feat: continue restart plan

Author: gustavotoyota

new-deepnotes/PLAN_PROGRESS.md

@@ -15,7 +15,8 @@
     "@deepnotes/db": "workspace:*",
     "@deepnotes/session": "workspace:*",
     "@upstash/redis": "^1.34.8",
-    "hono": "^4.7.7"
+    "hono": "^4.7.7",
+    "stripe": "^17.7.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250426.0",

new-deepnotes/apps/api-worker/package.json

@@ -157,6 +157,9 @@ describe("api-worker", () => {
     ["POST", "/api/users/me/2fa/recovery-codes"],
     ["POST", "/api/users/me/2fa/devices/forget"],
     ["POST", "/api/users/me/2fa/disable"],
+    ["POST", "/api/billing/stripe/checkout-session"],
+    ["POST", "/api/billing/stripe/portal-session"],
+    ["POST", "/api/webhooks/stripe"],
   ] as const)("returns 503 for %s %s when auth env is not configured", async (method, path) => {
     const res = await app.request(`http://test${path}`, { method });
     expect(res.status).toBe(503);

new-deepnotes/apps/api-worker/src/index.test.ts

@@ -36,15 +36,22 @@ import {
   userEmailChangeRequestSchema,
   userPasswordChangeRequestSchema,
   userRegisterRequestSchema,
+  stripeCheckoutSessionRequestSchema,
 } from "@deepnotes/api";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import { Hono } from "hono";
 import type { PageMoveBody } from "@deepnotes/session";
+import Stripe from "stripe";
 
 import { getDbForConnectionString } from "./db-pool.js";
 import { readCookieHeader } from "./cookies.js";
 import { getSessionRedisPort } from "./redis-port.js";
-import { getSessionEnv, type WorkerSessionBindings } from "./session-env.js";
+import {
+  getSessionEnv,
+  getStripeBillingEnv,
+  getStripeWebhookSecret,
+  type WorkerSessionBindings,
+} from "./session-env.js";
 
 type Bindings = WorkerSessionBindings & {
   /** Wired in `wrangler.toml`; optional in unit tests that do not pass `env`. */
@@ -527,6 +534,7 @@ app.post("/api/users/me/email-change/confirm", async (c) => {
 
   try {
     const { performUserEmailChangeConfirm } = await import("@deepnotes/session");
+    const stripeKey = c.env.STRIPE_SECRET_KEY;
     const { cookieLines } = await performUserEmailChangeConfirm({
       db,
       env: sessionEnv,
@@ -536,6 +544,13 @@ app.post("/api/users/me/email-change/confirm", async (c) => {
       newLoginHash: parsed.data.newLoginHash,
       newEncryptedPrivateKeyring: parsed.data.userEncryptedPrivateKeyring,
       newEncryptedSymmetricKeyring: parsed.data.userEncryptedSymmetricKeyring,
+      updateStripeCustomerEmail:
+        stripeKey != null && stripeKey.length > 0
+          ? async (customerId: string, newEmail: string) => {
+              const stripe = new Stripe(stripeKey);
+              await stripe.customers.update(customerId, { email: newEmail });
+            }
+          : undefined,
     });
     const res = c.body(null, 204);
     appendSetCookies(res, cookieLines);
@@ -603,11 +618,19 @@ app.delete("/api/users/me", async (c) => {
 
   try {
     const { performUserAccountDelete } = await import("@deepnotes/session");
+    const stripeKey = c.env.STRIPE_SECRET_KEY;
     const { cookieLines } = await performUserAccountDelete({
       db,
       env: sessionEnv,
       accessCookie: readCookieHeader(cookieHeader, "accessToken"),
       loginHash,
+      deleteStripeCustomer:
+        stripeKey != null && stripeKey.length > 0
+          ? async (customerId: string) => {
+              const stripe = new Stripe(stripeKey);
+              await stripe.customers.del(customerId);
+            }
+          : undefined,
     });
     const res = c.body(null, 204);
     appendSetCookies(res, cookieLines);
@@ -3460,4 +3483,173 @@ app.post("/api/users/me/2fa/disable", async (c) => {
   }
 });
 
+const billingNotConfiguredBody = {
+  code: "SERVICE_UNAVAILABLE" as const,
+  message:
+    "Stripe billing is not configured. Set STRIPE_SECRET_KEY, STRIPE_MONTHLY_PRICE_ID, and STRIPE_YEARLY_PRICE_ID (Wrangler secrets / .dev.vars).",
+} as const;
+
+const stripeWebhookNotConfiguredBody = {
+  code: "SERVICE_UNAVAILABLE" as const,
+  message:
+    "Stripe webhooks are not configured (STRIPE_WEBHOOK_SECRET).",
+} as const;
+
+app.post("/api/billing/stripe/checkout-session", async (c) => {
+  const sessionEnv = getSessionEnv(c.env);
+  if (sessionEnv == null) {
+    return c.json(serviceUnavailableBody, 503);
+  }
+  const hyper = c.env.HYPERDRIVE;
+  if (hyper == null) {
+    return c.json(
+      {
+        code: "SERVICE_UNAVAILABLE" as const,
+        message: "HYPERDRIVE binding is not configured.",
+      },
+      503,
+    );
+  }
+  const billing = getStripeBillingEnv(c.env);
+  if (billing == null) {
+    return c.json(billingNotConfiguredBody, 503);
+  }
+
+  let bodyJson: unknown = {};
+  try {
+    const t = await c.req.text();
+    if (t.length > 0) {
+      bodyJson = JSON.parse(t) as unknown;
+    }
+  } catch {
+    return c.json({ code: "BAD_REQUEST", message: "Expected JSON object." }, 400);
+  }
+  const parsed = stripeCheckoutSessionRequestSchema.safeParse(bodyJson);
+  if (!parsed.success) {
+    return c.json(
+      {
+        code: "VALIDATION_ERROR",
+        message: parsed.error.flatten().formErrors.join("; "),
+      },
+      400,
+    );
+  }
+
+  const db = getDbForConnectionString(hyper.connectionString);
+  const cookieHeader = c.req.header("Cookie");
+  try {
+    const { performStripeCreateCheckoutSession } = await import(
+      "@deepnotes/session"
+    );
+    const out = await performStripeCreateCheckoutSession({
+      db,
+      env: sessionEnv,
+      billing,
+      accessCookie: readCookieHeader(cookieHeader, "accessToken"),
+      requestOrigin: c.req.header("Origin") ?? undefined,
+      billingFrequency: parsed.data.billingFrequency,
+    });
+    return c.json(out, 200);
+  } catch (e) {
+    const { SessionError } = await import("@deepnotes/session");
+    if (e instanceof SessionError) {
+      return c.json(
+        { code: e.code, message: e.message },
+        e.status as ContentfulStatusCode,
+      );
+    }
+    throw e;
+  }
+});
+
+app.post("/api/billing/stripe/portal-session", async (c) => {
+  const sessionEnv = getSessionEnv(c.env);
+  if (sessionEnv == null) {
+    return c.json(serviceUnavailableBody, 503);
+  }
+  const hyper = c.env.HYPERDRIVE;
+  if (hyper == null) {
+    return c.json(
+      {
+        code: "SERVICE_UNAVAILABLE" as const,
+        message: "HYPERDRIVE binding is not configured.",
+      },
+      503,
+    );
+  }
+  const billing = getStripeBillingEnv(c.env);
+  if (billing == null) {
+    return c.json(billingNotConfiguredBody, 503);
+  }
+
+  const db = getDbForConnectionString(hyper.connectionString);
+  const cookieHeader = c.req.header("Cookie");
+  try {
+    const { performStripeCreatePortalSession } = await import(
+      "@deepnotes/session"
+    );
+    const out = await performStripeCreatePortalSession({
+      db,
+      env: sessionEnv,
+      billing,
+      accessCookie: readCookieHeader(cookieHeader, "accessToken"),
+    });
+    return c.json(out, 200);
+  } catch (e) {
+    const { SessionError } = await import("@deepnotes/session");
+    if (e instanceof SessionError) {
+      return c.json(
+        { code: e.code, message: e.message },
+        e.status as ContentfulStatusCode,
+      );
+    }
+    throw e;
+  }
+});
+
+app.post("/api/webhooks/stripe", async (c) => {
+  const hyper = c.env?.HYPERDRIVE;
+  if (hyper == null) {
+    return c.json(
+      {
+        code: "SERVICE_UNAVAILABLE" as const,
+        message: "HYPERDRIVE binding is not configured.",
+      },
+      503,
+    );
+  }
+  const webhookSecret = getStripeWebhookSecret(c.env);
+  if (webhookSecret == null) {
+    return c.json(stripeWebhookNotConfiguredBody, 503);
+  }
+
+  const rawBody = await c.req.text();
+  const db = getDbForConnectionString(hyper.connectionString);
+
+  try {
+    const {
+      parseStripeWebhookEvent,
+      processStripeWebhookEvent,
+    } = await import("@deepnotes/session");
+    const event = parseStripeWebhookEvent({
+      rawBody,
+      signature: c.req.header("Stripe-Signature") ?? c.req.header("stripe-signature"),
+      webhookSecret,
+    });
+    await processStripeWebhookEvent({ db, event });
+    return c.body(null, 200);
+  } catch (e) {
+    if (e instanceof Stripe.errors.StripeSignatureVerificationError) {
+      return c.json(
+        { code: "BAD_REQUEST", message: "Invalid Stripe webhook signature." },
+        400,
+      );
+    }
+    if (e instanceof Error && e.message === "Missing Stripe-Signature header.") {
+      return c.json({ code: "BAD_REQUEST", message: e.message }, 400);
+    }
+    throw e;
+  }
+});
+
 export default app;

new-deepnotes/apps/api-worker/src/index.ts

@@ -1,4 +1,4 @@
-import type { SessionEnv } from "@deepnotes/session";
+import type { SessionEnv, StripeBillingEnv } from "@deepnotes/session";
 
 export type WorkerSessionBindings = {
   ACCESS_SECRET?: string;
@@ -22,8 +22,44 @@ export type WorkerSessionBindings = {
   /** Optional; when set with token, failed-login rate limits use Upstash REST Redis. */
   UPSTASH_REDIS_REST_URL?: string;
   UPSTASH_REDIS_REST_TOKEN?: string;
+  /** Stripe (`stripe` package); checkout, portal, customer hooks when set. */
+  STRIPE_SECRET_KEY?: string;
+  /** Webhook signing secret for `POST /api/webhooks/stripe`. */
+  STRIPE_WEBHOOK_SECRET?: string;
+  STRIPE_MONTHLY_PRICE_ID?: string;
+  STRIPE_YEARLY_PRICE_ID?: string;
 };
 
+export function getStripeBillingEnv(
+  env: WorkerSessionBindings | undefined,
+): StripeBillingEnv | null {
+  if (
+    env?.STRIPE_SECRET_KEY == null ||
+    env.STRIPE_SECRET_KEY === "" ||
+    env.STRIPE_MONTHLY_PRICE_ID == null ||
+    env.STRIPE_MONTHLY_PRICE_ID === "" ||
+    env.STRIPE_YEARLY_PRICE_ID == null ||
+    env.STRIPE_YEARLY_PRICE_ID === ""
+  ) {
+    return null;
+  }
+  return {
+    STRIPE_SECRET_KEY: env.STRIPE_SECRET_KEY,
+    STRIPE_MONTHLY_PRICE_ID: env.STRIPE_MONTHLY_PRICE_ID,
+    STRIPE_YEARLY_PRICE_ID: env.STRIPE_YEARLY_PRICE_ID,
+  };
+}
+
+export function getStripeWebhookSecret(
+  env: WorkerSessionBindings | undefined,
+): string | null {
+  const s = env?.STRIPE_WEBHOOK_SECRET;
+  if (s == null || s === "") {
+    return null;
+  }
+  return s;
+}
+
 export function getSessionEnv(
   env: WorkerSessionBindings | undefined,
 ): SessionEnv | null {

new-deepnotes/apps/api-worker/src/session-env.ts

@@ -21,7 +21,7 @@ Set via **Wrangler secrets** or dashboard (never commit):
 
 - Database: Hyperdrive handles pooling; app reads Hyperdrive binding, not raw remote URL in Worker code paths that should use the binding.
 - `JWT_SECRET` (or `ACCESS_SECRET` / `REFRESH_SECRET` if split to match legacy semantics)
-- `STRIPE_WEBHOOK_SECRET` when billing is wired
+- **Stripe (subscriptions):** `STRIPE_SECRET_KEY`, `STRIPE_MONTHLY_PRICE_ID`, `STRIPE_YEARLY_PRICE_ID` for `POST /api/billing/stripe/checkout-session` and `…/portal-session`; `STRIPE_WEBHOOK_SECRET` for `POST /api/webhooks/stripe` (raw body + `Stripe-Signature`). Optional: same `STRIPE_SECRET_KEY` powers `customers.del` / `customers.update` after account delete and email change when wired in the Worker.
 - `REDIS_URL` or vendor-specific vars for rate limits / sessions
 
 ### Preview (per PR / branch)

new-deepnotes/docs/DEPLOY_CLOUDFLARE.md

@@ -25,8 +25,8 @@ Working checklist for Phase 0 of [docs/RESTART_PLAN.md](../../docs/RESTART_PLAN.
 | `users.account.twoFactorAuth.generateRecoveryCodes` | `POST /api/users/me/2fa/recovery-codes` |
 | `users.account.twoFactorAuth.forgetTrustedDevices` | `POST /api/users/me/2fa/devices/forget` |
 | `users.account.twoFactorAuth.disable` | `POST /api/users/me/2fa/disable` |
-| `users.account.stripe.createCheckoutSession` | `POST /api/billing/stripe/checkout-session` |
-| `users.account.stripe.createPortalSession` | `POST /api/billing/stripe/portal-session` |
+| `users.account.stripe.createCheckoutSession` | `POST /api/billing/stripe/checkout-session` (**implemented** — optional body `{ "billingFrequency"?: "monthly" \| "yearly" }`; **200** `{ "checkoutSessionUrl" }`; requires verified email; `STRIPE_*` + Hyperdrive in worker) |
+| `users.account.stripe.createPortalSession` | `POST /api/billing/stripe/portal-session` (**implemented** — **200** `{ "portalSessionUrl" }`; requires `users.customer_id`) |
 | `users.account.delete` | `DELETE /api/users/me` (JSON body `{ "loginHash" }` base64; clears cookies on 204; optional `deleteStripeCustomer` in worker when billing is wired) |
 | (WS) `users.account.changePassword` step 1+2 | `POST /api/users/me/password` (JSON: `oldLoginHash`, `newLoginHash`, `userEncryptedPrivateKeyring`, `userEncryptedSymmetricKeyring` as base64; same keyring semantics as `POST /api/users`; 204 + clears cookies + invalidates all sessions) |
 
@@ -104,7 +104,7 @@ Working checklist for Phase 0 of [docs/RESTART_PLAN.md](../../docs/RESTART_PLAN.
 
 | Legacy | New |
 |--------|-----|
-| Stripe webhook (Fastify) | `POST /api/webhooks/stripe` |
+| Stripe webhook (Fastify) | `POST /api/webhooks/stripe` (**implemented** — raw body + `Stripe-Signature`; `customer.subscription.updated` / `customer.subscription.deleted`; maps user by `users.customer_id`) |
 | RevenueCat webhook | **not implemented** |
 
 Reference routers: `apps/app-server/src/trpc/router.ts`, `apps/app-server/src/trpc/api/**`, `apps/app-server/src/websocket/**`.

new-deepnotes/docs/TRPC_REST_MAP.md

@@ -67,6 +67,11 @@ export {
   userPagesPathQuerySchema,
   userStartingPageResponseSchema,
 } from "./schemas/user-pages.js";
+export {
+  stripeCheckoutSessionRequestSchema,
+  stripeCheckoutSessionResponseSchema,
+  stripePortalSessionResponseSchema,
+} from "./schemas/billing.js";
 export {
   emailVerificationConfirmRequestSchema,
   emailVerificationResendRequestSchema,

new-deepnotes/packages/api/src/index.ts

@@ -123,5 +123,12 @@ describe("getOpenApiDocument", () => {
     expect(doc.paths?.["/api/pages/{pageId}"]?.delete).toBeDefined();
     expect(doc.paths?.["/api/pages/{pageId}/restore"]?.post).toBeDefined();
     expect(doc.paths?.["/api/pages/{pageId}/purge"]?.post).toBeDefined();
+    expect(
+      doc.paths?.["/api/billing/stripe/checkout-session"]?.post,
+    ).toBeDefined();
+    expect(
+      doc.paths?.["/api/billing/stripe/portal-session"]?.post,
+    ).toBeDefined();
+    expect(doc.paths?.["/api/webhooks/stripe"]?.post).toBeDefined();
   });
 });