alist-serve-resource/n8n/W5-purchase-check.json

{
  "name": "W5 - Footer Purchase Check (Public)",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "GET",
        "path": "dk-purchase-check",
        "responseMode": "lastNode",
        "options": {
          "responseCode": 200,
          "responseHeaders": {
            "entries": [
              {
                "name": "Access-Control-Allow-Origin",
                "value": "https://drive.digikedai.com"
              },
              {
                "name": "Content-Type",
                "value": "application/json"
              }
            ]
          }
        }
      },
      "id": "trigger-webhook",
      "name": "Footer Purchase Check (Webhook)",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        0,
        0
      ],
      "webhookId": "dk-purchase-check"
    },
    {
      "parameters": {
        "jsCode": "// ============================================================================\n// W5 runtime body — footer purchase/expiry lookup (PUBLIC, READ-ONLY).\n// Trigger: GET webhook /dk-purchase-check?u=<username>\n// Returns:  { username, known, purchases: [{product, expires_at, display_state, paths:[...]}] }\n//\n// v30 (2026-08-28): adds `paths` per purchase — each product's resources' alist_path\n//   (via Products→Resources mm link NOCODB_LINK_PROD_RESOURCES), so the footer modal\n//   can show a collapsible resource-path list. Products with no linked resources\n//   return paths: [].\n//\n// Security model (no HMAC — key would ship to the client, so it is theatre):\n//   - CORS: response header Access-Control-Allow-Origin: https://drive.digikedai.com\n//     → only the AList portal origin may READ the response from a browser.\n//   - Minimal data: product name + expiry + display_state + public folder paths only\n//     (no internal NocoDB Ids, no customer PII).\n//   - Server-side enumeration is mitigated by a Cloudflare WAF rate-limit +\n//     Origin/Referer rule (see delivery guide).\n//   - No AList auth requests of any kind (username comes from the caller's own\n//     JWT, decoded client-side in the footer) → no empty-client device drift.\n// ============================================================================\n\n// n8n Code node context (same pattern as W1–W4).\nconst ctx = { $env, helpers: this.helpers };\n\n// GET webhook: n8n puts query-string params under $json.query (fallback: body).\nconst item = $json ?? ($input && $input.item ? $input.item.json : {});\nconst q = item.query ?? item.body ?? {};\nconst username = String(q.u ?? '').trim();\n\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\nasync function ncGet(path) {\n  return await ctx.helpers.httpRequest({\n    method: 'GET',\n    url: ctx.$env.NOCODB_URL + path,\n    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n    json: true,\n  });\n}\n\nconst empty = () => ({ username, known: false, purchases: [] });\n\nif (!username) return { json: empty() };\n\ntry {\n  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n  const T_CP = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n  const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n  const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n  const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n  const today = new Date().toISOString().slice(0, 10);\n\n  // 1. resolve username -> customer (username is unique in Customers)\n  const custRows = (await ncGet(\n    `/api/v2/tables/${T_CUST}/records?where=(username,eq,${encodeURIComponent(username)})&limit=1`\n  )).list || [];\n  const customer = custRows[0];\n  if (!customer) return { json: empty() };\n\n  // 2. this customer's products (link query by Id, per NocoDB v2 gotchas)\n  const cps = (await ncGet(\n    `/api/v2/tables/${T_CP}/records?where=(customer.Id,eq,${customer.Id})&limit=500`\n  )).list || [];\n\n  // 3. resolve paths per product (Products→Resources mm link → alist_path).\n  //    Fetch all Resources once, index Id → alist_path (link API only returns\n  //    {Id, name}, not alist_path — see effective-grants.js pattern).\n  const allRes = (await ncGet(\n    `/api/v2/tables/${T_RES}/records?limit=10000&fields=Id,alist_path`\n  )).list || [];\n  const resPath = {};\n  allRes.forEach((r) => { resPath[r.Id] = r.alist_path; });\n\n  const prodIds = [...new Set(cps.map((c) => linkId(c.product)).filter(Boolean))];\n\n  const pathsByProduct = {}; // pid -> [alist_path, ...]\n  for (const pid of prodIds) {\n    let paths = [];\n    try {\n      const res = (await ncGet(\n        `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`\n      )).list || [];\n      paths = res.map((r) => resPath[r.Id]).filter((p) => p != null && String(p).length > 0);\n    } catch (e) {\n      paths = []; // graceful: no paths rather than failing the whole lookup\n    }\n    pathsByProduct[pid] = paths.sort();\n  }\n\n  const purchases = cps\n    .map((c) => {\n      const productObj = (typeof c.product === 'object' && c.product) ? c.product : null;\n      const name = productObj && productObj.name ? String(productObj.name) : 'Product';\n      const pid = linkId(c.product);\n      const expires = c.expires_at ? String(c.expires_at).slice(0, 10) : null;\n      let state = (c.status && c.status !== 'active') ? c.status : 'active';\n      if (state === 'active' && expires && expires <= today) state = 'expired';\n      const paths = pid ? (pathsByProduct[pid] || []) : [];\n      return { product: name, expires_at: expires, display_state: state, paths };\n    })\n    .sort((a, b) => {\n      const rank = { active: 0, suspended: 1, revoked: 2, expired: 3 };\n      if (rank[a.display_state] !== rank[b.display_state]) return rank[a.display_state] - rank[b.display_state];\n      return String(a.expires_at || '').localeCompare(String(b.expires_at || ''));\n    });\n\n  return { json: { username, known: true, purchases } };\n} catch (err) {\n  // graceful: footer renders static rows only on any error\n  return { json: { ...empty(), error: String((err && err.message) || err) } };\n}\n"
      },
      "id": "lookup",
      "name": "Lookup Purchases",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        220,
        0
      ]
    }
  ],
  "connections": {
    "Footer Purchase Check (Webhook)": {
      "main": [
        [
          {
            "node": "Lookup Purchases",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1"
  },
  "pinData": {}
}