon connection strings in the data vault and run migrations automatically on provision/update. - Refactor - Switched schema resolution to asynchronous calls across sessions, users, and internal metrics for improved reliability. - Chores - Introduced comprehensive backend environment variables for auth, email, storage, webhooks, telemetry, and payments. - Added a new backend dependency for stack integration. - Tests - Expanded end-to-end coverage for Neon provisioning, updates, validation, and vault-based decryption. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-09-09 21:35:07 +00:00
BilalG1	db02f71b73	payments schema changes, ledger algo, stackable items (#862) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Enhances payments system with stackable items, Stripe account management, and improved purchase flow, including schema updates and new tests. > > - **Behavior**: > - Adds quantity support for stackable offers in `apps/backend/src/lib/payments.tsx` and `apps/backend/src/app/api/latest/payments/purchases/purchase-session/route.tsx`. > - Introduces Stripe account info viewing and onboarding in `apps/backend/src/app/api/latest/internal/payments/stripe/account-info/route.ts`. > - Implements "Include by default" pricing and "Plans" group in `apps/backend/prisma/seed.ts`. > - **Schema Changes**: > - Adds `quantity` and `offerId` columns to `Subscription` table in `apps/backend/prisma/migrations/20250821212828_subscription_quantity/migration.sql` and `apps/backend/prisma/migrations/20250822203223_subscription_offer_id/migration.sql`. > - Adds `stripeAccountId` column to `Project` table in `apps/backend/prisma/migrations/20250825221947_stripe_account_id/migration.sql`. > - **Improvements**: > - Enhances purchase flow to return Stripe `client_secret` and handle subscription upgrades/downgrades in `apps/backend/src/app/api/latest/payments/purchases/purchase-session/route.tsx`. > - Updates item management with new actions and protections in `apps/backend/src/app/api/latest/payments/items/[customer_type]/[customer_id]/[item_id]/update-quantity/route.ts`. > - Tightens validation for customer type and offer conflicts in `apps/backend/src/app/api/latest/payments/purchases/validate-code/route.ts`. > - **Testing**: > - Adds extensive tests for new payment features in `apps/e2e/tests/backend/endpoints/api/v1/internal/payments/setup.test.ts` and `apps/e2e/tests/backend/endpoints/api/v1/payments/purchase-session.test.ts`. > - **Misc**: > - Removes unused `stripeAccountId` and `stripeAccountSetupComplete` from `branchPaymentsSchema` in `packages/stack-shared/src/config/schema.ts`. > - Refactors currency constants into `currency-constants.tsx` in `packages/stack-shared/src/utils`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 264563541d. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Quantity support for stackable offers across checkout, test purchases, and admin flows. - View Stripe account info and interactive payments onboarding per project. - "Include-by-default" pricing and new "Plans" group (Free, Extra Admins). - **Improvements** - Purchase flow returns Stripe client_secret and handles group-based subscription upgrades/downgrades. - Item management: Update Customer Quantity action, edit/delete protections, and read-only form mode. - Validation surfaces offer conflicts (already_bought_non_stackable, conflicting_group_offers). - **Changes** - Default item quantities now start at 0 unless explicitly granted. - Stripe account linkage is stored per project. - **Tests** - Expanded tests for quantities, stackable behavior, and group transition scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com>	2025-08-27 20:13:22 +00:00
Konsti Wohlwend	d5874b64b1	Project config override size limit (#861)	2025-08-25 11:35:39 -07:00
Konsti Wohlwend	284d85247a	Improved anonymous users (#857)	2025-08-24 11:36:01 -07:00
BilalG1	9e538a08e5	project owner team (#835) ... <img width="1920" height="968" alt="Screenshot 2025-08-12 at 10 44 41 AM" src="https://github.com/user-attachments/assets/3fb59810-45d8-46e1-9cfd-5a1a34936887" /> <!-- ELLIPSIS_HIDDEN --> > [!IMPORTANT] > Introduces team-based project ownership, refactoring existing user-based model, and updates UI, backend, and tests to support this feature. > > - **Behavior**: > - Introduced team-based ownership for projects, replacing user-based ownership. > - Updated project creation, transfer, and deletion flows to use team ownership. > - Added team selection UI during project creation in the dashboard. > - Projects now display owning team's name and include "owner team" field in API responses. > - **Refactor**: > - Enhanced backend and schema for team-based project management. > - Removed legacy user metadata updates related to project ownership. > - Modified project listing and management to rely on team associations. > - Streamlined failed emails digest and contact channel queries to resolve contacts via team membership. > - **Tests**: > - Updated tests to validate team ownership and project-user association handling. > - Adjusted test snapshots and assertions for non-null selected team data. > - Improved test flows for authentication and project deletion with team context. > - **Chores**: > - Minor improvements to logging and code clarity. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for e457b13b69. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> > [!IMPORTANT] > Introduces team-based project ownership, refactoring existing user-based model, and updates UI, backend, and tests to support this feature. > > - **Behavior**: > - Introduced team-based project ownership, replacing user-based ownership. > - Updated project creation, transfer, and deletion flows to use team ownership. > - Added team selection UI during project creation in the dashboard. > - Projects now display owning team's name and include "owner team" field in API responses. > - **Refactor**: > - Enhanced backend and schema for team-based project management. > - Removed legacy user metadata updates related to project ownership. > - Modified project listing and management to rely on team associations. > - Streamlined failed emails digest and contact channel queries to resolve contacts via team membership. > - **Tests**: > - Updated tests to validate team ownership and project-user association handling. > - Adjusted test snapshots and assertions for non-null selected team data. > - Improved test flows for authentication and project deletion with team context. > - **Chores**: > - Minor improvements to logging and code clarity. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 0f6f12b5dc. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Team-based project ownership: teams can own projects; UI to pick a team when creating projects; dashboard groups projects by team; TeamSwitcher component added. * **Improvements** * API and responses now include owner_team_id and populated selected_team/selected_team_id; provisioning and transfer flows assign teams for ownership; seeds create internal/emulator owner teams. * **Tests** * E2E and backend tests updated to reflect team ownership and enriched team fields. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-08-19 11:42:11 -07:00
Konstantin Wohlwend	e6e30d012d	Neon source-of-truth initialization ... Closes #838	2025-08-11 12:31:48 -07:00
BilalG1	2b541516bf	Payment tests, account status, smartRoutes (#828) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Introduce comprehensive payment and subscription management with Stripe integration, including new models, API endpoints, UI components, and extensive tests. > > - **Features**: > - Add Stripe integration for payments and subscriptions in `apps/backend/src/lib/stripe.tsx` and `apps/backend/src/app/api/latest/integrations/stripe/webhooks/route.tsx`. > - Implement payment offers and items management in `apps/backend/src/app/api/latest/payments`. > - Add UI components for payment management in `apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/payments`. > - **Models**: > - Add `Subscription` model in `prisma/schema.prisma` and `prisma/migrations/20250805195319_subscriptions/migration.sql`. > - **Tests**: > - Add end-to-end tests for payment APIs in `apps/e2e/tests/backend/endpoints/api/v1/payments`. > - **Configuration**: > - Update environment variables in `.env.development` and `docker.compose.yaml` for Stripe. > - **Misc**: > - Add new known errors related to payments in `known-errors.tsx`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 972c24854f. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced comprehensive payments and subscriptions management with Stripe integration. * Added UI for managing payment offers, items, and purchase URLs in the dashboard. * Implemented Stripe onboarding, purchase sessions, and return flow handling. * Added Stripe Connect and Elements integration with theme-aware UI components. * **Bug Fixes** * Enhanced validation and error handling for payments APIs and customer/item type consistency. * **Tests** * Added extensive end-to-end and backend tests for payments and purchase-related endpoints. * **Chores** * Updated environment variables and dependencies for Stripe support. * Added Stripe mock service to development Docker Compose. * **Documentation** * Extended schemas and types for payment offers, prices, items, and customer types. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Konstantin Wohlwend <n2d4xc@gmail.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>	2025-08-08 18:13:22 -07:00
Zai Shi	2b5eebcd22	Config override CRUD (#803) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Add admin-only API endpoints and UI support for project configuration overrides, with comprehensive tests and documentation updates. > > - **New Features**: > - Added admin-only API endpoints for reading and updating project configuration overrides in `config/crud.tsx` and `config/override/crud.tsx`. > - Admin app supports fetching, caching, and updating configuration overrides with new React hooks in `admin-app-impl.ts`. > - **Bug Fixes**: > - Validation and error handling for OAuth providers, duplicate IDs, and invalid config fields in `oauth-providers/crud.tsx`. > - **Tests**: > - Added end-to-end tests for configuration management and validation errors in `config.test.ts` and `js/config.test.ts`. > - **Documentation**: > - Updated API documentation for new config override endpoints in `config.ts`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 3d20abc092. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added the ability for admins to view and update project configuration overrides through new internal API endpoints. * Extended the admin app to support fetching, updating, and caching configuration overrides, including React hook support for real-time config usage. * Introduced new admin interface methods for retrieving and updating configuration. * **Bug Fixes** * Improved validation and error handling for configuration updates, including checks for duplicate or invalid OAuth provider entries and non-existent configuration fields. * **Tests** * Added comprehensive end-to-end tests covering configuration retrieval, updates, access control, OAuth provider management, and domain management. * **Documentation** * Enhanced API documentation for configuration management endpoints and operations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-08-01 18:28:27 +02:00
Konstantin Wohlwend	7c14504098	Do-not-delete warning on external projects	2025-07-31 15:50:57 -07:00
Konstantin Wohlwend	9399b84f97	Use retryTransaction instead of $transaction	2025-07-31 15:43:48 -07:00
Shridhar Deshmukh	8f55c1e710	fix: update super-admin-key name for neon auth (#809) ... Deleting super-secrete-admin-key breaks the integration with Neon Auth. This Pull request adds warning to key name to not delete it.	2025-07-31 13:15:57 -07:00
Zai Shi	7226c40d0a	Remove legacy tenancy config (#802) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Refactor tenancy configuration structure, affecting authentication, email, domain, OAuth, and permissions settings, with updates to feature flag checks, property access, and test assertions. > > - **Refactor**: > - Updated configuration structure for authentication, email, domain, OAuth, and permissions settings, affecting feature flag checks and property access in `handlers.tsx`, `route.tsx`, and `crud.tsx`. > - Improved handling of domain and OAuth provider configurations for integrations and CRUD operations. > - Adjusted redirect URL validation and origin checks to use updated tenancy configuration. > - Transformed project and tenancy configuration data returned by API handlers for consistency. > - Centralized email theme and template retrieval from updated configuration paths. > - **Bug Fixes**: > - Corrected error messages related to OTP sign-in feature availability. > - **Tests**: > - Updated test assertions to match new error messages for OTP sign-in. > - **Chores**: > - Reorganized import statements and updated internal logic to align with new configuration structure. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for ae04ae28be. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> ---- <!-- ELLIPSIS_HIDDEN --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated configuration structure for authentication, email, domain, OAuth, and permissions settings, resulting in changes to feature flag checks and property access throughout the backend. * Improved handling of domain and OAuth provider configurations for integrations and CRUD operations. * Adjusted redirect URL validation and origin checks to use updated tenancy configuration. * Transformed project and tenancy configuration data returned by API handlers for consistency. * Centralized email theme and template retrieval from updated configuration paths. * Simplified redirect URL validation calls by passing tenancy objects directly. * Updated passkey, password, OTP, and OAuth feature flag checks to new nested configuration properties. * **Bug Fixes** * Corrected error messages related to OTP sign-in feature availability. * **Tests** * Updated test assertions to match new error messages for OTP sign-in. * **Chores** * Reorganized import statements and updated internal logic to align with new configuration structure. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>	2025-07-31 20:06:33 +02:00
Zai Shi	a7acab4646	Auto migration (#526) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Introduces an automated database migration system, replacing manual Prisma commands with new scripts and updating workflows, configurations, and tests accordingly. > > - **Auto-Migration System**: > - Introduces `db-migrations.ts` script for handling database migrations automatically. > - Adds utility functions in `utils.tsx` for managing migration files. > - Implements `applyMigrations` and `runMigrationNeeded` in `index.tsx` for executing migrations. > - **Workflow and Scripts**: > - Updates GitHub workflows (`check-prisma-migrations.yaml`, `e2e-api-tests.yaml`) to use new migration commands. > - Replaces `prisma migrate` commands with `db:init`, `db:migrate`, etc., in `package.json` and `README.md`. > - **Testing**: > - Adds `auto-migration.tests.ts` for testing migration logic and concurrency handling. > - **Configuration**: > - Updates `.env.development` and `vitest.config.ts` for new environment variables and paths. > - Modifies `turbo.json` and `package.json` to include new migration tasks and scripts. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 2c24183879. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> <!-- ELLIPSIS_HIDDEN --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com> Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>	2025-07-24 02:38:37 +02:00
Konsti Wohlwend	a7ef394be4	Source of Truth (#660) ... Co-authored-by: Zai Shi <zaishi00@outlook.com>	2025-07-11 17:59:03 -07:00
Shridhar Deshmukh	daff52250e	feat: new api endpoints to get and update neon managed projects (#751) ... Added GET and PATCH endpoint for Neon managed project with `secret-admin-key` auth. The API handler is same as internal projects API - `/internal/projects/current`	2025-07-10 17:41:35 +00:00
Zai Shi	a16589e469	Refactor project integration identifiers from externalProjectId to clientId across the backend, including environment configuration, database schema, and API endpoints. Update test cases to reflect these changes for both custom and Neon integrations.	2025-05-26 13:03:30 -07:00
Zai Shi	6c02787f70	Update API key description for external integrations in project provisioning	2025-05-23 14:24:46 -07:00
Zai Shi	16e14240bf	General project provisioning (#694) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > This pull request adds support for custom integrations alongside Neon, including environment updates, database schema changes, new API endpoints, and comprehensive tests. > > - **Environment**: > - Renamed `STACK_NEON_INTEGRATION_CLIENTS_CONFIG` to `STACK_INTEGRATION_CLIENTS_CONFIG` in `.env.development`. > - Added `custom-local` client configuration to `STACK_INTEGRATION_CLIENTS_CONFIG`. > - **Database**: > - Renamed `NeonProvisionedProject` table to `ProvisionedProject` and updated related constraints and columns in `migration.sql`. > - Updated `schema.prisma` to reflect table and column renames. > - **API Endpoints**: > - Added CRUD operations for custom domains in `domains/`. > - Implemented OAuth authorization and token exchange for custom integrations in `oauth/`. > - Added project provisioning and transfer endpoints for custom integrations in `projects/`. > - **IDP**: > - Updated `createOidcProvider` to handle both Neon and custom integrations in `idp.ts`. > - **Tests**: > - Added e2e tests for custom domain, OAuth, project provisioning, and transfer in `e2e/tests/backend/endpoints/api/v1/integrations/custom/`. > - Updated snapshot serializer to handle custom integration paths in `snapshot-serializer.ts`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 7da89c38eb. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> <!-- ELLIPSIS_HIDDEN --> --------- Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-05-23 23:23:14 +02:00
Zai Shi	b15fea3ac9	Domain should be always defined in neon domain crud endpoint (#683) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Ensure `domain` is always defined in neon domain CRUD operations and add test for missing domain case. > > - **Schema Changes**: > - Update `domainReadSchema` and `domainCreateSchema` in `crud.tsx` to ensure `domain` is always defined. > - **Tests**: > - Add test case in `domain.test.ts` to verify failure when `domain` is not specified in the request body. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for defea9d0dd. You can [customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this summary. It will automatically update as commits are pushed.</sup> <!-- ELLIPSIS_HIDDEN --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-05-23 18:41:33 +02:00
Konsti Wohlwend	bae04178cc	Endpoints branching (#659) ... Co-authored-by: Zai Shi <zaishi00@outlook.com> Co-authored-by: moritz <moritsch@student.ethz.ch>	2025-04-30 15:39:47 -07:00
Konsti Wohlwend	f3f2adcee7	Remove SmartRequest.auth.project.config (#658) ... Co-authored-by: Zai Shi <zaishi00@outlook.com> Co-authored-by: moritz <moritsch@student.ethz.ch>	2025-04-30 15:31:15 -07:00
Zai Shi	d9e2dae4c6	Config DB migration step 2 (#629) ... Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com> Co-authored-by: moritz <moritsch@student.ethz.ch>	2025-04-29 14:52:45 -07:00
Konstantin Wohlwend	512e0113fc	Fix flakey tests	2025-04-22 18:03:53 -07:00
Moritz Schneider	d242292ab6	Implement api key revocation endpoint (#614) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Add API endpoint to revoke API keys found through credential scanning, with email notifications and error handling. > > - **Behavior**: > - Adds `POST` endpoint in `route.tsx` to revoke API keys found through credential scanning. > - Handles errors for non-existent, public, expired, and already revoked API keys. > - Sends email notifications to affected users or team members. > - **Email**: > - Adds `getSharedEmailConfig()` in `emails.tsx` for shared email configuration. > - **Testing**: > - Adds tests in `revoke.test.ts` for user and team API key revocation, including email notifications and error handling for non-existent and already revoked keys. > - **Errors**: > - Adds `PublicApiKeyCannotBeRevoked` error in `known-errors.tsx`. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for a67021bf47. It will automatically update as commits are pushed.</sup> <!-- ELLIPSIS_HIDDEN --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-04-12 01:08:31 +00:00
Zai Shi	61bc0de8f4	Config DB (#568) ... - Added new config json schema and helper functions - Separated the internal project and client project so we can later change the internal project APIs without breaking backward compatibility - Added database to config json and config json to project type so we can test and compare the result in production Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-04-10 19:38:25 +02:00
Moritz Schneider	592d259dde	Api Keys (#590) ... <!-- Make sure you've read the CONTRIBUTING.md guidelines: https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md --> <img width="1510" alt="image" src="https://github.com/user-attachments/assets/99619123-6be5-4788-aebe-5fc2a9a36245" /> <img width="1510" alt="image" src="https://github.com/user-attachments/assets/660677bf-f19a-4673-94c8-59ac50eb6ae5" /> <img width="1510" alt="image" src="https://github.com/user-attachments/assets/11ae63c4-5813-4fd8-aa01-fa580d2103be" /> <!-- ELLIPSIS_HIDDEN --> ---- > [!IMPORTANT] > Introduces API key management for users and teams, integrating with existing project configurations and permissions, and adds comprehensive tests and examples. > > - **API Key Management**: > - Introduces `ProjectApiKey` model in `schema.prisma` for managing API keys. > - Adds `createApiKeyHandlers` in `handlers.tsx` to handle API key CRUD operations. > - Implements API key creation, revocation, and validation logic. > - **Permissions and Configurations**: > - Adds `allowUserApiKeys` and `allowTeamApiKeys` to `ProjectConfig` in `schema.prisma`. > - Updates `TeamSystemPermission` enum to include `MANAGE_API_KEYS`. > - Ensures API key operations respect project configurations and user/team permissions. > - **Testing and Examples**: > - Adds extensive tests in `api-keys.test.ts` to cover various API key scenarios. > - Updates example projects to demonstrate API key usage. > - **Miscellaneous**: > - Refactors existing code to integrate API key functionalities. > - Updates documentation and type definitions to reflect new API key features. > > <sup>This description was created by </sup>[<img alt="Ellipsis" src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup> for 96f60c57f0. It will automatically update as commits are pushed.</sup> <!-- ELLIPSIS_HIDDEN --> --------- Co-authored-by: Konsti Wohlwend <n2d4xc@gmail.com>	2025-04-04 13:03:10 -07:00
Zai Shi	f28d47c36b	Fix OTP docs (#565)	2025-03-21 01:23:39 +01:00