External resource (#31)

* new external resource db model

* returning external resources

* validating active sub

* restricted signed url

* handling upload workflow of external resource

* rebase fixes

* redis cache try

* put and lite subscription

* host id

* improvements and test fixes

* delete external resource

* address feedback

* Address feedback

* fix ci

* Address feedback

* address feedback

---------

Co-authored-by: Gianni Carlo <gcarlo89@hotmail.com>

Author: Hirobreak

.github/workflows/test.yml

@@ -49,6 +49,9 @@ jobs:
       REVENUECAT_API_V2: https://ci.dummy/v2
       REVENUECAT_API_V2_KEY: ci-dummy
       REVENUECAT_PROJECT_ID: ci-dummy
+      REVENUECAT_ENTITLEMENT_PRO: ci-dummy-pro
+      REVENUECAT_ENTITLEMENT_PLUS: ci-dummy-plus
+      REVENUECAT_ENTITLEMENT_LITE: ci-dummy-lite
       PROXY_FILE_URL: https://ci.dummy
       APP_VERSION: latest
 

.gitignore

@@ -22,6 +22,7 @@ development.env
 store/*
 .development.env
 dump.rdb
+tsconfig.tsbuildinfo
 
 # Apple root certificates (should be downloaded fresh from Apple)
 certs/*.cer

development.env.template

@@ -32,6 +32,11 @@ REVENUECAT_KEY=
 REVENUECAT_API_V2=https://api.revenuecat.com/v2
 REVENUECAT_API_V2_KEY=
 REVENUECAT_PROJECT_ID=
+# RC internal entitlement object ids (e.g. entla0aca3f4af) -> tier. Find them at
+# RC dashboard > Project > Entitlements (the "id", not the lookup key).
+REVENUECAT_ENTITLEMENT_PRO=
+REVENUECAT_ENTITLEMENT_PLUS=
+REVENUECAT_ENTITLEMENT_LITE=
 
 REDIS_ENV=bookplayer_
 REDIS_URL=redis://127.0.0.1:6379

docker/ecs/task-definition.json

@@ -116,6 +116,18 @@
           "name": "REVENUECAT_PROJECT_ID",
           "valueFrom": "arn:aws:secretsmanager:us-east-1:327317202676:secret:prod/bookplayer-api:REVENUECAT_PROJECT_ID::"
         },
+        {
+          "name": "REVENUECAT_ENTITLEMENT_PRO",
+          "valueFrom": "arn:aws:secretsmanager:us-east-1:327317202676:secret:prod/bookplayer-api:REVENUECAT_ENTITLEMENT_PRO::"
+        },
+        {
+          "name": "REVENUECAT_ENTITLEMENT_PLUS",
+          "valueFrom": "arn:aws:secretsmanager:us-east-1:327317202676:secret:prod/bookplayer-api:REVENUECAT_ENTITLEMENT_PLUS::"
+        },
+        {
+          "name": "REVENUECAT_ENTITLEMENT_LITE",
+          "valueFrom": "arn:aws:secretsmanager:us-east-1:327317202676:secret:prod/bookplayer-api:REVENUECAT_ENTITLEMENT_LITE::"
+        },
         {
           "name": "PROXY_FILE_URL",
           "valueFrom": "arn:aws:secretsmanager:us-east-1:327317202676:secret:prod/bookplayer-api:PROXY_FILE_URL::"

package.json

@@ -51,7 +51,8 @@
     "semver": "^7.7.2",
     "ts-node": "^10.5.0",
     "verify-apple-id-token": "^3.1.2",
-    "winston": "^3.9.0"
+    "winston": "^3.9.0",
+    "zod": "^3"
   },
   "devDependencies": {
     "@types/compression": "^1.7.2",

src/__tests__/middlewares/subscription.test.ts

@@ -1,16 +1,19 @@
 import { describe, it, expect, beforeEach, jest } from '@jest/globals';
 
 const mockIsActive =
-  jest.fn<(externalId: string) => Promise<boolean>>();
+  jest.fn<(externalId: string) => Promise<SubscriptionState>>();
+const mockFetchLiveEntitlements =
+  jest.fn<(externalId: string) => Promise<SubscriptionState | null>>();
 const mockGetExternalIdByUserId =
   jest.fn<(userId: number) => Promise<string | null>>();
 
-// Replace the SubscriptionService class with one whose isActive we control.
+// Replace the SubscriptionService class with one whose methods we control.
 // Hoisted by jest before the module-under-test is imported, so the singleton
 // in subscription.ts ends up holding our mock.
 jest.mock('../../services/SubscriptionService', () => ({
   SubscriptionService: jest.fn().mockImplementation(() => ({
     isActive: mockIsActive,
+    fetchLiveEntitlements: mockFetchLiveEntitlements,
   })),
 }));
 
@@ -21,7 +24,8 @@ jest.mock('../../services/db/UserDB', () => ({
 }));
 
 // eslint-disable-next-line import/first
-import { checkSubscription } from '../../api/middlewares/subscription';
+import { checkSubscription, requireSubscription } from '../../api/middlewares/subscription';
+import { SubscriptionState, SubscriptionTierEnum } from '../../types/user';
 
 describe('checkSubscription middleware', () => {
   let req: any;
@@ -49,7 +53,7 @@ describe('checkSubscription middleware', () => {
   });
 
   it('calls next() when isActive returns true', async () => {
-    mockIsActive.mockResolvedValue(true);
+    mockIsActive.mockResolvedValue({ active: true, verified: 'local', subscriptions: [] });
     await checkSubscription(req, res, next);
     expect(mockIsActive).toHaveBeenCalledWith('ext-1');
     expect(next).toHaveBeenCalledTimes(1);
@@ -58,7 +62,7 @@ describe('checkSubscription middleware', () => {
   });
 
   it('returns 400 "not subscribed" when isActive returns false', async () => {
-    mockIsActive.mockResolvedValue(false);
+    mockIsActive.mockResolvedValue({ active: false, verified: 'local', subscriptions: [] });
     await checkSubscription(req, res, next);
     expect(mockIsActive).toHaveBeenCalledWith('ext-1');
     expect(res.status).toHaveBeenCalledWith(400);
@@ -77,7 +81,7 @@ describe('checkSubscription middleware', () => {
   it('falls back to DB lookup when JWT lacks external_id (legacy Apple login)', async () => {
     req.user = { id_user: 42 };  // no external_id — pre-fix Apple JWT shape
     mockGetExternalIdByUserId.mockResolvedValue('ext-from-db');
-    mockIsActive.mockResolvedValue(true);
+    mockIsActive.mockResolvedValue({ active: true, verified: 'local', subscriptions: [] });
 
     await checkSubscription(req, res, next);
 
@@ -86,3 +90,109 @@ describe('checkSubscription middleware', () => {
     expect(next).toHaveBeenCalledTimes(1);
   });
 });
+
+describe('requireSubscription middleware', () => {
+  let res: any;
+  let next: jest.Mock;
+
+  beforeEach(() => {
+    res = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    };
+    next = jest.fn();
+    mockFetchLiveEntitlements.mockReset();
+    mockGetExternalIdByUserId.mockReset();
+    // Default: live RC check finds no upgrade.
+    mockFetchLiveEntitlements.mockResolvedValue(null);
+    mockGetExternalIdByUserId.mockResolvedValue('ext-1');
+  });
+
+  it('calls next() when the user holds an allowed tier (no RC call)', async () => {
+    const req: any = { user: { id_user: 1, external_id: 'ext-1', subscriptions: [SubscriptionTierEnum.PRO] } };
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.status).not.toHaveBeenCalled();
+    expect(mockFetchLiveEntitlements).not.toHaveBeenCalled();
+  });
+
+  it('matches a tier anywhere in the subscriptions array (not just index 0)', async () => {
+    const req: any = {
+      user: { id_user: 1, external_id: 'ext-1', subscriptions: [SubscriptionTierEnum.LITE, SubscriptionTierEnum.PRO] },
+    };
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(mockFetchLiveEntitlements).not.toHaveBeenCalled();
+  });
+
+  it('falls back to RC and allows the action when RC confirms the upgraded tier (lite → pro)', async () => {
+    const req: any = { user: { id_user: 1, external_id: 'ext-1', subscriptions: [SubscriptionTierEnum.LITE] } };
+    mockFetchLiveEntitlements.mockResolvedValue({
+      active: true,
+      verified: 'rc',
+      subscriptions: ['pro'],
+    });
+
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+
+    expect(mockFetchLiveEntitlements).toHaveBeenCalledWith('ext-1');
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(res.status).not.toHaveBeenCalled();
+    // req.user.subscriptions refreshed for downstream handlers
+    expect(req.user.subscriptions).toEqual(['pro']);
+  });
+
+  it('returns 403 when RC also lacks the required tier (no real upgrade)', async () => {
+    const req: any = { user: { id_user: 1, external_id: 'ext-1', subscriptions: [SubscriptionTierEnum.LITE] } };
+    mockFetchLiveEntitlements.mockResolvedValue({
+      active: true,
+      verified: 'rc',
+      subscriptions: ['lite'],
+    });
+
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+
+    expect(mockFetchLiveEntitlements).toHaveBeenCalledWith('ext-1');
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({ message: 'Requires one of: pro' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('returns 403 when RC is unreachable (fetchLiveEntitlements returns null)', async () => {
+    const req: any = { user: { id_user: 1, external_id: 'ext-1', subscriptions: [SubscriptionTierEnum.FREE] } };
+    mockFetchLiveEntitlements.mockResolvedValue(null);
+
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('resolves externalId via DB lookup when the JWT lacks external_id, then checks RC', async () => {
+    const req: any = { user: { id_user: 42, subscriptions: [SubscriptionTierEnum.LITE] } };
+    mockGetExternalIdByUserId.mockResolvedValue('ext-from-db');
+    mockFetchLiveEntitlements.mockResolvedValue({ active: true, verified: 'rc', subscriptions: ['pro'] });
+
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+
+    expect(mockGetExternalIdByUserId).toHaveBeenCalledWith(42);
+    expect(mockFetchLiveEntitlements).toHaveBeenCalledWith('ext-from-db');
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('returns 403 (does not throw) when subscriptions is undefined and RC finds nothing', async () => {
+    const req: any = { user: { id_user: 1, external_id: 'ext-1' } };
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('returns 400 with a message when req.user is missing', async () => {
+    const req: any = {};
+    await requireSubscription([SubscriptionTierEnum.PRO])(req, res, next);
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.json).toHaveBeenCalledWith({ message: 'User data missing.' });
+    expect(next).not.toHaveBeenCalled();
+    expect(mockFetchLiveEntitlements).not.toHaveBeenCalled();
+  });
+});