Set a real bot id below.
+ + + + + + diff --git a/public/embed/concierge-widget.css b/public/embed/concierge-widget.css new file mode 100644 index 0000000..7499859 --- /dev/null +++ b/public/embed/concierge-widget.css @@ -0,0 +1,54 @@ +:root{ + --ebc-bg:#ffffff; + --ebc-fg:#111827; + --ebc-muted:#6b7280; + --ebc-border:#e5e7eb; + --ebc-primary:#2563eb; + --ebc-primary-fg:#ffffff; +} +.ebc-launcher{ + position:fixed; right:18px; bottom:18px; + width:54px; height:54px; border-radius:999px; + border:1px solid var(--ebc-border); + background:var(--ebc-primary); color:var(--ebc-primary-fg); + cursor:pointer; box-shadow:0 10px 25px rgba(0,0,0,.12); + font:600 14px/1 system-ui,-apple-system,Segoe UI,Roboto,Arial; +} +.ebc-panel{ + position:fixed; right:18px; bottom:84px; + width:340px; height:460px; + border:1px solid var(--ebc-border); + background:var(--ebc-bg); color:var(--ebc-fg); + border-radius:14px; box-shadow:0 14px 40px rgba(0,0,0,.14); + display:none; overflow:hidden; + font:400 13px/1.35 system-ui,-apple-system,Segoe UI,Roboto,Arial; +} +.ebc-panel.ebc-open{ display:flex; flex-direction:column; } +.ebc-header{ + padding:12px 12px; + border-bottom:1px solid var(--ebc-border); + display:flex; align-items:center; justify-content:space-between; +} +.ebc-title{ font-weight:700; font-size:13px; } +.ebc-close{ border:0; background:transparent; cursor:pointer; color:var(--ebc-muted); font-size:18px; } +.ebc-messages{ padding:12px; gap:8px; display:flex; flex-direction:column; overflow:auto; flex:1; } +.ebc-msg{ max-width:85%; padding:9px 10px; border-radius:12px; border:1px solid var(--ebc-border); background:#f9fafb; } +.ebc-msg.ebc-user{ margin-left:auto; background:#eff6ff; border-color:#dbeafe; } +.ebc-meta{ font-size:11px; color:var(--ebc-muted); margin-top:2px; } +.ebc-inputbar{ + padding:10px; border-top:1px solid var(--ebc-border); + display:flex; gap:8px; align-items:center; +} +.ebc-input{ + flex:1; border:1px solid var(--ebc-border); + border-radius:10px; padding:9px 10px; + outline:none; +} +.ebc-send{ + border:1px solid var(--ebc-border); + background:var(--ebc-primary); color:var(--ebc-primary-fg); + border-radius:10px; padding:9px 12px; + cursor:pointer; font-weight:600; +} +.ebc-error{ color:#b91c1c; font-size:12px; padding:0 12px 10px; display:none; } + diff --git a/public/embed/concierge-widget.js b/public/embed/concierge-widget.js new file mode 100644 index 0000000..dabfa38 --- /dev/null +++ b/public/embed/concierge-widget.js @@ -0,0 +1,138 @@ +(function () { + var cfg = window.EB_CONCIERGE || {}; + var botId = cfg.botId; + var apiBase = (cfg.apiBase || '').replace(/\/$/, ''); + if (!botId || !apiBase) { + // eslint-disable-next-line no-console + console.error('[EventBuzz Concierge] Missing window.EB_CONCIERGE.botId or apiBase'); + return; + } + + var storageKey = 'ebc_session_' + botId; + var sessionId = null; + try { sessionId = localStorage.getItem(storageKey); } catch {} + + function el(tag, attrs, children) { + var n = document.createElement(tag); + if (attrs) for (var k in attrs) n.setAttribute(k, attrs[k]); + if (children) children.forEach(function (c) { n.appendChild(typeof c === 'string' ? document.createTextNode(c) : c); }); + return n; + } + + function addCssOnce() { + if (document.getElementById('ebc-css')) return; + var link = el('link', { id: 'ebc-css', rel: 'stylesheet', href: apiBase.replace(/\/api$/, '') + '/embed/concierge-widget.css' }); + document.head.appendChild(link); + } + + addCssOnce(); + + var launcher = el('button', { class: 'ebc-launcher', type: 'button', 'aria-label': 'Chat with event concierge' }, ['Chat']); + var panel = el('div', { class: 'ebc-panel', role: 'dialog', 'aria-label': 'Event concierge chat' }); + var header = el('div', { class: 'ebc-header' }); + var title = el('div', { class: 'ebc-title' }, ['Event Concierge']); + var closeBtn = el('button', { class: 'ebc-close', type: 'button', 'aria-label': 'Close' }, ['×']); + header.appendChild(title); + header.appendChild(closeBtn); + + var messages = el('div', { class: 'ebc-messages' }); + var error = el('div', { class: 'ebc-error' }, ['']); + var inputBar = el('div', { class: 'ebc-inputbar' }); + var input = el('input', { class: 'ebc-input', placeholder: 'Ask a question…', maxlength: '800' }); + var sendBtn = el('button', { class: 'ebc-send', type: 'button' }, ['Send']); + inputBar.appendChild(input); + inputBar.appendChild(sendBtn); + + panel.appendChild(header); + panel.appendChild(messages); + panel.appendChild(error); + panel.appendChild(inputBar); + document.body.appendChild(launcher); + document.body.appendChild(panel); + + function setError(msg) { + if (!msg) { + error.style.display = 'none'; + error.textContent = ''; + return; + } + error.style.display = 'block'; + error.textContent = msg; + } + + function addMessage(role, text) { + var bubble = el('div', { class: 'ebc-msg' + (role === 'user' ? ' ebc-user' : '') }); + bubble.textContent = text; + messages.appendChild(bubble); + messages.scrollTop = messages.scrollHeight; + } + + function openPanel() { + panel.classList.add('ebc-open'); + input.focus(); + } + function closePanel() { + panel.classList.remove('ebc-open'); + } + + launcher.addEventListener('click', function () { + if (panel.classList.contains('ebc-open')) closePanel(); + else openPanel(); + }); + closeBtn.addEventListener('click', closePanel); + + function http(path, body) { + return fetch(apiBase + path, { + method: body ? 'POST' : 'GET', + headers: { 'Content-Type': 'application/json' }, + body: body ? JSON.stringify(body) : undefined, + credentials: 'omit' + }).then(function (r) { + return r.json().then(function (j) { return { status: r.status, json: j }; }); + }); + } + + // Load config + http('/public/concierge/' + encodeURIComponent(botId) + '/config').then(function (res) { + if (res.json && res.json.success && res.json.data) { + title.textContent = res.json.data.eventName ? ('Concierge · ' + res.json.data.eventName) : 'Event Concierge'; + var greet = res.json.data.greeting; + if (greet) addMessage('assistant', greet.replace(/\{eventName\}/g, res.json.data.eventName || 'the event')); + if (res.json.data.maxMessageLength) input.setAttribute('maxlength', String(res.json.data.maxMessageLength)); + } + }); + + function send() { + var text = String(input.value || '').trim(); + if (!text) return; + setError(null); + input.value = ''; + addMessage('user', text); + sendBtn.disabled = true; + + http('/public/concierge/' + encodeURIComponent(botId) + '/chat', { + sessionId: sessionId || undefined, + message: text + }).then(function (res) { + sendBtn.disabled = false; + if (!res.json || !res.json.success) { + setError((res.json && res.json.error && res.json.error.message) ? res.json.error.message : 'Request failed'); + return; + } + if (res.json.data && res.json.data.sessionId) { + sessionId = res.json.data.sessionId; + try { localStorage.setItem(storageKey, sessionId); } catch {} + } + addMessage('assistant', (res.json.data && res.json.data.reply) ? res.json.data.reply : '…'); + }).catch(function (e) { + sendBtn.disabled = false; + setError(e && e.message ? e.message : 'Network error'); + }); + } + + sendBtn.addEventListener('click', send); + input.addEventListener('keydown', function (e) { + if (e.key === 'Enter') send(); + }); +})(); + diff --git a/scripts/generate-permission-json-files.js b/scripts/generate-permission-json-files.js new file mode 100644 index 0000000..df080fc --- /dev/null +++ b/scripts/generate-permission-json-files.js @@ -0,0 +1,57 @@ +/** + * One-time generator: writes backend/src/config/permissions/*.json from the canonical catalog. + * Run: node backend/scripts/generate-permission-json-files.js + */ +const fs = require('fs'); +const path = require('path'); + +const DIR = path.join(__dirname, '../src/config/permissions'); + +const FEATURES = [ + ['participants', 'Participants', 'portfolio'], + ['event_website', 'Event Website', 'website'], + ['customise_event_website', 'Customise event website', 'website'], + ['custom_domain', 'Custom Domain', 'website'], + ['invites_rsvp', 'Invites +RSVP', 'registration'], + ['registration_forms_with_custom_fields', 'Registration forms with Custom fields', 'registration'], + ['custom_registration_workflow', 'Custom Registration workflow', 'registration'], + ['email_confirmation_reminders', 'Email Confirmation & Reminders', 'comms'], + ['email_outreach_campaigns', 'Email outreach campaigns', 'comms'], + ['custom_badge_and_print_file_creation', 'Custom Badge and print file creation', 'design'], + ['whatsapp_confirmation_reminders', 'WhatsApp confirmation & reminders', 'comms'], + ['bring_your_wa_number', 'Bring your WA number', 'comms'], + ['custom_template_for_wa_messaging', 'Custom template for WA messaging', 'comms'], + ['agenda_builder', 'Agenda builder', 'agenda'], + ['multi_track_agenda', 'Multi track agenda', 'agenda'], + ['speaker_management', 'Speaker management', 'agenda'], + ['abstract_management', 'Abstract management', 'agenda'], + ['ticketing_free_and_paid', 'Ticketing free & paid', 'payments'], + ['collect_payment_using_your_upi_qr', 'Collect Payment using your UPI QR', 'payments'], + ['payment_gateway_integration', 'Payment gateway integration', 'payments'], + ['qna_with_moderation', 'QnA with moderation', 'engagement'], + ['live_polls', 'Live Polls', 'engagement'], + ['multiple_quiz_modes', 'Multiple Quiz modes', 'engagement'], + ['word_cloud', 'Word Cloud', 'engagement'], + ['custom_theme', 'Custom Theme', 'branding'], + ['ai_summarization', 'AI Summarization', 'ai'], + ['ai_engagement_insights', 'AI Engagement insights', 'ai'], + ['content_management', 'Content management', 'content'], + ['ratings_for_sessions_and_speakers', 'Ratings for sessions and speakers', 'feedback'], + ['feedback_forms_and_surveys', 'Feedback forms & Surveys', 'feedback'], + ['gamification', 'Gamification', 'engagement'], + ['push_notifications', 'Push Notifications', 'comms'], +]; + +fs.mkdirSync(DIR, { recursive: true }); +for (const [key, label, category] of FEATURES) { + const file = path.join(DIR, `${key}.json`); + const doc = { + key, + label, + description: '', + category, + }; + fs.writeFileSync(file, `${JSON.stringify(doc, null, 2)}\n`, 'utf8'); + console.log('wrote', path.basename(file)); +} +console.log('done', FEATURES.length, 'files'); diff --git a/src/app.js b/src/app.js index 2ec18cf..6df330a 100644 --- a/src/app.js +++ b/src/app.js @@ -22,13 +22,26 @@ const contentCollectionRoutes = require('./routes/contentCollection.routes'); const paymentRoutes = require('./routes/payment.routes'); const organizationRoutes = require('./routes/organization.routes'); const subscriptionRoutes = require('./routes/subscription.routes'); +const platformAdminRoutes = require('./routes/platformAdmin.routes'); const adminRequestRoutes = require('./routes/adminRequest.routes'); const eventStaffRoutes = require('./routes/eventStaff.routes'); const websiteSettingsRoutes = require('./routes/websiteSettings.routes'); const eventMicrositeRoutes = require('./routes/eventMicrosite.routes'); const visitorRoutes = require('./routes/visitor.routes'); +const whatsappTemplateRoutes = require('./routes/whatsappTemplate.routes'); +const badgeBatchRoutes = require('./routes/badgeBatch.routes'); +const eventTicketRoutes = require('./routes/eventTicket.routes'); +const publicEventTicketRoutes = require('./routes/publicEventTicket.routes'); +const publicAttendanceRoutes = require('./routes/publicAttendance.routes'); +const attendanceRoutes = require('./routes/attendance.routes'); +const checkinsRoutes = require('./routes/checkins.routes'); +const ticketManualRoutes = require('./routes/ticketManual.routes'); +const eventTicketingManualRoutes = require('./routes/eventTicketingManual.routes'); +const conciergeBotRoutes = require('./routes/conciergeBot.routes'); +const publicConciergeRoutes = require('./routes/publicConcierge.routes'); const createServer = async () => { + /** Production: set CORS_ORIGIN (or FRONTEND_URL) to every origin that loads the SPA, e.g. https://console.example.com (no trailing slash). */ const fromEnv = (process.env.CORS_ORIGIN || process.env.FRONTEND_URL || '') .split(',') .map((s) => s.trim().replace(/\/$/, '')) @@ -63,7 +76,12 @@ const createServer = async () => { : localDevOrigins; /** Extra allowed origins (e.g. GrapesJS app on a different port/domain). Also set WEBSITE_BUILDER_CORS_ORIGINS in prod. */ - const allowedOrigins = [...new Set([...originList, ...builderExtras])]; + const conciergeExtras = (process.env.CONCIERGE_PUBLIC_ALLOWED_ORIGINS || '') + .split(',') + .map((s) => s.trim().replace(/\/$/, '')) + .filter(Boolean); + + const allowedOrigins = [...new Set([...originList, ...builderExtras, ...conciergeExtras])]; /** In development, allow any http://localhost or http://127.0.0.1 port (Vite may use 5175, 5176, …). Production: whitelist only. */ function resolveCorsAllowOrigin(rawOrigin) { @@ -167,7 +185,40 @@ const createServer = async () => { options: { auth: false }, }); + // Embeddable concierge widget assets (served directly from backend/public). + const fs = require('fs/promises'); + const path = require('path'); + const PUBLIC_DIR = path.join(__dirname, '..', 'public'); + const sendFile = async (h, relPath, contentType) => { + const abs = path.join(PUBLIC_DIR, relPath); + const body = await fs.readFile(abs, 'utf8'); + return h.response(body).type(contentType); + }; + server.route([ + { + method: 'GET', + path: '/embed/concierge-widget.js', + options: { auth: false }, + handler: async (request, h) => sendFile(h, 'embed/concierge-widget.js', 'application/javascript'), + }, + { + method: 'GET', + path: '/embed/concierge-widget.css', + options: { auth: false }, + handler: async (request, h) => sendFile(h, 'embed/concierge-widget.css', 'text/css'), + }, + { + method: 'GET', + path: '/embed/demo', + options: { auth: false }, + handler: async (request, h) => sendFile(h, 'embed-demo.html', 'text/html'), + }, + ]); + server.route(visitorRoutes); + server.route(publicEventTicketRoutes); + server.route(publicAttendanceRoutes); + server.route(publicConciergeRoutes); server.route(authRoutes); server.route(eventRoutes); @@ -189,10 +240,19 @@ const createServer = async () => { server.route(paymentRoutes); server.route(organizationRoutes); server.route(subscriptionRoutes); + server.route(platformAdminRoutes); server.route(adminRequestRoutes); server.route(eventStaffRoutes); server.route(websiteSettingsRoutes); server.route(eventMicrositeRoutes); + server.route(whatsappTemplateRoutes); + server.route(badgeBatchRoutes); + server.route(eventTicketRoutes); + server.route(ticketManualRoutes); + server.route(eventTicketingManualRoutes); + server.route(conciergeBotRoutes); + server.route(attendanceRoutes); + server.route(checkinsRoutes); server.ext('onPreResponse', (request, h) => { const response = request.response; @@ -231,7 +291,37 @@ const app = { async initialize() { await connectDB(); + const { warmPlanCache } = require('./config/subscriptionCatalog'); + await warmPlanCache(); this._server = await createServer(); + const cron = require('node-cron'); + const { runSubscriptionExpiry } = require('./jobs/subscriptionExpiry.job'); + cron.schedule( + '0 3 * * *', + async () => { + try { + const n = await runSubscriptionExpiry(); + if (n > 0) console.log(`[cron] subscription expiry: ${n} organisation(s) set to free`); + } catch (err) { + console.error('[cron] subscription expiry failed', err); + } + }, + { timezone: process.env.CRON_TZ || undefined }, + ); + const { runWhatsAppTemplateSync } = require('./jobs/whatsappTemplateSync.job'); + const waCron = process.env.WHATSAPP_TEMPLATE_SYNC_CRON || '*/12 * * * *'; + cron.schedule( + waCron, + async () => { + try { + const n = await runWhatsAppTemplateSync(); + if (n > 0) console.log(`[cron] whatsapp templates: synced ${n} organisation(s)`); + } catch (err) { + console.error('[cron] whatsapp template sync failed', err); + } + }, + { timezone: process.env.CRON_TZ || undefined }, + ); }, async start() { diff --git a/src/config/constants.js b/src/config/constants.js index e54ba08..4f1187a 100644 --- a/src/config/constants.js +++ b/src/config/constants.js @@ -5,7 +5,7 @@ const PARTICIPANT_STATUS = ['pending', 'confirmed', 'checked_in', 'cancelled']; const SESSION_TYPES = ['keynote', 'workshop', 'panel', 'breakout', 'networking']; const SESSION_STATUS = ['scheduled', 'ongoing', 'completed', 'cancelled']; const FORM_TYPES = ['registration', 'feedback', 'survey', 'custom', 'other']; -const FIELD_TYPES = ['text', 'email', 'phone', 'select', 'radio', 'checkbox', 'checkboxes', 'file']; +const FIELD_TYPES = ['text', 'email', 'phone', 'select', 'stars', 'radio', 'checkbox', 'checkboxes', 'file']; /** Registration field → Participant property mapping (or `custom` + customMapsKey). */ const FORM_FIELD_MAPS_TO = [ 'firstName', diff --git a/src/config/database.js b/src/config/database.js index b586c39..64efdff 100644 --- a/src/config/database.js +++ b/src/config/database.js @@ -1,13 +1,43 @@ const mongoose = require('mongoose'); +let connectPromise = null; + +/** + * Single shared MongoDB connection for API, workers, and chatbot service. + * Always require models from this backend package so they use this mongoose instance. + */ const connectDB = async () => { - try { - const conn = await mongoose.connect(process.env.MONGODB_URI); - console.log(`MongoDB connected: ${conn.connection.host}`); - } catch (error) { - console.error('MongoDB connection error:', error); - process.exit(1); + if (mongoose.connection.readyState === 1) { + return mongoose.connection; } + if (connectPromise) { + return connectPromise; + } + + const uri = process.env.MONGODB_URI; + if (!uri) { + throw new Error('MONGODB_URI is not configured'); + } + + connectPromise = mongoose + .connect(uri, { + maxPoolSize: Number(process.env.MONGODB_MAX_POOL_SIZE) || 50, + serverSelectionTimeoutMS: Number(process.env.MONGODB_SERVER_SELECTION_MS) || 30000, + socketTimeoutMS: Number(process.env.MONGODB_SOCKET_TIMEOUT_MS) || 45000, + }) + .then((conn) => { + console.log(`MongoDB connected: ${conn.connection.host}`); + return conn; + }) + .catch((err) => { + console.error('MongoDB connection error:', err); + throw err; + }) + .finally(() => { + connectPromise = null; + }); + + return connectPromise; }; -module.exports = { connectDB }; +module.exports = { connectDB, mongoose }; diff --git a/src/config/eventbuzz_plans.source.csv b/src/config/eventbuzz_plans.source.csv new file mode 100644 index 0000000..d33ce94 --- /dev/null +++ b/src/config/eventbuzz_plans.source.csv @@ -0,0 +1,36 @@ +,Free,Starter,Growth,Pro,Enterprise +MANAGE,,,,, +Participants,50,300,500,1000,Unlimited +Event Website,Event Page,Event microsite,Event microsite,Custom domain event microsite,Custom Website +Customise event website,No,No,Yes,Yes,Yes +Custom Domain,No,No,Yes,Yes,Yes +Invites +RSVP,Yes,Yes,Yes,Yes,Yes +Registration forms with Custom fields,Yes,Yes,Yes,Yes,Yes +Custom Registration workflow,No,No,No,Yes,Yes +Email Confirmation & Reminders,Yes,Yes,Yes,Yes,Yes +Email outreach campaigns,Upto 500 emails,Upto 5000 emails,Upto 10K emails,Upto 10K emails,Unlimited +Custom Badge and print file creation,Yes,Yes,Yes,Yes,Yes +WhatsApp confirmation & reminders,No,No,Yes,Yes,Yes +Bring your WA number,No,No,No,Yes,Yes +Custom template for WA messaging,No,No,No,Yes,Yes +Agenda builder,Yes,Yes,Yes,Yes,Yes +Multi track agenda,No,Yes,Yes,Yes,Yes +Speaker management,No,Yes,Yes,Yes,Yes +Abstract management,No,No,No,Yes,Yes +Ticketing free & paid,Yes,Yes,Yes,Yes,Yes +Collect Payment using your UPI QR,Add on,Yes,Yes,Yes,Yes +Payment gateway integration,No,No,Yes,Yes,Yes +,,,,, +ENGAGE,,,,, +QnA with moderation,Yes,Yes,Yes,Yes,Yes +Live Polls,Yes,Yes,Yes,Yes,Yes +Multiple Quiz modes,Yes,Yes,Yes,Yes,Yes +Word Cloud,Yes,Yes,Yes,Yes,Yes +Custom Theme,No,No,No,Yes,Yes +AI Summarization,No,No,Yes,Yes,Yes +AI Engagement insights ,No,No,Yes,Yes,Yes +Content management,No,No,Yes,Yes,Yes +Ratings for sessions and speakers,Yes,Yes,Yes,Yes,Yes +Feedback forms & Surveys,Yes,Yes,Yes,Yes,Yes +Gamification,No,No,Yes,Yes,Yes +Push Notifications,Yes,Yes,Yes,Yes,Yes diff --git a/src/config/loadPermissionFeatures.js b/src/config/loadPermissionFeatures.js new file mode 100644 index 0000000..e0cc2e3 --- /dev/null +++ b/src/config/loadPermissionFeatures.js @@ -0,0 +1,40 @@ +/** + * Loads subscription feature definitions from backend/src/config/permissions/*.json + * (one file per feature). Used by subscriptionCatalog and featureAccess. + */ +const fs = require('fs'); +const path = require('path'); + +const PERMISSIONS_DIR = path.join(__dirname, 'permissions'); + +/** + * @returns {{ FEATURES: RecordThis is a test email from your EventBuzz organisation SMTP settings.
', + }); + if (!r.ok && r.skipped) { + return h.response(error('VALIDATION_ERROR', 'No SMTP available — enable organisation SMTP or set MAIL_HOST on the server')).code(400); + } + if (!r.ok) return h.response(error('SEND_FAILED', r.error || 'Send failed')).code(502); + return h.response(success({ ok: true })); +}; + const removeUser = async (request, h) => { const target = await User.findById(request.params.id); if (!target) return h.response(error('NOT_FOUND', 'User not found')).code(404); @@ -132,6 +287,11 @@ const removeUser = async (request, h) => { module.exports = { getOrganization, updateOrganization, + getEmailSettings, + updateEmailSettings, + getWhatsAppSettings, + updateWhatsAppSettings, + testEmailSettings, listUsers, addUser, updateUser, diff --git a/src/controllers/participantList.controller.js b/src/controllers/participantList.controller.js index ef28526..0d9c025 100644 --- a/src/controllers/participantList.controller.js +++ b/src/controllers/participantList.controller.js @@ -5,6 +5,7 @@ const Participant = require('../models/Participant'); const { success, error } = require('../utils/response'); const { flattenParticipantForEvent } = require('../utils/participantMembership'); const { resolveScopedOrganizationId } = require('../utils/tenantListScope'); +const { rulesToQuery } = require('../utils/participantListQuery'); function assertListOrg(list, user) { if (user.role === 'super_admin') return true; @@ -19,103 +20,6 @@ async function resolveAllowedEventIds(user, queryOrganization) { return { allowedIds: ids }; } -function mapUiStatusToApi(val) { - const s = String(val || '').toLowerCase().replace(/ /g, '_'); - if (s === 'checked_in' || s === 'checkedin') return 'checked_in'; - if (s === 'confirmed') return 'confirmed'; - if (s === 'cancelled' || s === 'canceled') return 'cancelled'; - if (s === 'pending') return 'pending'; - return String(val || '').toLowerCase(); -} - -function rulesToQuery(rules, conjunction, allowedEventIds, listTenantOrg) { - if (!allowedEventIds.length) return { _id: { $in: [] } }; - const oidList = allowedEventIds.map((id) => - id instanceof mongoose.Types.ObjectId ? id : new mongoose.Types.ObjectId(String(id)) - ); - - const clauses = (Array.isArray(rules) ? rules : []) - .map((rule) => { - const field = String(rule.field || ''); - const op = String(rule.operator || 'is'); - const val = String(rule.value || '').trim(); - - if (field === 'Status') { - const st = mapUiStatusToApi(val); - return { - eventMemberships: { - $elemMatch: { - event: { $in: oidList }, - status: op === 'is not' ? { $ne: st } : st, - }, - }, - }; - } - if (field === 'Tag') { - const inAllowedEvents = { - eventMemberships: { $elemMatch: { event: { $in: oidList } } }, - }; - const legacyMembershipTag = { - eventMemberships: { - $elemMatch: { event: { $in: oidList }, tags: val }, - }, - }; - if (op === 'is not') { - return { - $and: [ - inAllowedEvents, - { tags: { $nin: [val] } }, - { - eventMemberships: { - $not: { - $elemMatch: { event: { $in: oidList }, tags: val }, - }, - }, - }, - ], - }; - } - return { - $and: [inAllowedEvents, { $or: [{ tags: val }, legacyMembershipTag] }], - }; - } - if (field === 'Event') { - if (!mongoose.Types.ObjectId.isValid(val)) return null; - const eid = new mongoose.Types.ObjectId(val); - if (!oidList.some((x) => String(x) === String(eid))) return null; - return { - eventMemberships: { - $elemMatch: { - event: op === 'is not' ? { $nin: [eid] } : eid, - }, - }, - }; - } - if (field === 'Role' || field === 'Registration Date') { - return null; - } - return null; - }) - .filter(Boolean); - - const base = { - tenantOrganization: - listTenantOrg instanceof mongoose.Types.ObjectId - ? listTenantOrg - : new mongoose.Types.ObjectId(String(listTenantOrg)), - }; - - if (!clauses.length) { - return { - ...base, - eventMemberships: { $elemMatch: { event: { $in: oidList } } }, - }; - } - - const combined = conjunction === 'OR' ? { $or: clauses } : { $and: clauses }; - return { $and: [base, combined] }; -} - const list = async (request, h) => { const user = request.auth.credentials.user; const scoped = resolveScopedOrganizationId(user, request.query.organization); diff --git a/src/controllers/platformAdmin.controller.js b/src/controllers/platformAdmin.controller.js new file mode 100644 index 0000000..8a65a64 --- /dev/null +++ b/src/controllers/platformAdmin.controller.js @@ -0,0 +1,371 @@ +const Organization = require('../models/Organization'); +const User = require('../models/User'); +const OrganizationUserMap = require('../models/OrganizationUserMap'); +const SubscriptionPlan = require('../models/SubscriptionPlan'); +const { success, error } = require('../utils/response'); +const { defaultFeatureValuesByPlanId } = require('../config/planFeatureMatrix'); +const { + FEATURES, + DEFAULT_PLANS, + listFeatures, + listPlans, + invalidatePlanCache, + warmPlanCache, +} = require('../config/subscriptionCatalog'); + +function defaultPricingForPlan(planId) { + return ( + DEFAULT_PLANS[planId]?.pricing || { + amount: null, + currency: 'INR', + interval: 'month', + contactSales: false, + } + ); +} + +/** Merge optional `pricing` payload with catalog defaults or existing document. */ +function applyFeatureValuesPayload(incoming, existingRow, planId) { + const defaults = defaultFeatureValuesByPlanId(planId); + const base = + existingRow && existingRow.featureValues && typeof existingRow.featureValues === 'object' + ? { + event_website: existingRow.featureValues.event_website ?? defaults.event_website, + email_outreach_campaigns: { + maxEmails: + existingRow.featureValues.email_outreach_campaigns && + existingRow.featureValues.email_outreach_campaigns.maxEmails !== undefined + ? existingRow.featureValues.email_outreach_campaigns.maxEmails + : defaults.email_outreach_campaigns.maxEmails, + }, + } + : defaults; + if (!incoming || typeof incoming !== 'object') return base; + const maxFromIn = + incoming.email_outreach_campaigns && + typeof incoming.email_outreach_campaigns === 'object' && + incoming.email_outreach_campaigns.maxEmails !== undefined + ? incoming.email_outreach_campaigns.maxEmails === null + ? null + : Number(incoming.email_outreach_campaigns.maxEmails) + : undefined; + return { + event_website: + incoming.event_website !== undefined ? String(incoming.event_website) : base.event_website, + email_outreach_campaigns: { + maxEmails: maxFromIn !== undefined ? maxFromIn : base.email_outreach_campaigns.maxEmails, + }, + }; +} + +function applyPricingPayload(incoming, existingRow, planId) { + const base = + existingRow && existingRow.pricing && typeof existingRow.pricing === 'object' + ? { + amount: existingRow.pricing.amount, + currency: existingRow.pricing.currency, + interval: existingRow.pricing.interval, + contactSales: existingRow.pricing.contactSales, + } + : defaultPricingForPlan(planId); + if (!incoming || typeof incoming !== 'object') return base; + return { + amount: + incoming.amount !== undefined + ? incoming.amount === null + ? null + : Number(incoming.amount) + : base.amount, + currency: + incoming.currency !== undefined + ? String(incoming.currency || '').trim() || 'INR' + : base.currency, + interval: + incoming.interval !== undefined + ? String(incoming.interval || '').trim() || 'month' + : base.interval, + contactSales: + incoming.contactSales !== undefined ? Boolean(incoming.contactSales) : base.contactSales, + }; +} + +function escapeRegex(s) { + return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); +} + +function serializeOrgDoc(org, userCount) { + const o = typeof org.toObject === 'function' ? org.toObject() : { ...org }; + o._id = o._id != null ? String(o._id) : o._id; + o.userCount = userCount; + return o; +} + +async function listOrganizations(request, h) { + const page = Math.max(1, Number(request.query.page) || 1); + const limit = Math.min(100, Math.max(1, Number(request.query.limit) || 20)); + const search = request.query.search ? String(request.query.search).trim() : ''; + const q = {}; + if (search) { + const rx = new RegExp(escapeRegex(search), 'i'); + q.$or = [{ name: rx }, { email: rx }]; + } + const skip = (page - 1) * limit; + const [orgs, total] = await Promise.all([ + Organization.find(q).sort({ createdAt: -1 }).skip(skip).limit(limit).lean(), + Organization.countDocuments(q), + ]); + const organizations = await Promise.all( + orgs.map(async (org) => { + const userCount = await User.countDocuments({ organization: org._id }); + return serializeOrgDoc(org, userCount); + }), + ); + return h.response(success({ organizations, total, page, limit })).code(200); +} + +/** + * Create a tenant organization and its first user (org role super_admin). + */ +async function createOrganization(request, h) { + const { organization: orgIn, admin } = request.payload; + const adminEmail = String(admin.email).trim(); + const existingUser = await User.findOne({ email: adminEmail }); + if (existingUser) { + return h.response(error('VALIDATION_ERROR', 'A user with this email already exists')).code(400); + } + + const sub = {}; + if (orgIn.subscription && typeof orgIn.subscription === 'object') { + if (orgIn.subscription.plan != null) sub.plan = orgIn.subscription.plan; + if (orgIn.subscription.status != null) sub.status = orgIn.subscription.status; + } + + const str = (v) => (v == null ? undefined : String(v).trim()); + const opt = (v) => { + const s = str(v); + return s === '' ? undefined : s; + }; + + const org = await Organization.create({ + name: str(orgIn.name), + description: opt(orgIn.description), + email: opt(orgIn.email), + phone: opt(orgIn.phone), + website: opt(orgIn.website), + timezone: opt(orgIn.timezone), + ...(Object.keys(sub).length ? { subscription: sub } : {}), + }); + + const user = await User.create({ + email: adminEmail, + password: admin.password, + firstName: admin.firstName != null ? String(admin.firstName).trim() : undefined, + lastName: admin.lastName != null ? String(admin.lastName).trim() : undefined, + organization: org._id, + role: 'super_admin', + }); + + await OrganizationUserMap.create({ + user: user._id, + organization: org._id, + role: 'super_admin', + eventAccess: [], + }); + + const userCount = await User.countDocuments({ organization: org._id }); + const organization = serializeOrgDoc(await Organization.findById(org._id).lean(), userCount); + const adminOut = user.toObject(); + delete adminOut.password; + + return h + .response( + success({ + organization, + adminUser: adminOut, + }), + ) + .code(201); +} + +async function getOrganization(request, h) { + const org = await Organization.findById(request.params.id).lean(); + if (!org) return h.response(error('NOT_FOUND', 'Organization not found')).code(404); + const userCount = await User.countDocuments({ organization: org._id }); + return h.response(success({ organization: serializeOrgDoc(org, userCount) })).code(200); +} + +async function patchOrganizationSubscription(request, h) { + const org = await Organization.findById(request.params.id); + if (!org) return h.response(error('NOT_FOUND', 'Organization not found')).code(404); + const p = request.payload; + if (!org.subscription) org.subscription = {}; + const sub = org.subscription; + if (p.plan != null) sub.plan = p.plan; + if (p.status != null) sub.status = p.status; + if (p.expiresAt !== undefined) sub.expiresAt = p.expiresAt ? new Date(p.expiresAt) : undefined; + if (p.maxEvents !== undefined) sub.maxEvents = p.maxEvents; + if (p.maxParticipants !== undefined) sub.maxParticipants = p.maxParticipants; + if (Array.isArray(p.featureOverrides)) sub.featureOverrides = p.featureOverrides.map(String); + org.subscription = sub; + org.markModified('subscription'); + await org.save(); + const userCount = await User.countDocuments({ organization: org._id }); + return h.response(success({ organization: serializeOrgDoc(org, userCount) })).code(200); +} + +async function listPermissions(request, h) { + return h.response(success({ features: listFeatures() })).code(200); +} + +async function listPlansAdmin(request, h) { + const plans = await listPlans(); + const withCounts = await Promise.all( + plans.map(async (p) => ({ + ...p, + organizationCount: await Organization.countDocuments({ 'subscription.plan': p.id }), + })), + ); + return h.response(success({ plans: withCounts })).code(200); +} + +async function createPlan(request, h) { + const { PLAN_ID_REGEX } = SubscriptionPlan; + const b = request.payload; + const planId = String(b.planId || '').trim(); + if (!PLAN_ID_REGEX.test(planId)) { + return h + .response( + error( + 'VALIDATION_ERROR', + 'planId must be a lowercase slug: start with a letter, then letters, digits, or underscores (max 64 chars).', + ), + ) + .code(400); + } + const dup = await SubscriptionPlan.findOne({ planId }); + if (dup) { + return h.response(error('VALIDATION_ERROR', 'A plan with this id already exists')).code(400); + } + const featureKeys = Array.isArray(b.featureKeys) + ? [...new Set(b.featureKeys.filter((k) => typeof k === 'string' && FEATURES[k]))] + : []; + await SubscriptionPlan.create({ + planId, + name: String(b.name).trim(), + tagline: b.tagline != null ? String(b.tagline) : '', + featureKeys, + defaultLimits: + b.defaultLimits && typeof b.defaultLimits === 'object' + ? { + maxEvents: b.defaultLimits.maxEvents, + maxParticipants: b.defaultLimits.maxParticipants, + } + : { maxEvents: null, maxParticipants: null }, + pricing: applyPricingPayload(b.pricing, null, planId), + featureValues: applyFeatureValuesPayload(b.featureValues, null, planId), + }); + invalidatePlanCache(); + await warmPlanCache(); + const plans = await listPlans(); + const withCounts = await Promise.all( + plans.map(async (p) => ({ + ...p, + organizationCount: await Organization.countDocuments({ 'subscription.plan': p.id }), + })), + ); + return h.response(success({ plans: withCounts })).code(201); +} + +async function putPlan(request, h) { + const { PLAN_ID_REGEX } = SubscriptionPlan; + const { planId } = request.params; + if (!PLAN_ID_REGEX.test(planId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid plan id')).code(400); + } + const b = request.payload; + const existing = await SubscriptionPlan.findOne({ planId }).lean(); + if (!existing) { + return h.response(error('NOT_FOUND', 'Plan not found')).code(404); + } + const featureKeys = Array.isArray(b.featureKeys) + ? [...new Set(b.featureKeys.filter((k) => typeof k === 'string' && FEATURES[k]))] + : undefined; + const set = {}; + if (b.name != null) set.name = String(b.name).trim(); + if (b.tagline !== undefined) set.tagline = String(b.tagline); + if (featureKeys !== undefined) set.featureKeys = featureKeys; + if (b.defaultLimits != null && typeof b.defaultLimits === 'object') { + set.defaultLimits = { + maxEvents: b.defaultLimits.maxEvents, + maxParticipants: b.defaultLimits.maxParticipants, + }; + } + if (b.pricing !== undefined) { + set.pricing = applyPricingPayload(b.pricing, existing, planId); + } + if (b.featureValues !== undefined) { + set.featureValues = applyFeatureValuesPayload(b.featureValues, existing, planId); + } + if (Object.keys(set).length === 0) { + return h.response(error('VALIDATION_ERROR', 'No valid fields to update')).code(400); + } + const updated = await SubscriptionPlan.findOneAndUpdate({ planId }, { $set: set }, { new: true }); + if (!updated) { + return h.response(error('NOT_FOUND', 'Plan not found')).code(404); + } + invalidatePlanCache(); + await warmPlanCache(); + const plans = await listPlans(); + const withCounts = await Promise.all( + plans.map(async (p) => ({ + ...p, + organizationCount: await Organization.countDocuments({ 'subscription.plan': p.id }), + })), + ); + return h.response(success({ plans: withCounts })).code(200); +} + +async function deletePlan(request, h) { + const { PLAN_ID_REGEX } = SubscriptionPlan; + const { planId } = request.params; + if (!PLAN_ID_REGEX.test(planId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid plan id')).code(400); + } + const inUse = await Organization.countDocuments({ 'subscription.plan': planId }); + if (inUse > 0) { + return h + .response( + error( + 'CONFLICT', + `This plan is assigned to ${inUse} organization(s). Move them to another plan before deleting.`, + ), + ) + .code(409); + } + const removed = await SubscriptionPlan.findOneAndDelete({ planId }); + if (!removed) { + return h.response(error('NOT_FOUND', 'Plan not found')).code(404); + } + invalidatePlanCache(); + await warmPlanCache(); + const plans = await listPlans(); + const withCounts = await Promise.all( + plans.map(async (p) => ({ + ...p, + organizationCount: await Organization.countDocuments({ 'subscription.plan': p.id }), + })), + ); + return h.response(success({ plans: withCounts })).code(200); +} + +module.exports = { + listOrganizations, + createOrganization, + getOrganization, + patchOrganizationSubscription, + listPermissions, + listPlansAdmin, + createPlan, + putPlan, + deletePlan, +}; diff --git a/src/controllers/publicAttendance.controller.js b/src/controllers/publicAttendance.controller.js new file mode 100644 index 0000000..08de487 --- /dev/null +++ b/src/controllers/publicAttendance.controller.js @@ -0,0 +1,88 @@ +const Event = require('../models/Event'); +const { success, error } = require('../utils/response'); +const { + performCheckIn, + loadAttendanceByToken, + searchEventParticipantsForAttendance, +} = require('../services/attendanceCheckIn.service'); + +const getSession = async (request, h) => { + const { token } = request.params; + const r = await loadAttendanceByToken(token); + if (r.err) return h.response(r.err).code(404); + + const attendance = r.attendance; + if (attendance.status !== 'active') { + return h.response(error('BAD_REQUEST', 'This attendance session is closed')).code(400); + } + + const event = await Event.findById(attendance.event) + .select('name subtitle startDate endDate location locationType image') + .lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + + return h.response( + success({ + name: attendance.name, + description: attendance.description, + settings: { + allowDuplicateCheckIn: Boolean(attendance.settings?.allowDuplicateCheckIn), + publicLinkEnabled: Boolean(attendance.settings?.publicLinkEnabled), + }, + status: attendance.status, + event: { + name: event.name, + subtitle: event.subtitle, + startDate: event.startDate, + endDate: event.endDate, + location: event.location, + locationType: event.locationType, + image: event.image, + }, + }) + ); +}; + +const search = async (request, h) => { + const { token } = request.params; + const r = await loadAttendanceByToken(token); + if (r.err) return h.response(r.err).code(404); + + const attendance = r.attendance; + if (attendance.status !== 'active') { + return h.response(error('BAD_REQUEST', 'This attendance session is closed')).code(400); + } + if (!attendance.settings?.publicLinkEnabled) { + return h.response(error('FORBIDDEN', 'Public check-in link is disabled')).code(403); + } + + const q = String(request.query.q || '').trim(); + + const data = await searchEventParticipantsForAttendance({ + eventId: attendance.event, + organizationId: attendance.organization, + q: q || undefined, + attendanceId: attendance._id, + limit: q ? 500 : 5000, + maxCap: 5000, + }); + return h.response(success(data)); +}; + +const checkIn = async (request, h) => { + const { token } = request.params; + const { participantId } = request.payload; + const outcome = await performCheckIn({ + publicToken: token, + participantId, + source: 'public', + }); + if (outcome.err) return h.response(outcome.err).code(outcome.statusCode || 400); + return h.response(success(outcome.result, 'Checked in')); +}; + +module.exports = { + getSession, + search, + checkIn, +}; diff --git a/src/controllers/publicConcierge.controller.js b/src/controllers/publicConcierge.controller.js new file mode 100644 index 0000000..06cdb3c --- /dev/null +++ b/src/controllers/publicConcierge.controller.js @@ -0,0 +1,134 @@ +const crypto = require('crypto'); +const mongoose = require('mongoose'); +const ConciergeBot = require('../models/ConciergeBot'); +const Event = require('../models/Event'); +const WebChatSession = require('../models/WebChatSession'); +const { success, error } = require('../utils/response'); +const { executeConciergeRag } = require('../services/conciergeRag.service'); + +const MAX_MESSAGE_LENGTH = 800; +const MAX_HISTORY_MESSAGES = 40; + +// Basic in-memory rate limit (best-effort). +const ipBuckets = new Map(); +const WINDOW_MS = 60_000; +const MAX_REQ_PER_WINDOW = 20; + +function takeIpToken(ip) { + const now = Date.now(); + const key = String(ip || 'unknown'); + const row = ipBuckets.get(key) || { resetAt: now + WINDOW_MS, count: 0 }; + if (now > row.resetAt) { + row.resetAt = now + WINDOW_MS; + row.count = 0; + } + row.count += 1; + ipBuckets.set(key, row); + return row.count <= MAX_REQ_PER_WINDOW; +} + +async function loadBotOr404(botId) { + if (!mongoose.Types.ObjectId.isValid(String(botId))) return { err: error('VALIDATION_ERROR', 'Invalid bot') }; + const bot = await ConciergeBot.findById(botId).lean(); + if (!bot) return { err: error('NOT_FOUND', 'Chatbot not found') }; + if (!bot.enabled || bot.status !== 'ACTIVE') return { err: error('FORBIDDEN', 'Chatbot is not enabled') }; + const event = await Event.findById(bot.event).select('name').lean(); + return { bot, event }; +} + +const config = async (request, h) => { + const { botId } = request.params; + const { bot, event, err } = await loadBotOr404(botId); + if (err) return h.response(err).code(err.error?.code === 'NOT_FOUND' ? 404 : 400); + return h.response( + success({ + botId: String(bot._id), + eventId: String(bot.event), + eventName: event?.name || 'Event', + greeting: bot.greeting?.message || '', + maxMessageLength: MAX_MESSAGE_LENGTH, + }), + ); +}; + +const chat = async (request, h) => { + const ip = request.headers['x-forwarded-for'] || request.info.remoteAddress; + if (!takeIpToken(ip)) return h.response(error('RATE_LIMIT', 'Too many requests. Try again in a minute.')).code(429); + + const { botId } = request.params; + const { bot, event, err } = await loadBotOr404(botId); + if (err) return h.response(err).code(err.error?.code === 'NOT_FOUND' ? 404 : 400); + + const msg = String(request.payload?.message || '').trim(); + if (!msg) return h.response(error('VALIDATION_ERROR', 'Message is required')).code(400); + if (msg.length > MAX_MESSAGE_LENGTH) { + return h + .response(error('VALIDATION_ERROR', `Message too long (max ${MAX_MESSAGE_LENGTH} chars)`)) + .code(400); + } + + let sessionId = String(request.payload?.sessionId || '').trim(); + if (!sessionId) sessionId = crypto.randomBytes(16).toString('hex'); + + let session = await WebChatSession.findOne({ botId: bot._id, sessionId }); + if (!session) { + session = await WebChatSession.create({ + botId: bot._id, + eventId: bot.event, + organization: bot.organization, + sessionId, + history: [], + lastSeenAt: new Date(), + }); + } + + session.history.push({ + role: 'user', + text: msg, + ts: new Date(), + modelId: null, + inputTokens: 0, + outputTokens: 0, + }); + if (session.history.length > MAX_HISTORY_MESSAGES) { + session.history = session.history.slice(-MAX_HISTORY_MESSAGES); + } + session.lastSeenAt = new Date(); + + const historyForPrompt = session.history.slice(-12).map((m) => ({ role: m.role, text: m.text })); + const includeEventDetails = bot.knowledge?.includeEventDetails !== false; + + const ragResult = await executeConciergeRag(String(bot.event), msg, event?.name || 'Event', { + includeEventDetails, + history: historyForPrompt, + }); + const answerText = + ragResult?.text || + "I don't have that in my knowledge base yet. Please check with event staff or try another question."; + + const reply = String(answerText || '').trim().slice(0, 1200); + const inTok = ragResult?.usage?.inputTokens || 0; + const outTok = ragResult?.usage?.outputTokens || 0; + session.inputTokensTotal = Number(session.inputTokensTotal || 0) + Number(inTok || 0); + session.outputTokensTotal = Number(session.outputTokensTotal || 0) + Number(outTok || 0); + session.history.push({ + role: 'assistant', + text: reply, + ts: new Date(), + modelId: ragResult?.modelId || null, + inputTokens: inTok, + outputTokens: outTok, + }); + if (session.history.length > MAX_HISTORY_MESSAGES) { + session.history = session.history.slice(-MAX_HISTORY_MESSAGES); + } + await session.save(); + + return h.response(success({ sessionId, reply, usage: ragResult?.usage || null })); +}; + +module.exports = { + config, + chat, +}; + diff --git a/src/controllers/publicEventTicket.controller.js b/src/controllers/publicEventTicket.controller.js new file mode 100644 index 0000000..79f332c --- /dev/null +++ b/src/controllers/publicEventTicket.controller.js @@ -0,0 +1,378 @@ +const mongoose = require('mongoose'); +const Event = require('../models/Event'); +const EventTicket = require('../models/EventTicket'); +const Form = require('../models/Form'); +const TicketManualOrder = require('../models/TicketManualOrder'); +const { success, error } = require('../utils/response'); +const { computeTicketQuote, ticketRequiresBillingState } = require('../utils/eventTicketPricing'); +const { createPaymentOrderCore } = require('../services/payments/createOrderCore'); +const { validateAndBuildTicketPurchaseContext } = require('../utils/publicTicketCheckoutShared'); +const { organizationHasOnlineTicketCheckout } = require('../utils/eventTicketingGateway'); +const { uploadBufferToS3AndGetCloudFrontUrl } = require('../utils/s3Media'); +const { notifyTicketStakeholders } = require('../services/ticketSaleNotify'); +const { isManualPaymentConfigured } = require('../utils/ticketingManualPayment'); + +function publicTicketShape(ticket, registrationFormFields) { + return { + _id: ticket._id, + name: ticket.name, + description: ticket.description, + keyPoints: ticket.keyPoints || [], + basePriceMinor: ticket.basePriceMinor, + currency: ticket.currency || 'INR', + maxPerOrder: ticket.maxPerOrder, + requiresBillingState: ticketRequiresBillingState(ticket), + registrationFormId: ticket.registrationForm || null, + registrationFormFields: registrationFormFields || null, + }; +} + +async function loadFormFieldsForPublic(formId) { + if (!formId || !mongoose.Types.ObjectId.isValid(String(formId))) return null; + const form = await Form.findById(formId).lean(); + if (!form || !form.settings?.isActive) return null; + const fields = (form.fields || []).map((f) => ({ + label: f.label, + type: f.type, + required: Boolean(f.required), + options: f.options, + placeholder: f.placeholder, + mapsTo: f.mapsTo, + })); + return fields; +} + +const eventSummary = async (request, h) => { + const { eventId } = request.params; + if (!mongoose.Types.ObjectId.isValid(eventId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid event')).code(400); + } + const event = await Event.findById(eventId) + .select('name subtitle startDate endDate location locationType image') + .lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + return h.response( + success({ + name: event.name, + subtitle: event.subtitle, + startDate: event.startDate, + endDate: event.endDate, + location: event.location, + locationType: event.locationType, + image: event.image, + }), + ); +}; + +const listCatalog = async (request, h) => { + const { eventId } = request.params; + if (!mongoose.Types.ObjectId.isValid(eventId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid event')).code(400); + } + const event = await Event.findById(eventId).lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + + const tickets = await EventTicket.find({ event: eventId, isActive: true }).sort({ sortOrder: 1, name: 1 }).lean(); + const out = []; + for (const t of tickets) { + const regFields = t.registrationForm ? await loadFormFieldsForPublic(t.registrationForm) : null; + out.push(publicTicketShape(t, regFields)); + } + return h.response(success({ tickets: out })); +}; + +const quote = async (request, h) => { + const { eventId } = request.params; + const { ticketId, quantity, billingStateCode } = request.payload; + if (!mongoose.Types.ObjectId.isValid(eventId) || !mongoose.Types.ObjectId.isValid(ticketId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid id')).code(400); + } + const ticket = await EventTicket.findOne({ _id: ticketId, event: eventId, isActive: true }).lean(); + if (!ticket) return h.response(error('NOT_FOUND', 'Ticket not found')).code(404); + + const state = billingStateCode ? String(billingStateCode).trim().toUpperCase() : ''; + if (ticketRequiresBillingState(ticket) && !state) { + return h.response(error('VALIDATION_ERROR', 'Billing state is required for this ticket')).code(400); + } + + const qty = Math.min(100, Math.max(1, parseInt(quantity, 10) || 1)); + if (ticket.maxPerOrder && qty > ticket.maxPerOrder) { + return h.response(error('VALIDATION_ERROR', `Maximum ${ticket.maxPerOrder} per order`)).code(400); + } + + const q = computeTicketQuote(ticket, qty, state); + return h.response( + success({ + ticketId: String(ticket._id), + quantity: qty, + billingStateCode: state || null, + baseMinor: q.baseMinor, + taxMinor: q.taxMinor, + totalMinor: q.totalMinor, + taxLines: q.taxLines, + currency: ticket.currency || 'INR', + }), + ); +}; + +const checkoutOptions = async (request, h) => { + const { eventId } = request.params; + if (!mongoose.Types.ObjectId.isValid(eventId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid event')).code(400); + } + const event = await Event.findById(eventId).select('name organization ticketingManualPayment').lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + + const onlineAvailable = await organizationHasOnlineTicketCheckout(event.organization); + const mp = event.ticketingManualPayment || {}; + const manualEligible = Boolean(mp.enabled && isManualPaymentConfigured(mp)); + const manualQrMode = mp.manualQrMode === 'dynamic' ? 'dynamic' : 'upload'; + + return h.response( + success({ + onlineAvailable, + manualUpi: manualEligible + ? { + manualQrMode, + eventName: event.name || '', + upiQrImageUrl: String(mp.upiQrImageUrl || '').trim(), + upiId: mp.upiId || '', + payeeName: mp.payeeName || '', + instructions: mp.instructions || '', + /** Always 0 — organiser covers Eventbuzz via manual UPI enablement fee; buyers pay ticket + tax only. */ + platformFeeInr: 0, + } + : null, + }), + ); +}; + +const manualQuote = async (request, h) => { + const { eventId } = request.params; + const { ticketId, quantity, billingStateCode } = request.payload; + if (!mongoose.Types.ObjectId.isValid(eventId) || !mongoose.Types.ObjectId.isValid(ticketId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid id')).code(400); + } + const event = await Event.findById(eventId).lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + + const mp = event.ticketingManualPayment || {}; + if (!mp.enabled || !isManualPaymentConfigured(mp)) { + return h.response(error('VALIDATION_ERROR', 'Manual UPI is not enabled for this event')).code(400); + } + + const ticket = await EventTicket.findOne({ _id: ticketId, event: eventId, isActive: true }).lean(); + if (!ticket) return h.response(error('NOT_FOUND', 'Ticket not found')).code(404); + + const state = billingStateCode ? String(billingStateCode).trim().toUpperCase() : ''; + if (ticketRequiresBillingState(ticket) && !state) { + return h.response(error('VALIDATION_ERROR', 'Billing state is required for this ticket')).code(400); + } + + const qty = Math.min(100, Math.max(1, parseInt(quantity, 10) || 1)); + if (ticket.maxPerOrder && qty > ticket.maxPerOrder) { + return h.response(error('VALIDATION_ERROR', `Maximum ${ticket.maxPerOrder} per order`)).code(400); + } + + const q = computeTicketQuote(ticket, qty, state); + + return h.response( + success({ + ticketId: String(ticket._id), + ticketName: ticket.name || '', + eventName: event.name || '', + quantity: qty, + billingStateCode: state || null, + baseMinor: q.baseMinor, + taxMinor: q.taxMinor, + platformFeeMinor: 0, + totalMinor: q.totalMinor, + taxLines: q.taxLines, + currency: ticket.currency || 'INR', + }), + ); +}; + +function parseDataUrlImage(dataUrl) { + const s = String(dataUrl || ''); + const m = s.match(/^data:(image\/[a-zA-Z0-9.+-]+);base64,(.+)$/); + if (!m) return null; + const contentType = m[1]; + const buf = Buffer.from(m[2], 'base64'); + if (!buf.length || buf.length > 5 * 1024 * 1024) return null; + return { buffer: buf, contentType }; +} + +const manualSubmit = async (request, h) => { + const { eventId } = request.params; + const p = request.payload; + + const event = await Event.findById(eventId).lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + + const mp = event.ticketingManualPayment || {}; + if (!mp.enabled || !isManualPaymentConfigured(mp)) { + return h.response(error('VALIDATION_ERROR', 'Manual UPI is not enabled for this event')).code(400); + } + + const v = await validateAndBuildTicketPurchaseContext(eventId, p); + if (!v.ok) { + const code = v.code === 'NOT_FOUND' ? 404 : 400; + return h.response(error(v.code, v.message)).code(code); + } + + const q = v.quoteResult; + if (q.totalMinor !== Math.round(Number(p.expectedTotalMinor))) { + return h.response(error('VALIDATION_ERROR', 'Price changed — refresh and try again')).code(409); + } + + const img = parseDataUrlImage(p.screenshotDataUrl); + if (!img) { + return h.response(error('VALIDATION_ERROR', 'Invalid or too large payment screenshot (use a base64 data URL image, max 5MB)')).code(400); + } + + const orgId = String(event.organization); + const filename = `ticket-manual-${Date.now()}.${img.contentType.includes('png') ? 'png' : 'jpg'}`; + let screenshotUrl; + try { + const up = await uploadBufferToS3AndGetCloudFrontUrl({ + buffer: img.buffer, + contentType: img.contentType, + orgId, + eventId: String(eventId), + module: 'ticket-manual-payments', + filename, + }); + screenshotUrl = up.url; + } catch (e) { + console.error('[manualSubmit] S3 upload failed', e); + return h.response(error('SERVER_ERROR', 'Could not store screenshot')).code(500); + } + + const registrationContext = { + ...v.registrationContext, + quote: { + baseMinor: q.baseMinor, + taxMinor: q.taxMinor, + totalMinor: q.totalMinor, + taxLines: q.taxLines, + platformFeeMinor: 0, + quantity: v.qty, + }, + }; + + const order = await TicketManualOrder.create({ + event: eventId, + organization: event.organization, + ticket: p.ticketId, + purchaserEmail: registrationContext.purchaserEmail, + attendees: registrationContext.attendees, + quote: registrationContext.quote, + currency: v.currency, + billingStateCode: v.state || '', + screenshotUrl, + buyerNote: p.buyerNote ? String(p.buyerNote).trim().slice(0, 2000) : '', + status: 'pending_review', + }); + + void notifyTicketStakeholders({ + kind: 'manual_submitted', + eventId: String(eventId), + organizationId: orgId, + ticketName: v.ticket.name, + purchaserEmail: registrationContext.purchaserEmail, + amountMinor: q.totalMinor, + currency: v.currency, + orderId: String(order._id), + }); + + return h + .response( + success({ + orderId: String(order._id), + message: 'Submitted for review. You will be notified when it is approved.', + }), + ) + .code(201); +}; + +const checkout = async (request, h) => { + const { eventId } = request.params; + const p = request.payload; + + const event = await Event.findById(eventId).lean(); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + + const onlineAvailable = await organizationHasOnlineTicketCheckout(event.organization); + if (!onlineAvailable) { + return h.response( + error( + 'VALIDATION_ERROR', + 'Online ticket checkout requires the organiser’s connected Razorpay account. Use UPI / manual checkout for this event if it is enabled, or ask the organiser to add their payment keys.', + ), + ).code(400); + } + + const v = await validateAndBuildTicketPurchaseContext(eventId, p); + if (!v.ok) { + const code = v.code === 'NOT_FOUND' ? 404 : 400; + return h.response(error(v.code, v.message)).code(code); + } + + if (v.quoteResult.totalMinor !== Math.round(Number(p.expectedTotalMinor))) { + return h.response(error('VALIDATION_ERROR', 'Price changed — refresh and try again')).code(409); + } + + try { + const result = await createPaymentOrderCore({ + organizationId: event.organization, + eventId, + participantId: null, + amountSubtotalMinor: v.quoteResult.totalMinor, + currency: v.currency, + idempotencyKey: p.idempotencyKey || null, + registrationContext: v.registrationContext, + purpose: 'ticket_purchase', + }); + return h + .response( + success({ + keyId: result.keyId, + orderId: result.orderId, + amount: result.amount, + currency: result.currency, + transactionId: result.transaction._id.toString(), + checkoutSource: result.checkoutSource, + }), + ) + .code(201); + } catch (e) { + if (e.code === 'IDEMPOTENCY_COMPLETE') { + return h.response(error('VALIDATION_ERROR', e.message)).code(409); + } + if ( + e.code === 'GATEWAY_NOT_IMPLEMENTED' || + e.code === 'PLATFORM_CHECKOUT_DISABLED' || + e.code === 'PLATFORM_RAZORPAY_MISSING' || + e.code === 'NO_GATEWAY' || + e.code === 'TICKET_ORG_GATEWAY_REQUIRED' || + e.code === 'BAD_GATEWAY_CREDENTIALS' || + e.code === 'IDEMPOTENCY_MISMATCH' || + e.code === 'INVALID_AMOUNT' || + e.code === 'RAZORPAY_SDK_MISSING' + ) { + return h.response(error('VALIDATION_ERROR', e.message)).code(400); + } + throw e; + } +}; + +module.exports = { + eventSummary, + listCatalog, + quote, + checkoutOptions, + manualQuote, + manualSubmit, + checkout, +}; diff --git a/src/controllers/question.controller.js b/src/controllers/question.controller.js index cb062b6..68680e1 100644 --- a/src/controllers/question.controller.js +++ b/src/controllers/question.controller.js @@ -1,5 +1,6 @@ const Question = require('../models/Question'); const Event = require('../models/Event'); +const Session = require('../models/Session'); const { success, error } = require('../utils/response'); const { syncSessionQuestionToFirebase, @@ -147,7 +148,16 @@ const answer = async (request, h) => { }; const sessionQuestions = async (request, h) => { - const questions = await Question.find({ session: request.params.sessionId }).populate('participant user').lean(); + const { sessionId } = request.params; + const session = await Session.findById(sessionId).lean(); + if (!session) return h.response(error('NOT_FOUND', 'Session not found')).code(404); + const event = await Event.findById(session.event); + if (!event) return h.response(error('NOT_FOUND', 'Event not found')).code(404); + const user = request.auth.credentials.user; + if (user.role !== 'super_admin' && event.organization?.toString() !== (user.organization?._id || user.organization)?.toString()) { + return h.response(error('FORBIDDEN', 'Access denied')).code(403); + } + const questions = await Question.find({ session: sessionId }).populate('participant user').sort({ upvotes: -1, createdAt: -1 }).lean(); return h.response(success({ questions })); }; diff --git a/src/controllers/subscription.controller.js b/src/controllers/subscription.controller.js index 17215bf..5be9df5 100644 --- a/src/controllers/subscription.controller.js +++ b/src/controllers/subscription.controller.js @@ -1,12 +1,183 @@ -const { success } = require('../utils/response'); -const { listFeatures, listPlans } = require('../config/subscriptionCatalog'); +const PaymentTransaction = require('../models/PaymentTransaction'); +const Organization = require('../models/Organization'); +const Event = require('../models/Event'); +const User = require('../models/User'); +const { success, error } = require('../utils/response'); +const { sendContactSalesLeadEmail } = require('../utils/mail'); +const { verifyPaymentCore, minorToMajor } = require('../services/payments/verifyPaymentCore'); +const { + createSubscriptionCheckoutOrder, + buildSubscriptionInvoiceHtml, + buildManualEnablementInvoiceHtml, +} = require('../services/subscriptionPayment.service'); +const { listFeatures, listPlans, getPlanForAccess } = require('../config/subscriptionCatalog'); const catalog = async (request, h) => h.response( success({ features: listFeatures(), - plans: listPlans(), + plans: await listPlans(), }), ); -module.exports = { catalog }; +const checkoutOrder = async (request, h) => { + const user = request.auth.credentials.user; + const orgId = user.organization?._id || user.organization; + const { targetPlanId } = request.payload; + try { + const result = await createSubscriptionCheckoutOrder({ + organizationId: orgId, + userId: user._id, + targetPlanId: String(targetPlanId).trim(), + }); + return h + .response( + success({ + keyId: result.keyId, + orderId: result.orderId, + amount: result.amount, + currency: result.currency, + transactionId: result.transaction._id.toString(), + checkoutSource: result.checkoutSource, + }), + ) + .code(201); + } catch (e) { + const code = e.code || 'ERROR'; + const msg = e.message || 'Failed to create order'; + if (['INVALID_PLAN', 'CONTACT_SALES', 'NO_CHARGE', 'PLAN_MISSING'].includes(code)) { + return h.response(error(code, msg)).code(400); + } + if (code === 'INVALID_AMOUNT') return h.response(error('VALIDATION_ERROR', msg)).code(400); + if (code === 'PLATFORM_RAZORPAY_MISSING' || code === 'NO_GATEWAY') { + return h.response(error('VALIDATION_ERROR', msg)).code(400); + } + throw e; + } +}; + +const checkoutVerify = async (request, h) => { + const user = request.auth.credentials.user; + const orgId = user.organization?._id || user.organization; + const { orderId, paymentId, signature } = request.payload; + const out = await verifyPaymentCore({ + orderId, + paymentId, + signature, + organizationId: orgId, + }); + if (out.error) { + const status = out.error === 'NOT_FOUND' ? 404 : 400; + return h.response(error(out.error, out.message)).code(status); + } + return h.response( + success({ + verified: true, + transactionId: out.transaction._id.toString(), + }), + ); +}; + +const listInvoices = async (request, h) => { + const user = request.auth.credentials.user; + const orgId = user.organization?._id || user.organization; + const rows = await PaymentTransaction.find({ + organization: orgId, + purpose: { $in: ['saas_subscription', 'ticketing_manual_enablement'] }, + status: 'paid', + }) + .sort({ createdAt: -1 }) + .limit(100) + .lean(); + + const invoices = rows.map((r) => { + const isEnablement = r.purpose === 'ticketing_manual_enablement'; + return { + id: r._id.toString(), + createdAt: r.createdAt, + planId: isEnablement ? 'manual_upi_enablement' : r.subscriptionPlanId, + invoiceLabel: isEnablement ? 'Manual UPI ticketing — enablement fee' : r.subscriptionPlanId, + amountMajor: minorToMajor(r.amountGross, r.currency), + currency: r.currency, + status: r.status, + razorpayOrderId: r.externalOrderId, + razorpayPaymentId: r.externalPaymentId, + }; + }); + return h.response(success({ invoices })); +}; + +const contactSalesRequest = async (request, h) => { + const user = request.auth.credentials.user; + const orgId = user.organization?._id || user.organization; + if (!orgId) return h.response(error('NO_ORG', 'No organisation')).code(400); + + const { requirements, targetPlanId } = request.payload; + const org = await Organization.findById(orgId).lean(); + const planKey = targetPlanId ? String(targetPlanId).trim() : 'enterprise'; + const planRow = getPlanForAccess(planKey); + + const admins = await User.find({ platform_admin: 'yes', isActive: { $ne: false } }) + .select('email') + .lean(); + const emails = admins.map((a) => a.email).filter(Boolean); + if (emails.length === 0) { + return h + .response(error('NO_PLATFORM_ADMIN', 'No platform administrators are configured to receive sales enquiries.')) + .code(503); + } + + const requesterName = [user.firstName, user.lastName].filter(Boolean).join(' ').trim(); + const ok = await sendContactSalesLeadEmail({ + to: emails, + requesterEmail: user.email, + requesterName: requesterName || undefined, + organizationName: org?.name, + planId: planRow.id || planKey, + planName: planRow.name, + requirements, + }); + if (!ok) { + return h.response(error('MAIL_FAILED', 'Could not send message. Check server email configuration.')).code(502); + } + return h.response(success({ sent: true })).code(200); +}; + +const downloadInvoice = async (request, h) => { + const user = request.auth.credentials.user; + const orgId = user.organization?._id || user.organization; + const { transactionId } = request.params; + const tx = await PaymentTransaction.findOne({ + _id: transactionId, + organization: orgId, + purpose: { $in: ['saas_subscription', 'ticketing_manual_enablement'] }, + status: 'paid', + }).lean(); + if (!tx) return h.response(error('NOT_FOUND', 'Invoice not found')).code(404); + const org = await Organization.findById(orgId).lean(); + let html; + if (tx.purpose === 'ticketing_manual_enablement') { + const ctx = tx.registrationContext && typeof tx.registrationContext === 'object' ? tx.registrationContext : {}; + let eventName = ''; + if (ctx.eventId) { + const ev = await Event.findById(ctx.eventId).select('name').lean(); + eventName = ev?.name || ''; + } + html = buildManualEnablementInvoiceHtml(org, tx, eventName); + } else { + html = buildSubscriptionInvoiceHtml(org, tx); + } + return h + .response(html) + .type('text/html; charset=utf-8') + .header('Content-Disposition', `attachment; filename="eventbuzz-invoice-${tx._id}.html"`); +}; + +module.exports = { + catalog, + checkoutOrder, + checkoutVerify, + contactSalesRequest, + listInvoices, + downloadInvoice, +}; diff --git a/src/controllers/ticketManual.controller.js b/src/controllers/ticketManual.controller.js new file mode 100644 index 0000000..cdf056d --- /dev/null +++ b/src/controllers/ticketManual.controller.js @@ -0,0 +1,149 @@ +const mongoose = require('mongoose'); +const Event = require('../models/Event'); +const TicketManualOrder = require('../models/TicketManualOrder'); +const EventTicket = require('../models/EventTicket'); +const { success, error } = require('../utils/response'); +const { fulfillTicketPurchaseFromContext } = require('../services/ticketPurchaseFulfillment'); +const { notifyTicketStakeholders } = require('../services/ticketSaleNotify'); + +async function assertEventAccess(eventId, user) { + const event = await Event.findById(eventId).select('organization').lean(); + if (!event) return { err: (h) => h.response(error('NOT_FOUND', 'Event not found')).code(404) }; + if ( + user.role !== 'super_admin' && + String(event.organization) !== String(user.organization?._id || user.organization || '') + ) { + return { err: (h) => h.response(error('FORBIDDEN', 'Access denied')).code(403) }; + } + return { event }; +} + +const list = async (request, h) => { + const { eventId } = request.params; + const status = request.query.status ? String(request.query.status) : 'pending_review'; + const user = request.auth.credentials.user; + const r = await assertEventAccess(eventId, user); + if (r.err) return r.err(h); + + const filter = { event: eventId }; + if (status !== 'all' && ['pending_review', 'approved', 'rejected'].includes(status)) filter.status = status; + + const orders = await TicketManualOrder.find(filter) + .sort({ createdAt: -1 }) + .limit(200) + .populate('ticket', 'name') + .lean(); + + return h.response( + success({ + orders: orders.map((o) => ({ + _id: o._id, + status: o.status, + createdAt: o.createdAt, + purchaserEmail: o.purchaserEmail, + screenshotUrl: o.screenshotUrl, + buyerNote: o.buyerNote, + quote: o.quote, + currency: o.currency, + ticket: o.ticket ? { _id: o.ticket._id, name: o.ticket.name } : null, + reviewedAt: o.reviewedAt, + rejectReason: o.rejectReason, + fulfillmentParticipantIds: o.fulfillmentParticipantIds || [], + })), + }), + ); +}; + +const approve = async (request, h) => { + const { eventId, orderId } = request.params; + const user = request.auth.credentials.user; + const r = await assertEventAccess(eventId, user); + if (r.err) return r.err(h); + + if (!mongoose.Types.ObjectId.isValid(orderId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid order')).code(400); + } + + const order = await TicketManualOrder.findOne({ _id: orderId, event: eventId }); + if (!order) return h.response(error('NOT_FOUND', 'Order not found')).code(404); + if (order.status !== 'pending_review') { + return h.response(error('VALIDATION_ERROR', 'Order is not pending review')).code(400); + } + + const ctx = { + kind: 'ticket_purchase', + ticketId: String(order.ticket), + eventId: String(order.event), + quantity: order.quote?.quantity || order.attendees?.length || 1, + billingStateCode: order.billingStateCode || null, + purchaserEmail: order.purchaserEmail, + attendees: order.attendees, + quote: order.quote, + }; + + const ids = await fulfillTicketPurchaseFromContext(ctx, { + paymentLine: { + amountGrossMinor: order.quote?.totalMinor ?? 0, + currency: (order.currency || 'INR').toUpperCase(), + externalId: `manual-upi:${order._id}`, + }, + }); + + if (!ids.length) { + return h.response(error('SERVER_ERROR', 'Fulfillment failed — check ticket and list configuration')).code(500); + } + + order.status = 'approved'; + order.reviewedAt = new Date(); + order.reviewedBy = user._id || user.id; + order.fulfillmentParticipantIds = ids.map((id) => String(id)); + await order.save(); + + const ticket = await EventTicket.findById(order.ticket).select('name').lean(); + void notifyTicketStakeholders({ + kind: 'manual_approved', + eventId: String(eventId), + organizationId: String(order.organization), + ticketName: ticket?.name, + purchaserEmail: order.purchaserEmail, + amountMinor: order.quote?.totalMinor, + currency: order.currency, + }); + + return h.response(success({ ok: true, participantIds: order.fulfillmentParticipantIds })); +}; + +const reject = async (request, h) => { + const { eventId, orderId } = request.params; + const { reason } = request.payload || {}; + const user = request.auth.credentials.user; + const r = await assertEventAccess(eventId, user); + if (r.err) return r.err(h); + + if (!mongoose.Types.ObjectId.isValid(orderId)) { + return h.response(error('VALIDATION_ERROR', 'Invalid order')).code(400); + } + + const order = await TicketManualOrder.findOne({ _id: orderId, event: eventId }); + if (!order) return h.response(error('NOT_FOUND', 'Order not found')).code(404); + if (order.status !== 'pending_review') { + return h.response(error('VALIDATION_ERROR', 'Order is not pending review')).code(400); + } + + order.status = 'rejected'; + order.reviewedAt = new Date(); + order.reviewedBy = user._id || user.id; + order.rejectReason = reason ? String(reason).trim().slice(0, 2000) : ''; + await order.save(); + + void notifyTicketStakeholders({ + kind: 'manual_rejected', + eventId: String(eventId), + organizationId: String(order.organization), + rejectReason: order.rejectReason, + }); + + return h.response(success({ ok: true })); +}; + +module.exports = { list, approve, reject }; diff --git a/src/controllers/visitor.controller.js b/src/controllers/visitor.controller.js index 84c6bbd..aba25bd 100644 --- a/src/controllers/visitor.controller.js +++ b/src/controllers/visitor.controller.js @@ -16,6 +16,7 @@ const { participantInEvent } = require('../utils/participantMembership'); const { mergeRules } = require('../utils/rewardRulesResolve'); const { isObjectiveQuestionCorrect } = require('../utils/quizLoyaltyScore'); const { awardIfNew } = require('../services/rewardAward'); +const { computeEventRatingsSummary } = require('../utils/eventRatingsSummary'); /** All event fields for JSON except website, timestamps; adds logoUrl from website.logo || image. Never expose inviteCode. */ function publicEventLoginPayload(doc) { @@ -148,7 +149,13 @@ async function loginPreview(request, h) { if (!event) { return h.response(error('NOT_FOUND', 'Event not found')).code(404); } - return h.response(success(publicEventLoginPayload(event))); + const ratings = await computeEventRatingsSummary(eventId); + return h.response( + success({ + ...publicEventLoginPayload(event), + ratings, + }), + ); } /** GET …/visitor/events/{eventId}/tracks — public; tracks for agenda links */ diff --git a/src/controllers/whatsappTemplate.controller.js b/src/controllers/whatsappTemplate.controller.js new file mode 100644 index 0000000..607c328 --- /dev/null +++ b/src/controllers/whatsappTemplate.controller.js @@ -0,0 +1,191 @@ +const WhatsAppTemplate = require('../models/WhatsAppTemplate'); +const { success, error } = require('../utils/response'); +const { + createMessageTemplate, + getOrgWhatsAppCredentials, + validateTemplateComponentsForMeta, + resolveTemplateImageHeaderHandles, +} = require('../utils/metaWhatsApp'); +const { syncOrganizationTemplates } = require('../services/whatsappTemplateMetaSync'); + +function organizationId(user) { + return user.organization?._id || user.organization; +} + +function assertRead(user) { + if (!['super_admin', 'admin', 'moderator', 'viewer'].includes(user.role)) { + return { code: 'FORBIDDEN', message: 'Insufficient permissions', status: 403 }; + } + return null; +} + +function assertWrite(user) { + if (!['super_admin', 'admin'].includes(user.role)) { + return { code: 'FORBIDDEN', message: 'Only administrators can manage WhatsApp templates', status: 403 }; + } + return null; +} + +function normalizeLanguage(lang) { + return String(lang || '') + .trim() + .replace(/-/g, '_'); +} + +const list = async (request, h) => { + const user = request.auth.credentials.user; + const denied = assertRead(user); + if (denied) return h.response(error(denied.code, denied.message)).code(denied.status); + const oid = organizationId(user); + if (!oid) return h.response(error('VALIDATION_ERROR', 'No organization')).code(400); + + const doSync = request.query.sync === '1' || request.query.sync === 'true'; + if (doSync) { + try { + const r = await syncOrganizationTemplates(oid); + if (!r.ok) return h.response(error('VALIDATION_ERROR', r.error || 'Sync failed')).code(400); + } catch (err) { + return h.response(error('META_ERROR', err.message || 'Meta sync failed')).code(502); + } + } + + const q = { organization: oid }; + if (request.query.status) q.status = String(request.query.status).toUpperCase(); + const templates = await WhatsAppTemplate.find(q).sort({ updatedAt: -1 }).lean(); + return h.response(success({ templates })); +}; + +const get = async (request, h) => { + const user = request.auth.credentials.user; + const denied = assertRead(user); + if (denied) return h.response(error(denied.code, denied.message)).code(denied.status); + const oid = organizationId(user); + if (!oid) return h.response(error('VALIDATION_ERROR', 'No organization')).code(400); + const doc = await WhatsAppTemplate.findOne({ _id: request.params.id, organization: oid }).lean(); + if (!doc) return h.response(error('NOT_FOUND', 'Template not found')).code(404); + + const doSync = request.query.sync === '1' || request.query.sync === 'true'; + if (doSync) { + try { + await syncOrganizationTemplates(oid); + } catch { + /* ignore */ + } + const fresh = await WhatsAppTemplate.findOne({ _id: request.params.id, organization: oid }).lean(); + return h.response(success(fresh || doc)); + } + return h.response(success(doc)); +}; + +const create = async (request, h) => { + const user = request.auth.credentials.user; + const denied = assertWrite(user); + if (denied) return h.response(error(denied.code, denied.message)).code(denied.status); + const oid = organizationId(user); + if (!oid) return h.response(error('VALIDATION_ERROR', 'No organization')).code(400); + + const creds = await getOrgWhatsAppCredentials(oid); + if (!creds) { + return h + .response( + error( + 'VALIDATION_ERROR', + 'WhatsApp Cloud is not configured. Add WABA ID and access token under Settings, or set META_WHATSAPP_DEFAULT_* on the server.', + ), + ) + .code(400); + } + + const { name, language, category, components, variableBindings } = request.payload; + const lang = normalizeLanguage(language); + const metaBody = { + name, + language: lang, + category, + components: JSON.parse(JSON.stringify(components || [])), + }; + + try { + validateTemplateComponentsForMeta(metaBody.components); + } catch (err) { + return h.response(error('VALIDATION_ERROR', err.message || 'Invalid template')).code(400); + } + + try { + await resolveTemplateImageHeaderHandles(metaBody.components, creds.accessToken); + } catch (err) { + if (err.code === 'WA_TEMPLATE_RULE') { + return h.response(error('VALIDATION_ERROR', err.message)).code(400); + } + const status = err.status && err.status < 500 ? 400 : 502; + const code = err.status && err.status < 500 ? 'META_VALIDATION' : 'META_ERROR'; + return h.response(error(code, err.message || 'Meta media upload failed')).code(status); + } + + let metaRes; + try { + metaRes = await createMessageTemplate(creds.wabaId, creds.accessToken, metaBody); + } catch (err) { + const code = err.status && err.status < 500 ? 'META_VALIDATION' : 'META_ERROR'; + return h.response(error(code, err.message || 'Meta API error')).code(err.status && err.status < 500 ? 400 : 502); + } + + try { + const vb = variableBindings && typeof variableBindings === 'object' ? variableBindings : {}; + const doc = await WhatsAppTemplate.create({ + organization: oid, + name, + language: lang, + category, + components, + variableBindings: { + header: Array.isArray(vb.header) ? vb.header.map((x) => String(x || '').trim()) : [], + body: Array.isArray(vb.body) ? vb.body.map((x) => String(x || '').trim()) : [], + url: Array.isArray(vb.url) ? vb.url.map((x) => String(x || '').trim()) : [], + }, + metaTemplateId: metaRes.id != null ? String(metaRes.id) : '', + status: metaRes.status != null ? String(metaRes.status).toUpperCase() : 'PENDING', + rejectionReason: '', + lastSyncedAt: new Date(), + lastError: '', + createdBy: user._id, + }); + return h.response(success(doc, 'Template submitted to Meta', 201)).code(201); + } catch (e) { + if (e.code === 11000) { + return h.response(error('VALIDATION_ERROR', 'A template with this name and language already exists')).code(400); + } + throw e; + } +}; + +const syncOne = async (request, h) => { + const user = request.auth.credentials.user; + const denied = assertWrite(user); + if (denied) return h.response(error(denied.code, denied.message)).code(denied.status); + const oid = organizationId(user); + if (!oid) return h.response(error('VALIDATION_ERROR', 'No organization')).code(400); + const exists = await WhatsAppTemplate.findOne({ _id: request.params.id, organization: oid }).lean(); + if (!exists) return h.response(error('NOT_FOUND', 'Template not found')).code(404); + try { + const r = await syncOrganizationTemplates(oid); + if (!r.ok) return h.response(error('VALIDATION_ERROR', r.error || 'Sync failed')).code(400); + } catch (err) { + return h.response(error('META_ERROR', err.message || 'Meta sync failed')).code(502); + } + const doc = await WhatsAppTemplate.findOne({ _id: request.params.id, organization: oid }).lean(); + return h.response(success(doc)); +}; + +const remove = async (request, h) => { + const user = request.auth.credentials.user; + const denied = assertWrite(user); + if (denied) return h.response(error(denied.code, denied.message)).code(denied.status); + const oid = organizationId(user); + if (!oid) return h.response(error('VALIDATION_ERROR', 'No organization')).code(400); + const r = await WhatsAppTemplate.deleteOne({ _id: request.params.id, organization: oid }); + if (r.deletedCount === 0) return h.response(error('NOT_FOUND', 'Template not found')).code(404); + return h.response(success(null, 'Template removed from dashboard')); +}; + +module.exports = { list, get, create, syncOne, remove }; diff --git a/src/jobs/subscriptionExpiry.job.js b/src/jobs/subscriptionExpiry.job.js new file mode 100644 index 0000000..57a57f4 --- /dev/null +++ b/src/jobs/subscriptionExpiry.job.js @@ -0,0 +1,27 @@ +const Organization = require('../models/Organization'); + +/** + * Downgrade organisations whose paid subscription period has ended. + * @returns {PromiseOne-time fee to unlock manual UPI / proof-based ticketing for this event.
+${orgName}
+| Event | ${ev} |
| Description | Manual UPI ticketing — enablement fee |
| Amount | ${currency} ${major} |
| Date | ${escapeHtml(date)} |
| Razorpay order | ${orderId} |
| Razorpay payment | ${payId} |
| Transaction id | ${escapeHtml(String(tx._id))} |
This document is a receipt for your plan purchase.
+${orgName}
+| Plan | ${planId} |
| Amount | ${currency} ${major} |
| Date | ${escapeHtml(date)} |
| Razorpay order | ${orderId} |
| Razorpay payment | ${payId} |
| Transaction id | ${escapeHtml(String(tx._id))} |
A ticket was purchased online for ${escapeHtml(eventName)}.
+Open the dashboard → Ticketing to review activity.
+ `; + } else if (p.kind === 'manual_submitted') { + subject = `[EventBuzz] UPI ticket proof pending review — ${eventName}`; + html = ` +A buyer submitted a UPI payment screenshot for ${escapeHtml(eventName)}.
+${escapeHtml(p.orderId)}Review and approve or reject in the dashboard → Ticketing → Manual UPI orders.
+ `; + } else if (p.kind === 'manual_approved') { + subject = `[EventBuzz] UPI ticket approved — ${eventName}`; + html = ` +A manual UPI ticket order was approved for ${escapeHtml(eventName)}.
+A manual UPI ticket order was rejected for ${escapeHtml(eventName)}.
+Reason: ${escapeHtml(p.rejectReason || '—')}
+ `; + } + + for (const to of toList) { + void sendOrgMail({ + organizationId: p.organizationId, + to, + subject, + html, + text: html.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim(), + }); + } +} + +module.exports = { notifyTicketStakeholders, collectStakeholderEmails }; diff --git a/src/services/ticketingManualEnablement.service.js b/src/services/ticketingManualEnablement.service.js new file mode 100644 index 0000000..ea11b74 --- /dev/null +++ b/src/services/ticketingManualEnablement.service.js @@ -0,0 +1,87 @@ +const Event = require('../models/Event'); +const { createPaymentOrderCore } = require('./payments/createOrderCore'); +const { defaultManualEnablementFeeInrFromEnv } = require('../utils/manualTicketingFee'); + +const SUBSCRIPTION_PLAN_SENTINEL = 'manual_upi_enablement'; + +/** + * @param {import('mongoose').Types.ObjectId|string} organizationId + * @param {import('mongoose').Types.ObjectId|string} eventId + */ +async function assertEventBelongsToOrg(organizationId, eventId) { + const event = await Event.findById(eventId).select('organization ticketingManualPayment').lean(); + if (!event) { + const e = new Error('Event not found'); + e.code = 'NOT_FOUND'; + throw e; + } + if (String(event.organization) !== String(organizationId)) { + const e = new Error('Event not in organisation'); + e.code = 'FORBIDDEN'; + throw e; + } + return event; +} + +/** + * Razorpay order for one-time manual UPI enablement (billing / invoices). + * @param {{ organizationId: import('mongoose').Types.ObjectId, userId: import('mongoose').Types.ObjectId, eventId: import('mongoose').Types.ObjectId|string }} p + */ +async function createManualEnablementCheckoutOrder(p) { + const { organizationId, userId, eventId } = p; + const event = await assertEventBelongsToOrg(organizationId, eventId); + const mp = event.ticketingManualPayment || {}; + if (mp.enablementFeePaidAt) { + const e = new Error('Manual UPI enablement fee has already been paid for this event'); + e.code = 'ALREADY_PAID'; + throw e; + } + + const feeInr = defaultManualEnablementFeeInrFromEnv(); + if (feeInr <= 0) { + const e = new Error('Enablement fee is not configured'); + e.code = 'INVALID_CONFIG'; + throw e; + } + const amountPaise = Math.round(feeInr * 100); + + return createPaymentOrderCore({ + organizationId, + eventId, + participantId: null, + amountSubtotalMinor: amountPaise, + currency: 'INR', + idempotencyKey: `ticketing-manual-enable:${String(eventId)}`, + purpose: 'ticketing_manual_enablement', + subscriptionPlanId: SUBSCRIPTION_PLAN_SENTINEL, + purchasedBy: userId, + registrationContext: { kind: 'ticketing_manual_enablement', eventId: String(eventId) }, + }); +} + +/** + * After Razorpay verify — unlock manual UPI configuration for the event. + * @param {import('mongoose').Document} tx + */ +async function applyTicketingManualEnablementFromPayment(tx) { + if (tx.purpose !== 'ticketing_manual_enablement') return; + const ctx = tx.registrationContext && typeof tx.registrationContext === 'object' ? tx.registrationContext : null; + if (!ctx || ctx.kind !== 'ticketing_manual_enablement' || !ctx.eventId) return; + + const event = await Event.findById(ctx.eventId); + if (!event || String(event.organization) !== String(tx.organization)) return; + + const prev = event.ticketingManualPayment && typeof event.ticketingManualPayment === 'object' ? event.ticketingManualPayment : {}; + event.ticketingManualPayment = { + ...prev, + enablementFeePaidAt: new Date(), + enablementTransaction: tx._id, + }; + await event.save(); +} + +module.exports = { + createManualEnablementCheckoutOrder, + applyTicketingManualEnablementFromPayment, + SUBSCRIPTION_PLAN_SENTINEL, +}; diff --git a/src/services/whatsappTemplateMetaSync.js b/src/services/whatsappTemplateMetaSync.js new file mode 100644 index 0000000..5658fe7 --- /dev/null +++ b/src/services/whatsappTemplateMetaSync.js @@ -0,0 +1,59 @@ +const WhatsAppTemplate = require('../models/WhatsAppTemplate'); +const { getOrgWhatsAppCredentials, listMessageTemplates } = require('../utils/metaWhatsApp'); + +function normLang(s) { + return String(s || '') + .trim() + .replace(/-/g, '_') + .toLowerCase(); +} + +function rejectionFromMeta(m) { + if (!m || typeof m !== 'object') return ''; + return String(m.rejected_reason || m.reason || '').trim(); +} + +/** + * Pull template rows from Meta and update local docs (by metaTemplateId or name+language). + * @param {import('mongoose').Types.ObjectId|string} organizationId + */ +async function syncOrganizationTemplates(organizationId) { + const creds = await getOrgWhatsAppCredentials(organizationId); + if (!creds) { + return { ok: false, error: 'WhatsApp Cloud is not configured for this organisation (WABA + access token).' }; + } + + const data = await listMessageTemplates(creds.wabaId, creds.accessToken); + const list = Array.isArray(data.data) ? data.data : []; + const locals = await WhatsAppTemplate.find({ organization: organizationId }).lean(); + const now = new Date(); + + for (const loc of locals) { + let m = null; + if (loc.metaTemplateId) { + m = list.find((x) => String(x.id) === String(loc.metaTemplateId)); + } + if (!m) { + m = list.find((x) => x.name === loc.name && normLang(x.language) === normLang(loc.language)); + } + if (m) { + const st = m.status != null ? String(m.status).toUpperCase() : loc.status; + await WhatsAppTemplate.updateOne( + { _id: loc._id }, + { + $set: { + metaTemplateId: String(m.id), + status: st, + rejectionReason: rejectionFromMeta(m), + lastSyncedAt: now, + lastError: '', + }, + } + ); + } + } + + return { ok: true, metaCount: list.length }; +} + +module.exports = { syncOrganizationTemplates }; diff --git a/src/utils/aiEventMergeAndGaps.js b/src/utils/aiEventMergeAndGaps.js new file mode 100644 index 0000000..4a14d37 --- /dev/null +++ b/src/utils/aiEventMergeAndGaps.js @@ -0,0 +1,185 @@ +const { + EVENT_TYPES: AI_EVENT_TYPES, + EVENT_STATUS: AI_EVENT_STATUS, + LOCATION_TYPES: AI_LOCATION_TYPES, +} = require('./bedrockExtractEvent'); + +function defaultAiDateRange() { + const start = new Date(); + start.setUTCDate(start.getUTCDate() + 7); + start.setUTCHours(10, 0, 0, 0); + const end = new Date(start.getTime()); + end.setUTCHours(18, 0, 0, 0); + return { start, end }; +} + +/** + * Same merge as event.controller historical AI path (defaults + inference). + * @param {RecordThis link expires in 14 days.
— EventBuzz
`; - const t = getTransporter(); + const t = getDefaultTransporter(); if (!t) { console.log('[EventInvite email skipped — set MAIL_HOST or SMTP_HOST]\nTo:', to, '\nLink:', acceptUrl); return true; @@ -81,14 +172,6 @@ This link expires in 14 days. } } -function escapeHtml(s) { - return String(s || '') - .replace(/&/g, '&') - .replace(//g, '>') - .replace(/"/g, '"'); -} - async function sendVisitorOtpEmail({ to, otp, eventName }) { const from = getMailFrom(); const name = eventName || 'your event'; @@ -104,7 +187,7 @@ It expires in 10 minutes.This code expires in 10 minutes.
— EventBuzz
`; - const t = getTransporter(); + const t = getDefaultTransporter(); if (!t) { console.log(`[visitor OTP — no MAIL_HOST/SMTP_HOST] to=${to} code=${otp}`); return true; @@ -134,7 +217,7 @@ ${magicLinkUrl}This link expires in 15 minutes.
— EventBuzz
`; - const t = getTransporter(); + const t = getDefaultTransporter(); if (!t) { console.log(`[visitor magic link — no MAIL_HOST/SMTP_HOST] to=${to}\n${magicLinkUrl}`); return true; @@ -148,19 +231,7 @@ ${magicLinkUrl} } } -/** - * Microsite "Contact us" form: notify organizer-defined email (published static sites). - * @param {{ to: string, eventName?: string, visitorEmail: string, firstName?: string, lastName?: string, message?: string }} opts - * @returns {PromiseEvent: ${escapeHtml(eventName || '—')}
— EventBuzz microsite
`; - const t = getTransporter(); + const t = getDefaultTransporter(); if (!t) { console.log(`[microsite contact — no MAIL_HOST/SMTP_HOST] to=${to}\n${text}`); return true; @@ -189,9 +260,66 @@ ${message || '(no message)'} } } +async function sendContactSalesLeadEmail({ + to, + requesterEmail, + requesterName, + organizationName, + planId, + planName, + requirements, +}) { + const from = getMailFrom(); + const subject = `[EventBuzz] Contact sales — ${planName || planId || 'Enterprise'} (${organizationName || 'Organisation'})`; + const who = [requesterName, requesterEmail].filter(Boolean).join(' — ') || requesterEmail; + const text = `A team requested a contact-sales / enterprise conversation. + +Organisation: ${organizationName || '—'} +Plan interest: ${planName || planId || '—'} (${planId || '—'}) +From: ${who} + +Requirements / message: +${requirements} + +— EventBuzz billing`; + + const html = `Contact sales lead
+Organisation: ${escapeHtml(organizationName || '—')}
+Plan interest: ${escapeHtml(planName || planId || '—')} ${escapeHtml(planId || '')}
+From: ${escapeHtml(requesterName || '')} <${escapeHtml(requesterEmail)}>
${escapeHtml(requirements)}
+— EventBuzz billing
`; + + const t = getDefaultTransporter(); + const toStr = Array.isArray(to) ? to.filter(Boolean).join(', ') : String(to || ''); + if (!toStr) { + console.log('[Contact sales — no recipients]\n', text); + return false; + } + if (!t) { + console.log(`[Contact sales — no MAIL_HOST/SMTP_HOST] to=${toStr}\n${text}`); + return true; + } + try { + await t.sendMail({ from, to: toStr, subject, text, html }); + return true; + } catch (e) { + console.error('sendContactSalesLeadEmail', e.message); + return false; + } +} + module.exports = { + getMailFrom, + getDefaultTransporter, + getTransporter, + getTransporterForOrganization, + orgFromAddress, + sendOrgMail, + clearOrgTransportCache, sendEventInviteEmail, sendVisitorOtpEmail, sendVisitorMagicLinkEmail, sendMicrositeContactEmail, + sendContactSalesLeadEmail, }; diff --git a/src/utils/manualTicketingFee.js b/src/utils/manualTicketingFee.js new file mode 100644 index 0000000..78a9602 --- /dev/null +++ b/src/utils/manualTicketingFee.js @@ -0,0 +1,9 @@ +/** One-time org fee (INR major) to unlock manual UPI ticketing per event — recorded in billing. */ +function defaultManualEnablementFeeInrFromEnv() { + const n = parseInt(process.env.EVENT_TICKETING_MANUAL_ENABLEMENT_FEE_INR || '500', 10); + return Number.isFinite(n) && n >= 0 ? n : 500; +} + +module.exports = { + defaultManualEnablementFeeInrFromEnv, +}; diff --git a/src/utils/metaWhatsApp.js b/src/utils/metaWhatsApp.js new file mode 100644 index 0000000..7acff23 --- /dev/null +++ b/src/utils/metaWhatsApp.js @@ -0,0 +1,660 @@ +const { decrypt } = require('./smtpCrypto'); + +function normalizeVersion(v) { + const raw = v != null && String(v).trim() !== '' ? String(v).trim() : 'v21.0'; + let s = raw; + if (!/^v\d/i.test(s)) s = `v${s}`; + return s.toLowerCase(); +} + +function graphBaseUrl() { + return `https://graph.facebook.com/${normalizeVersion(process.env.META_GRAPH_API_VERSION)}`; +} + +/** + * @param {string} organizationId + * @returns {Promise<{ wabaId: string, accessToken: string, phoneNumberId: string } | null>} + */ +async function getOrgWhatsAppCredentials(organizationId) { + const Organization = require('../models/Organization'); + const org = await Organization.findById(organizationId).lean(); + if (!org) return null; + const wc = org.whatsappCloud || {}; + if (wc.enabled && wc.wabaId) { + const token = decrypt(wc.accessTokenEnc || ''); + if (token) { + return { + wabaId: String(wc.wabaId).trim(), + accessToken: token, + phoneNumberId: wc.phoneNumberId ? String(wc.phoneNumberId).trim() : '', + }; + } + } + const dw = (process.env.META_WHATSAPP_DEFAULT_WABA_ID || '').trim(); + const dt = (process.env.META_WHATSAPP_ACCESS_TOKEN || '').trim(); + if (dw && dt) { + return { + wabaId: dw, + accessToken: dt, + phoneNumberId: (process.env.META_WHATSAPP_DEFAULT_PHONE_NUMBER_ID || '').trim(), + }; + } + return null; +} + +function graphErrorMessage(data, fallback) { + if (!data || typeof data !== 'object') return fallback; + const e = data.error; + if (e && typeof e === 'object') { + return e.error_user_msg || e.message || e.error_user_title || fallback; + } + return fallback; +} + +/** + * Parse Graph JSON with numeric `id` fields coerced to strings so large WABA / phone ids are not + * corrupted by JavaScript Number (e.g. 9163703890405324 > Number.MAX_SAFE_INTEGER). + * @param {string} text + */ +function parseGraphJsonSafeIds(text) { + const sanitized = String(text || '').replace(/"id"\s*:\s*(\d+)/g, '"id":"$1"'); + return JSON.parse(sanitized); +} + +function normalizeMetaId(v) { + if (v == null) return ''; + return String(v).trim(); +} + +function skipPhoneWabaGraphCheck() { + const v = String(process.env.META_WHATSAPP_SKIP_PHONE_WABA_CHECK || '').trim().toLowerCase(); + return v === '1' || v === 'true'; +} + +function metaDebugEnabled() { + const d = String(process.env.META_WHATSAPP_DEBUG || '').trim(); + const l = String(process.env.META_WHATSAPP_LOG || '').trim().toLowerCase(); + return d === '1' || d === 'true' || l === 'true' || l === '1'; +} + +/** Max JSON chars per log line block (avoid huge stdout). Override with META_WHATSAPP_LOG_MAX_CHARS. */ +function metaLogMaxChars() { + const n = parseInt(process.env.META_WHATSAPP_LOG_MAX_CHARS || '250000', 10); + return Number.isFinite(n) && n > 1000 ? n : 250000; +} + +function stringifyForMetaLog(value) { + try { + if (typeof value === 'string') return value; + return JSON.stringify(value, null, 0); + } catch { + return String(value); + } +} + +function truncateMetaLog(str) { + const max = metaLogMaxChars(); + if (str.length <= max) return str; + return `${str.slice(0, max)}\n… [metaWhatsApp log truncated: ${str.length - max} more chars; raise META_WHATSAPP_LOG_MAX_CHARS]`; +} + +function logMeta(label, payload) { + if (!metaDebugEnabled()) return; + try { + const line = typeof payload === 'string' ? payload : stringifyForMetaLog(payload); + console.log(`[metaWhatsApp] ${label}`, truncateMetaLog(line)); + } catch { + console.log(`[metaWhatsApp] ${label}`, payload); + } +} + +/** + * One logical Graph call: request + response (never logs tokens). + * @param {string} operation e.g. "POST message_templates" + * @param {object} request { method, url, headers?, body? } — body is JSON-serializable or Buffer length only + * @param {object} response { httpStatus, ok, body } + */ +function logMetaGraphExchange(operation, request, response) { + if (!metaDebugEnabled()) return; + const reqOut = { + method: request.method, + url: request.url, + ...(request.headers && Object.keys(request.headers).length ? { headers: request.headers } : {}), + ...(request.body !== undefined + ? { body: request.body } + : request.bodyBytes != null + ? { body: `[binary ${request.bodyBytes} bytes]` } + : {}), + }; + logMeta(`${operation} request`, reqOut); + logMeta(`${operation} response`, { + httpStatus: response.httpStatus, + ok: response.ok, + body: response.body, + }); +} + +/** + * Meta: parameters cannot be leading or trailing in BODY / HEADER (text) / button label. + * Trailing/leading punctuation and spaces do NOT count—e.g. "... for {{2}}." is still rejected + * because after stripping ". " the string ends with }}. + * Not applied to URL button `url` (dynamic suffix allowed). + */ +const PARAM_AT_START = /^\{\{\s*\d+\s*\}\}/; +const PARAM_AT_END = /\{\{\s*\d+\s*\}\}$/; +const HAS_PARAM = /\{\{\s*\d+\s*\}\}/; +/** Strip chars Meta ignores when deciding if a param is “at the edge”. */ +const LEAD_EDGE_NOISE = /^[.,;:!?…'"«»""''()\[\]\s\u2013\u2014\-]+/u; +const TRAIL_EDGE_NOISE = /[.,;:!?…'"«»""''()\[\]\s\u2013\u2014\-]+$/u; + +function validationError(message) { + const err = new Error(message); + err.status = 400; + err.code = 'WA_TEMPLATE_RULE'; + return err; +} + +function assertParamNotAtTextEdges(text, fieldLabel) { + const t = String(text || '').trim(); + if (!t || !HAS_PARAM.test(t)) return; + const forStart = t.replace(LEAD_EDGE_NOISE, ''); + if (PARAM_AT_START.test(forStart)) { + throw validationError( + `${fieldLabel}: WhatsApp does not allow a variable at the very start. Put real words before the first {{1}} (not only punctuation).`, + ); + } + const forEnd = t.replace(TRAIL_EDGE_NOISE, ''); + if (PARAM_AT_END.test(forEnd)) { + throw validationError( + `${fieldLabel}: WhatsApp does not allow a variable at the end with only punctuation after it. Example: change "…for {{2}}." to "…for {{2}} We look forward to seeing you." (add words after the last variable).`, + ); + } +} + +/** + * Run before POST message_templates to match common Meta rejections (clearer than API error). + * @param {unknown[]} components + */ +function validateTemplateComponentsForMeta(components) { + if (!Array.isArray(components)) return; + for (const c of components) { + if (!c || typeof c !== 'object') continue; + const type = String(c.type || '').toUpperCase(); + const format = String(c.format || '').toUpperCase(); + + if (type === 'BODY' && c.text != null) { + assertParamNotAtTextEdges(c.text, 'BODY'); + } + if (type === 'HEADER' && format === 'TEXT' && c.text != null) { + assertParamNotAtTextEdges(c.text, 'HEADER (text)'); + } + if (type === 'FOOTER' && c.text != null) { + const ft = String(c.text || ''); + if (HAS_PARAM.test(ft)) { + throw validationError( + 'FOOTER: WhatsApp does not allow variables in the footer. Use static text only or leave the footer empty.', + ); + } + } + if (type === 'BUTTONS' && Array.isArray(c.buttons)) { + for (let i = 0; i < c.buttons.length; i += 1) { + const b = c.buttons[i]; + if (b && typeof b === 'object' && b.text != null) { + assertParamNotAtTextEdges(b.text, `BUTTON #${i + 1} label`); + } + } + } + } +} + +function isHttpUrl(s) { + return /^https?:\/\//i.test(String(s || '').trim()); +} + +function metaAppId() { + return String(process.env.META_WHATSAPP_APP_ID || process.env.META_APP_ID || '').trim(); +} + +function templateHeaderUploadMaxBytes() { + const n = Number(process.env.META_WHATSAPP_HEADER_UPLOAD_MAX_BYTES); + if (Number.isFinite(n) && n > 0) return n; + return 5 * 1024 * 1024; +} + +function safeFileNameFromUrl(url) { + try { + const u = new URL(url); + const base = u.pathname.split('/').pop() || 'header'; + const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, '_'); + return (cleaned || 'header').slice(0, 120); + } catch { + return 'header.bin'; + } +} + +/** @param {string} contentType @param {string} fileName @param {string} url */ +function mimeForTemplateUpload(contentType, fileName, url) { + const c = String(contentType || '').toLowerCase(); + if (c.includes('png')) return 'image/png'; + if (c.includes('jpeg') || c.includes('jpg')) return 'image/jpeg'; + const lower = `${fileName || ''} ${url || ''}`.toLowerCase(); + if (lower.includes('.png')) return 'image/png'; + if (lower.includes('.jpg') || lower.includes('.jpeg')) return 'image/jpeg'; + return 'image/png'; +} + +async function fetchBinaryFromUrl(url) { + const res = await fetch(url, { redirect: 'follow' }); + if (!res.ok) { + const err = new Error(`Could not download header image (${res.status})`); + err.status = 400; + err.code = 'WA_TEMPLATE_RULE'; + throw err; + } + const buf = Buffer.from(await res.arrayBuffer()); + const max = templateHeaderUploadMaxBytes(); + if (buf.length > max) { + throw validationError( + `HEADER (image): file is too large for Meta upload (max ${Math.round(max / 1024 / 1024)}MB).`, + ); + } + const ct = res.headers.get('content-type') || ''; + return { buffer: buf, contentType: ct.split(';')[0].trim() }; +} + +/** + * Meta template IMAGE examples need a resumable-upload handle, not a public URL. + * @see https://developers.facebook.com/docs/graph-api/guides/upload/ + */ +async function metaResumableUploadForTemplate(accessToken, appId, buffer, fileName, fileType) { + const base = graphBaseUrl(); + const sessionUrl = `${base}/${encodeURIComponent(appId)}/uploads`; + const sessionPayload = { + file_length: buffer.length, + file_name: fileName, + file_type: fileType, + }; + const sRes = await fetch(sessionUrl, { + method: 'POST', + headers: { + Authorization: `Bearer ${accessToken}`, + 'Content-Type': 'application/json', + }, + body: JSON.stringify(sessionPayload), + }); + const sData = await sRes.json().catch(() => ({})); + logMetaGraphExchange('POST /{app-id}/uploads (session)', { + method: 'POST', + url: sessionUrl, + headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ***' }, + body: sessionPayload, + }, { httpStatus: sRes.status, ok: sRes.ok, body: sData }); + if (!sRes.ok || !sData.id) { + const msg = graphErrorMessage(sData, 'Meta upload session failed'); + const err = new Error(msg); + err.status = sRes.status; + err.raw = sData; + throw err; + } + const uploadSessionId = String(sData.id); + const uploadUrl = `${base}/${uploadSessionId}`; + const uRes = await fetch(uploadUrl, { + method: 'POST', + headers: { + // Graph resumable upload step 2 expects OAuth-scheme token for some apps; matches working integrations. + Authorization: `OAuth ${accessToken}`, + file_offset: '0', + }, + body: buffer, + }); + const uData = await uRes.json().catch(() => ({})); + logMetaGraphExchange('POST /{upload-session-id} (binary)', { + method: 'POST', + url: uploadUrl, + headers: { Authorization: 'OAuth ***', file_offset: '0' }, + bodyBytes: buffer.length, + }, { httpStatus: uRes.status, ok: uRes.ok, body: uData }); + if (!uRes.ok || !uData.h) { + const msg = graphErrorMessage(uData, 'Meta media upload failed'); + const err = new Error(msg); + err.status = uRes.status; + err.raw = uData; + throw err; + } + return String(uData.h); +} + +/** + * Replace any https URLs in HEADER IMAGE `example.header_handle` with Meta upload handles. + * Leaves existing handles unchanged. Mutates `components` in place. + * @param {unknown[]} components + * @param {string} accessToken + */ +async function resolveTemplateImageHeaderHandles(components, accessToken) { + if (!Array.isArray(components)) return; + const appId = metaAppId(); + for (const c of components) { + if (!c || typeof c !== 'object') continue; + const type = String(c.type || '').toUpperCase(); + const format = String(c.format || '').toUpperCase(); + if (type !== 'HEADER' || format !== 'IMAGE') continue; + const ex = c.example; + if (!ex || typeof ex !== 'object' || !Array.isArray(ex.header_handle)) continue; + const out = []; + for (const raw of ex.header_handle) { + const s = String(raw || '').trim(); + if (!s) continue; + if (!isHttpUrl(s)) { + out.push(s); + continue; + } + if (!appId) { + throw validationError( + 'HEADER (image): Meta needs a resumable upload for the sample image. Set META_WHATSAPP_APP_ID (Meta app ID) in server environment, then try again.', + ); + } + const allowed = new Set(['image/png', 'image/jpeg', 'image/jpg']); + const { buffer, contentType } = await fetchBinaryFromUrl(s); + const fileName = safeFileNameFromUrl(s); + let fileType = mimeForTemplateUpload(contentType, fileName, s); + if (fileType === 'image/jpg') fileType = 'image/jpeg'; + if (!allowed.has(fileType)) { + throw validationError( + 'HEADER (image): use a PNG or JPEG sample. Other types are not supported for WhatsApp template upload.', + ); + } + const h = await metaResumableUploadForTemplate(accessToken, appId, buffer, fileName, fileType); + out.push(h); + } + ex.header_handle = out; + } +} + +/** + * @param {string} wabaId + * @param {string} accessToken + * @param {object} body — Meta message_templates create body + */ +async function createMessageTemplate(wabaId, accessToken, body) { + const url = `${graphBaseUrl()}/${encodeURIComponent(wabaId)}/message_templates`; + const res = await fetch(url, { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + Authorization: `Bearer ${accessToken}`, + }, + body: JSON.stringify(body), + }); + const data = await res.json().catch(() => ({})); + logMetaGraphExchange('POST /{waba-id}/message_templates', { + method: 'POST', + url, + headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ***' }, + body, + }, { httpStatus: res.status, ok: res.ok, body: data }); + if (!res.ok) { + const msg = graphErrorMessage(data, res.statusText || 'Meta API error'); + const err = new Error(msg); + err.status = res.status; + err.raw = data; + throw err; + } + return data; +} + +/** + * @param {string} wabaId + * @param {string} accessToken + * @param {Record