feat: add base Lago API codebase from upstream v1.46.0

.annotaterb.yml

@@ -0,0 +1,58 @@
+---
+:position: bottom
+:position_in_additional_file_patterns: bottom
+:position_in_class: bottom
+:position_in_factory: bottom
+:position_in_fixture: bottom
+:position_in_routes: bottom
+:position_in_serializer: bottom
+:position_in_test: bottom
+:classified_sort: true
+:exclude_controllers: true
+:exclude_factories: true
+:exclude_fixtures: true
+:exclude_helpers: true
+:exclude_scaffolds: true
+:exclude_serializers: true
+:exclude_sti_subclasses: false
+:exclude_tests: true
+:force: false
+:format_markdown: false
+:format_rdoc: false
+:format_yard: false
+:frozen: false
+:ignore_model_sub_dir: false
+:ignore_unknown_models: false
+:include_version: false
+:show_check_constraints: false
+:show_complete_foreign_keys: false
+:show_foreign_keys: true
+:show_indexes: true
+:simple_indexes: false
+:sort: false
+:timestamp: false
+:trace: false
+:with_comment: true
+:with_column_comments: true
+:with_table_comments: true
+:active_admin: false
+:command:
+:debug: false
+:hide_default_column_types: "json,jsonb,hstore"
+:hide_limit_column_types: "integer,bigint,boolean"
+:ignore_columns:
+:ignore_routes:
+:models: true
+:routes: false
+:skip_on_db_migrate: false
+:target_action: :do_annotations
+:wrapper:
+:wrapper_close:
+:wrapper_open:
+:classes_default_to_s: []
+:additional_file_patterns: []
+:model_dir:
+- app/models
+:require: []
+:root_dir:
+- ''

.dockerignore

@@ -0,0 +1,16 @@
+/tmp/*
+.rsa_private.pem
+.rsa_public.pem
+
+.git
+.gitignore
+.github
+
+README.md
+LICENSE
+CODE_OF_CONDUCT.md
+CONTRIBUTING.md
+SECURITY.md
+
+Dockerfile
+Dockerfile.dev

.env.dist

@@ -0,0 +1 @@
+DATABASE_URL=postgresql://lago:changeme@localhost:5432/lago_test

.git-blame-ignore-revs

@@ -0,0 +1,5 @@
+# Enable TrailingCommaInHashLiteral rubocop rule for all files
+3803519f622313a50def9b5261dfce899bdaf12d
+f83dbe1f847414c927273523b6cf60f3a881a9f1
+747a2feea6530ef298722f464e47855507c21886
+15179f005dc0a6f7d61140581e123662535e4e53

.gitattributes

@@ -0,0 +1,9 @@
+# See https://git-scm.com/docs/gitattributes for more about git attribute files.
+
+# Mark the database schema as having been generated.
+db/schema.rb linguist-generated
+schema.json linguist-generated
+schema.graphql linguist-generated
+
+# Mark any vendored files as having been vendored.
+vendor/* linguist-vendored

.github/workflows/front-compatibility.yml

@@ -0,0 +1,78 @@
+name: Front compatibility (PR check, informational)
+
+# Runs on PRs targeting main that modify schema.graphql. Regenerates
+# lago-front's types from the PR's schema and runs tsc against
+# lago-front main. Failure is informational only — the job is marked
+# continue-on-error so it never blocks merging. Authors can still see
+# a red/green signal in the PR's checks panel and inspect logs when
+# something breaks.
+#
+# Path filter on schema.graphql — most PRs don't change the schema, so
+# the workflow rarely runs. Cost: a few minutes of CI per schema change.
+
+on:
+  pull_request:
+    branches: [main]
+    paths: ['schema.graphql']
+
+jobs:
+  front-typecheck:
+    name: Front typecheck against PR schema (informational)
+    runs-on: ubuntu-latest
+    # Non-blocking: a failure here surfaces in the checks panel but does
+    # not fail the workflow run, so branch protection cannot gate on it.
+    continue-on-error: true
+
+    steps:
+      - name: Checkout lago-api (PR head — the new schema)
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: api
+
+      - name: Checkout lago-front (main — stable baseline)
+        uses: actions/checkout@v6
+        with:
+          repository: getlago/lago-front
+          ref: main
+          path: front
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          # lago-front declares its pnpm version in `packageManager`.
+          # Point the action at front's package.json so the version
+          # tracks whatever lago-front pins, no manual upkeep here.
+          package_json_file: front/package.json
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          # Inherit the version from lago-front's own package.json
+          # (engines.node) so this workflow tracks any node bump on the
+          # front side without manual upkeep here.
+          node-version-file: front/package.json
+          cache: pnpm
+          cache-dependency-path: front/pnpm-lock.yaml
+
+      - name: Install front dependencies
+        working-directory: front
+        run: pnpm install --frozen-lockfile
+
+      - name: Build workspace packages (prebuild)
+        working-directory: front
+        run: pnpm prebuild
+
+      - name: Regenerate front types from PR schema
+        working-directory: front
+        env:
+          # graphql-codegen accepts file paths in its `schema:` field.
+          # codegen.yml reads ${CODEGEN_API}; pointing it at the API
+          # PR's checked-in schema.graphql skips the API boot step
+          # entirely — no docker compose, no resolvers, just the schema.
+          CODEGEN_API: ../api/schema.graphql
+        run: pnpm codegen
+
+      - name: Type-check front
+        working-directory: front
+        run: pnpm tsc --noEmit

.github/workflows/internal-build.yml

@@ -0,0 +1,52 @@
+name: "Internal Build"
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      sidekiq_pro:
+        type: boolean
+        default: true
+        description: Enable Sidekiq Pro
+permissions: {}
+jobs:
+  build-api-image:
+    runs-on: ubuntu-latest
+    name: Build API Image
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Add version into docker image
+        run: echo ${{ github.sha }} > ./LAGO_VERSION
+
+      - name: Docker tag
+        id: docker_tag
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: lago-api-production
+          IMAGE_TAG: ${{ github.sha }}
+        run: echo "tag=$(echo $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG)" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.docker_tag.outputs.tag }}
+          build-args: |
+            BUNDLE_WITH=${{ (github.event_name == 'push' || github.event.inputs.sidekiq_pro == 'true') && 'sidekiq-pro' || '' }}
+          secrets: |
+            "BUNDLE_GEMS__CONTRIBSYS__COM=${{ secrets.BUNDLE_GEMS__CONTRIBSYS__COM }}"

.github/workflows/linters.yml

@@ -0,0 +1,43 @@
+name: Linters
+on: [pull_request]
+permissions: {}
+jobs:
+  linters:
+    name: Linters
+    runs-on: ubuntu-latest
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    env:
+      RAILS_ENV: production
+      RAILS_MASTER_KEY: N+XcWoGDzKjuoxrU8BIPN5D0/GSuqx9s
+      SECRET_KEY_BASE: cvIAI6ycC0OnVDRAjT5hmbRxnjCxl4YB
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "4.0.2"
+          bundler-cache: true
+      - name: Setup Rubocop
+        # A bug requires the use of `bundle install` to use `rubocop-rails`. A fix is coming to Rubocop.
+        # See: https://github.com/rubocop/rubocop/issues/12823
+        run: |
+          bundle install
+      - name: Run Rubocop
+        # We must pass the list of files because for now, rubocop on the entire project throws too many errors.
+        # We exclude the db/schema.rb file explicitly because passing a list of files will override the `AllCops.Exclude` config in .rubocop.yml
+        run: |
+          FILES=$(git diff --diff-filter=d --name-only origin/${{ github.base_ref }}...HEAD -- '*.rb' ':!db/*structure.sql')
+          if [ -z "$FILES" ]; then
+            echo "No Ruby files to lint"
+            exit 0
+          else
+            echo "Linting Ruby files"
+            bundle exec rubocop $FILES
+          fi
+      - name: Generate RSA keys
+        run: ./scripts/generate.rsa.sh
+      - name: Zeitwerk check
+        run: bin/rails zeitwerk:check

.github/workflows/migrations-test.yml

@@ -0,0 +1,75 @@
+name: Run rails migrations
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+    types: [opened, synchronize, reopened]
+permissions: {}
+jobs:
+  run-migrations:
+    name: Run migrations
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: getlago/postgres-partman:15.0-alpine
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_DB: lago
+          POSTGRES_USER: lago
+          POSTGRES_PASSWORD: lago
+    env:
+      RAILS_ENV: test
+      DATABASE_URL: "postgres://lago:lago@localhost:5432/lago"
+      RAILS_MASTER_KEY: N+XcWoGDzKjuoxrU8BIPN5D0/GSuqx9s
+      SECRET_KEY_BASE: cvIAI6ycC0OnVDRAjT5hmbRxnjCxl4YB
+      ENCRYPTION_PRIMARY_KEY: 5I9mjfzry2P787x4S5ZuDdJwXNgYEwqo
+      ENCRYPTION_DETERMINISTIC_KEY: SGiZzmh18EjBF9gSW8LCNk7pelauWVr4
+      ENCRYPTION_KEY_DERIVATION_SALT: q3pkMw34ZkRPFSf2LmtWe705yw532Pf7
+      LAGO_API_URL: https://api.lago.dev
+      LAGO_PDF_URL: https://pdf.lago.dev
+      LAGO_FROM_EMAIL: noreply@getlago.com
+      LAGO_CLICKHOUSE_ENABLED: true
+      LAGO_CLICKHOUSE_MIGRATIONS_ENABLED: true
+      LAGO_CLICKHOUSE_HOST: localhost
+      LAGO_CLICKHOUSE_DATABASE: default
+      LAGO_CLICKHOUSE_USERNAME: ""
+      LAGO_CLICKHOUSE_PASSWORD: "password"
+      LAGO_DISABLE_SCHEMA_DUMP: true
+      LAGO_KAFKA_EVENTS_CHARGED_IN_ADVANCE_TOPIC: events_charged_in_advance
+      ANNOTATE_SKIP_ON_DB_MIGRATE: 1
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Install Ruby and gems
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "4.0.2"
+          bundler-cache: true
+      - name: Install pg 14
+        uses: tj-actions/install-postgresql@v3
+        with:
+          postgresql-version: "15"
+      - name: Start Clickhouse database
+        run: |
+          docker run -d --rm -p 8123:8123 -p 9000:9000 --ulimit nofile=262144:262144 -v ./clickhouse-s3:/var/lib/clickhouse-s3 -v ./ci/clickhouse/config.xml:/etc/clickhouse-server/config.d/config.xml -e CLICKHOUSE_PASSWORD=password clickhouse/clickhouse-server:25.12-alpine
+        shell: bash
+      - name: Generate RSA keys
+        run: ./scripts/generate.rsa.sh
+      - run: "pg_dump --version"
+      - name: Move db schema for comparison
+        run: mv db/structure.sql db/structure-before-dump.sql
+      - name: Perform Postgres database migrations
+        run: bin/rails db:migrate:primary
+      - name: dump schema
+        run: LAGO_DISABLE_SCHEMA_DUMP="" bin/rails db:schema:dump:primary
+      - name: Ensure no changes to structure.sql (excluding restrict/unrestrict)
+        run: |
+          grep -v '\\restrict' db/structure.sql | grep -v '\\unrestrict' | grep -v 'Dumped from database version' | grep -v 'Dumped by pg_dump version' | sed '/^[[:space:]]*$/d' > db/structure.sql.filtered
+          grep -v '\\restrict' db/structure-before-dump.sql | grep -v '\\unrestrict' | grep -v 'Dumped from database version' | grep -v 'Dumped by pg_dump version' | sed '/^[[:space:]]*$/d' > db/structure-before-dump.sql.filtered
+          diff db/structure.sql.filtered db/structure-before-dump.sql.filtered
+      - name: Ensure annotations are up to date
+        run: bundle exec annotaterb --frozen
+      - name: Perform Clickhouse database migrations
+        run: bin/rails db:migrate:clickhouse