Initial working state: CL3.5 complete (Plesk sync + suspend/unsuspend)

app/api/plesk/instances/[id]/sync/route.ts

@@ -0,0 +1,52 @@
+import { NextResponse } from "next/server";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { syncPleskInstance } from "@/lib/plesk/sync";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-sync:${context.userId}`, 8, 60_000);
+
+    const supabase = createSupabaseRouteClient() as any;
+
+    const { data: instance, error: instanceError } = await supabase
+      .from("plesk_instances")
+      .select(
+        "id, agency_id, base_url, auth_type, encrypted_secret, last_connected_at",
+      )
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (instanceError || !instance) throw new Error("Plesk instance not found");
+
+    const result = await syncPleskInstance(
+      supabase,
+      instance,
+      context.userId,
+      "sync",
+    );
+
+    return NextResponse.json({
+      subscriptionsUpserted: result.subscriptionsUpserted,
+      domainsUpserted: result.domainsUpserted,
+      skipped: result.skipped,
+      reason: result.reason,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Sync failed" },
+      { status: 400 },
+    );
+  }
+}

app/api/plesk/instances/[id]/test/route.ts

@@ -0,0 +1,85 @@
+import { NextResponse } from "next/server";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { testPleskConnection } from "@/lib/plesk/client";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-test:${context.userId}`, 20, 60_000);
+
+    const supabase = createSupabaseRouteClient() as any;
+    const { data: instance, error: loadError } = await supabase
+      .from("plesk_instances")
+      .select("id, agency_id, base_url, auth_type, encrypted_secret")
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (loadError || !instance) {
+      throw new Error("Plesk instance not found");
+    }
+
+    let status: "connected" | "error" = "connected";
+    let errorMessage: string | null = null;
+
+    try {
+      await testPleskConnection({
+        baseUrl: instance.base_url,
+        authType: instance.auth_type,
+        encryptedSecret: instance.encrypted_secret,
+      });
+    } catch (error) {
+      status = "error";
+      errorMessage =
+        error instanceof Error
+          ? error.message.slice(0, 1000)
+          : "Connection test failed";
+    }
+
+    const { data: updated } = await supabase
+      .from("plesk_instances")
+      .update({
+        status,
+        error_message: errorMessage,
+        last_connected_at:
+          status === "connected" ? new Date().toISOString() : null,
+      })
+      .eq("id", instance.id)
+      .eq("agency_id", context.agencyId)
+      .select(
+        "id, name, base_url, auth_type, status, error_message, last_connected_at",
+      )
+      .single();
+
+    await supabase.from("actions_log").insert({
+      agency_id: context.agencyId,
+      actor_user_id: context.userId,
+      target_type: "plesk_instance",
+      target_id: instance.id,
+      action: "test_connection",
+      status: status === "connected" ? "success" : "failed",
+      error_message: errorMessage,
+      metadata: { instance_id: instance.id },
+    });
+
+    return NextResponse.json({ ok: status === "connected", instance: updated });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error ? error.message : "Connection test failed",
+      },
+      { status: 400 },
+    );
+  }
+}

app/api/plesk/instances/route.ts

@@ -0,0 +1,122 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { encryptPleskSecret } from "@/lib/crypto";
+import { testPleskConnection } from "@/lib/plesk/client";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+const createSchema = z.object({
+  name: z.string().min(2),
+  base_url: z.string().url(),
+  auth_type: z.enum(["api_key", "basic"]),
+  api_key: z.string().min(8).optional(),
+  username: z.string().min(1).optional(),
+  password: z.string().min(1).optional(),
+});
+
+export async function POST(req: Request) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-connect:${context.userId}`, 10, 60_000);
+
+    const input = createSchema.parse(await req.json());
+    const payload =
+      input.auth_type === "api_key"
+        ? {
+            ...input,
+            secret: input.api_key,
+          }
+        : {
+            ...input,
+            secret:
+              input.username && input.password
+                ? `${input.username}:${input.password}`
+                : undefined,
+          };
+
+    if (!payload.secret) {
+      throw new Error("Missing credentials for selected auth type");
+    }
+
+    const supabase = createSupabaseRouteClient() as any;
+
+    const { encryptedSecret, secretKid } = encryptPleskSecret(payload.secret);
+
+    try {
+      await testPleskConnection({
+        baseUrl: payload.base_url,
+        authType: payload.auth_type,
+        encryptedSecret: encryptedSecret,
+      });
+    } catch (connectError) {
+      const errorMessage =
+        connectError instanceof Error
+          ? connectError.message.slice(0, 1000)
+          : "Connection test failed";
+
+      await supabase.from("actions_log").insert({
+        agency_id: context.agencyId,
+        actor_user_id: context.userId,
+        target_type: "plesk_instance",
+        target_id: null,
+        action: "connect",
+        status: "failed",
+        error_message: errorMessage,
+        metadata: { base_url: payload.base_url, auth_type: payload.auth_type },
+      });
+
+      throw new Error(errorMessage);
+    }
+
+    const { data: instance, error } = await supabase
+      .from("plesk_instances")
+      .insert({
+        agency_id: context.agencyId,
+        name: payload.name,
+        base_url: payload.base_url,
+        auth_type: payload.auth_type,
+        encrypted_secret: encryptedSecret,
+        secret_kid: secretKid,
+        status: "connected",
+        error_message: null,
+        last_connected_at: new Date().toISOString(),
+      })
+      .select(
+        "id, name, base_url, auth_type, status, error_message, last_connected_at",
+      )
+      .single();
+
+    if (error || !instance) {
+      throw new Error(error?.message ?? "Failed to create Plesk instance");
+    }
+
+    await supabase.from("actions_log").insert({
+      agency_id: context.agencyId,
+      actor_user_id: context.userId,
+      target_type: "plesk_instance",
+      target_id: instance.id,
+      action: "connect",
+      status: "success",
+      error_message: null,
+      metadata: { base_url: payload.base_url, auth_type: payload.auth_type },
+    });
+
+    return NextResponse.json({ instance });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Failed to create Plesk instance",
+      },
+      { status: 400 },
+    );
+  }
+}

app/api/plesk/subscriptions/[id]/action/route.ts

@@ -0,0 +1,133 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import {
+  suspendPleskSubscription,
+  unsuspendPleskSubscription,
+} from "@/lib/plesk/client";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+const actionSchema = z.object({
+  action: z.enum(["suspend", "unsuspend"]),
+});
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  let requestedAction: "suspend" | "unsuspend" | null = null;
+  const supabase = createSupabaseRouteClient() as any;
+  let context: Awaited<ReturnType<typeof getRouteAgencyContextOrThrow>> | null =
+    null;
+  let subscription: {
+    id: string;
+    plesk_subscription_id: string;
+    plesk_instance_id: string;
+  } | null = null;
+
+  try {
+    assertSameOrigin(req);
+
+    context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-subscription-action:${context.userId}`, 20, 60_000);
+
+    const payload = actionSchema.parse(await req.json());
+    requestedAction = payload.action;
+
+    const { data, error } = await supabase
+      .from("plesk_subscriptions")
+      .select("id, plesk_subscription_id, plesk_instance_id")
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    subscription = data;
+
+    if (error || !subscription) {
+      throw new Error("Subscription not found");
+    }
+
+    const { data: instance, error: instanceError } = await supabase
+      .from("plesk_instances")
+      .select("id, base_url, auth_type, encrypted_secret")
+      .eq("id", subscription.plesk_instance_id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (instanceError || !instance) {
+      throw new Error("Plesk instance not found");
+    }
+
+    const connection = {
+      baseUrl: instance.base_url,
+      authType: instance.auth_type,
+      encryptedSecret: instance.encrypted_secret,
+    } as const;
+
+    if (payload.action === "suspend") {
+      await suspendPleskSubscription(
+        connection,
+        subscription.plesk_subscription_id,
+      );
+    } else {
+      await unsuspendPleskSubscription(
+        connection,
+        subscription.plesk_subscription_id,
+      );
+    }
+
+    const newStatus = payload.action === "suspend" ? "suspended" : "active";
+    const { error: updateError } = await supabase
+      .from("plesk_subscriptions")
+      .update({ status: newStatus })
+      .eq("id", subscription.id);
+
+    await supabase.from("actions_log").insert({
+      agency_id: context.agencyId,
+      actor_user_id: context.userId,
+      target_type: "plesk_subscription",
+      target_id: subscription.id,
+      action: payload.action,
+      status: "success",
+      metadata: {
+        plesk_subscription_id: subscription.plesk_subscription_id,
+        db_status_update_error: updateError?.message ?? null,
+      },
+    });
+
+    return NextResponse.json({
+      ok: true,
+      status: newStatus,
+      dbStatusUpdated: !updateError,
+    });
+  } catch (error) {
+    if (supabase && context && subscription) {
+      const message =
+        error instanceof Error ? error.message : "Subscription action failed";
+      await supabase.from("actions_log").insert({
+        agency_id: context.agencyId,
+        actor_user_id: context.userId,
+        target_type: "plesk_subscription",
+        target_id: subscription.id,
+        action: requestedAction ?? "subscription_action",
+        status: "failed",
+        error_message: message,
+        metadata: {
+          plesk_subscription_id: subscription.plesk_subscription_id,
+        },
+      });
+    }
+
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error ? error.message : "Subscription action failed",
+      },
+      { status: 400 },
+    );
+  }
+}

app/api/plesk/sync/route.ts

@@ -0,0 +1,60 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { syncPleskInstance } from "@/lib/plesk/sync";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+const syncSchema = z.object({
+  instanceId: z.string().uuid(),
+});
+
+export async function POST(req: Request) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-sync:${context.userId}`, 8, 60_000);
+
+    const payload = syncSchema.parse(await req.json());
+    const supabase = createSupabaseRouteClient() as any;
+
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+    console.log("SYNC USER:", user?.id, user?.email);
+
+    const { data: instance, error: instanceError } = await supabase
+      .from("plesk_instances")
+      .select(
+        "id, agency_id, base_url, auth_type, encrypted_secret, last_connected_at",
+      )
+      .eq("id", payload.instanceId)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (instanceError || !instance) throw new Error("Plesk instance not found");
+
+    const result = await syncPleskInstance(
+      supabase,
+      instance,
+      context.userId,
+      "sync",
+    );
+
+    return NextResponse.json({
+      subscriptionsUpserted: result.subscriptionsUpserted,
+      domainsUpserted: result.domainsUpserted,
+      skipped: result.skipped,
+      reason: result.reason,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Sync failed" },
+      { status: 400 },
+    );
+  }
+}