release: DOS shared billing live, upstream sync 90 commits, SSO worker retirement

.env.example

@@ -369,6 +369,25 @@ MEWE_HOST="https://mewe.com"
 MEWE_APP_ID="sample_mewe_app_id"
 MEWE_API_KEY="sample_mewe_api_key"
 
+# DOS shared billing — Crove sells DOS Plus ($9) / Pro ($19), not Postiz Stripe packages.
+# Keep STRIPE_PUBLISHABLE_KEY set so channel gating stays on. Checkout goes to DOS-Me.
+# DOS_SHARED_BILLING=true
+# DOS_ME_API_URL=https://api.dos.me
+# DOS_ME_INTERNAL_API_KEY=""
+
+# Developer Settings
+NX_ADD_PLUGINS=false
+IS_GENERAL="true" # required for now
+NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME="Authentik"
+NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL="https://raw.githubusercontent.com/walkxcode/dashboard-icons/master/png/authentik.png"
+POSTIZ_GENERIC_OAUTH="false"
+POSTIZ_OAUTH_URL="https://auth.example.com"
+POSTIZ_OAUTH_AUTH_URL="https://auth.example.com/application/o/authorize"
+POSTIZ_OAUTH_TOKEN_URL="https://auth.example.com/application/o/token"
+POSTIZ_OAUTH_USERINFO_URL="https://authentik.example.com/application/o/userinfo"
+POSTIZ_OAUTH_CLIENT_ID=""
+POSTIZ_OAUTH_CLIENT_SECRET=""
+# POSTIZ_OAUTH_SCOPE="openid profile email" # default values
 # --- Farcaster (Neynar API) ---
 NEYNAR_CLIENT_ID="sample_neynar_client_id"
 NEYNAR_SECRET_KEY="sample_neynar_secret_key"

.github/copilot-instructions.md

@@ -11,7 +11,6 @@
 - `apps/backend`: NestJS REST API Gateway, Controllers, OAuth & Webhook endpoints.
 - `apps/frontend`: Next.js 16 (App Router) + React 19 + Tailwind CSS 3 UI.
 - `apps/orchestrator`: Temporal Worker for scheduled posting workflows and background activities.
-- `apps/crove-sso`: Cloudflare Worker SSO bridge (optional edge fallback).
 - `libraries/nestjs-libraries`: Database layer (Prisma), 34+ Social Providers, Email, Notifications, Mastra MCP Server.
 - `libraries/helpers`: Runtime branding engine, Fetch wrappers, Subdomain management, Auth helper utilities.
 - `libraries/react-shared-libraries`: Reusable React components, translations, UI forms.

.github/workflows/build.yml

@@ -78,9 +78,6 @@ jobs:
       - name: Validate Beta deployment script and compose contract
         run: pnpm run validate:beta-deploy
 
-      - name: Test SSO Worker (vitest)
-        run: pnpm run test:sso
-
       # The suites drive the real Prisma client, so the schema must exist in
       # the throwaway database first. --skip-generate because the postinstall
       # hook already generated the client. No --accept-data-loss: this is an

apps/backend/src/api/api.module.ts

@@ -16,6 +16,8 @@ import { IntegrationManager } from '@gitroom/nestjs-libraries/integrations/integ
 import { SettingsController } from '@gitroom/backend/api/routes/settings.controller';
 import { PostsController } from '@gitroom/backend/api/routes/posts.controller';
 import { MediaController } from '@gitroom/backend/api/routes/media.controller';
+import { MediaWidgetController } from '@gitroom/backend/api/routes/media.widget.controller';
+import { UploadWidgetAuthMiddleware } from '@gitroom/backend/services/auth/upload.widget.auth.middleware';
 import { UploadModule } from '@gitroom/nestjs-libraries/upload/upload.module';
 import { BillingController } from '@gitroom/backend/api/routes/billing.controller';
 import { NotificationsController } from '@gitroom/backend/api/routes/notifications.controller';
@@ -51,6 +53,8 @@ import { AppleProvider } from '@gitroom/backend/services/auth/providers/apple.pr
 import { FarcasterProvider } from '@gitroom/backend/services/auth/providers/farcaster.provider';
 import { WalletProvider } from '@gitroom/backend/services/auth/providers/wallet.provider';
 import { OauthProvider } from '@gitroom/backend/services/auth/providers/oauth.provider';
+import { DosMeBillingClient } from '@gitroom/nestjs-libraries/dos-billing/dos-me-billing.client';
+import { DosSharedBillingService } from '@gitroom/nestjs-libraries/dos-billing/dos-shared-billing.service';
 import { StripeController } from '@gitroom/backend/api/routes/stripe.controller';
 
 const authenticatedController = [
@@ -77,7 +81,7 @@ const authenticatedController = [
 @Module({
   imports: [UploadModule, EcosystemModule],
   controllers: process.env.MCP_ONLY
-    ? [RootController, OAuthController]
+    ? [RootController, OAuthController, MediaWidgetController]
     : [
         RootController,
         PaymentController,
@@ -88,6 +92,7 @@ const authenticatedController = [
         EnterpriseController,
         NoAuthIntegrationsController,
         OAuthController,
+        MediaWidgetController,
         ...authenticatedController,
       ],
   providers: [
@@ -99,6 +104,7 @@ const authenticatedController = [
     OpenaiService,
     ExtractContentService,
     AuthMiddleware,
+    UploadWidgetAuthMiddleware,
     PoliciesGuard,
     PermissionsService,
     CodesService,
@@ -112,6 +118,8 @@ const authenticatedController = [
     FarcasterProvider,
     WalletProvider,
     OauthProvider,
+    DosMeBillingClient,
+    DosSharedBillingService,
   ],
   get exports() {
     return [...this.imports, ...this.providers];
@@ -120,5 +128,6 @@ const authenticatedController = [
 export class ApiModule implements NestModule {
   configure(consumer: MiddlewareConsumer) {
     consumer.apply(AuthMiddleware).forRoutes(...authenticatedController);
+    consumer.apply(UploadWidgetAuthMiddleware).forRoutes(MediaWidgetController);
   }
 }

apps/backend/src/api/routes/auth.controller.ts

@@ -7,7 +7,10 @@ import {
   Query,
   Req,
   Res,
+  UseGuards,
 } from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import { ThrottlerRealIpGuard } from '@gitroom/nestjs-libraries/throttler/throttler.provider';
 import { Response, Request } from 'express';
 
 import { CreateOrgUserDto } from '@gitroom/nestjs-libraries/dtos/auth/create.org.user.dto';
@@ -24,6 +27,7 @@ import { UserAgent } from '@gitroom/nestjs-libraries/user/user.agent';
 import { Provider } from '@prisma/client';
 import { makeId } from '@gitroom/nestjs-libraries/services/make.is';
 import * as Sentry from '@sentry/nestjs';
+import { FarcasterProvider } from '@gitroom/nestjs-libraries/integrations/social/farcaster.provider';
 
 @ApiTags('Auth')
 @Controller('/auth')
@@ -295,6 +299,30 @@ export class AuthController {
     }
   }
 
+  // public and creates a signer at Neynar per call, so cap it per client
+  @UseGuards(ThrottlerRealIpGuard)
+  @Throttle({ default: { limit: 30, ttl: 3600000 } })
+  @Post('/farcaster/signer')
+  async farcasterSigner() {
+    try {
+      return await new FarcasterProvider().createSigner();
+    } catch (err: any) {
+      return { error: err.message || 'Failed to create signer' };
+    }
+  }
+
+  // the modal polls every 2s for up to 10 minutes, so leave room for that
+  @UseGuards(ThrottlerRealIpGuard)
+  @Throttle({ default: { limit: 1000, ttl: 3600000 } })
+  @Get('/farcaster/signer')
+  async farcasterSignerStatus(@Query('signerUuid') signerUuid: string) {
+    try {
+      return await new FarcasterProvider().signerStatus(signerUuid);
+    } catch (err: any) {
+      return { error: err.message || 'Failed to check signer' };
+    }
+  }
+
   @Post('/oauth/:provider/redirect')
   oauthRedirect(
     @Param('provider') provider: string,

apps/backend/src/api/routes/billing.controller.ts

@@ -18,6 +18,7 @@ import { NotificationService } from '@gitroom/nestjs-libraries/database/prisma/n
 import { Request } from 'express';
 import { AuthService } from '@gitroom/helpers/auth/auth.service';
 import { UsersService } from '@gitroom/nestjs-libraries/database/prisma/users/users.service';
+import { DosSharedBillingService } from '@gitroom/nestjs-libraries/dos-billing/dos-shared-billing.service';
 import { PaymentService } from '@gitroom/nestjs-libraries/services/payment/payment.service';
 import { BillingSyncDto } from '@gitroom/nestjs-libraries/dtos/billing/billing.sync.dto';
 
@@ -28,6 +29,7 @@ export class BillingController {
     private _subscriptionService: SubscriptionService,
     private _notificationService: NotificationService,
     private _usersService: UsersService,
+    private _dosBilling: DosSharedBillingService,
     private _paymentService: PaymentService
   ) {}
 
@@ -98,6 +100,10 @@ export class BillingController {
       return { blocked: true };
     }
 
+    if (this._dosBilling.enabled()) {
+      return this.subscribeThroughDos(user, body.billing);
+    }
+
     const uniqueId = req?.cookies?.track;
     return (await this.provider(org)).embedded(
       uniqueId,
@@ -119,6 +125,10 @@ export class BillingController {
       return { blocked: true };
     }
 
+    if (this._dosBilling.enabled()) {
+      return this.subscribeThroughDos(user, body.billing);
+    }
+
     const uniqueId = req?.cookies?.track;
     return (await this.provider(org)).subscribe(
       uniqueId,
@@ -151,15 +161,34 @@ export class BillingController {
   }
 
   @Get('/portal')
-  async modifyPayment(@GetOrgFromRequest() org: Organization) {
+  async modifyPayment(
+    @GetOrgFromRequest() org: Organization,
+    @GetUserFromRequest() user: User
+  ) {
+    if (this._dosBilling.enabled()) {
+      const { url } = await this._dosBilling.portal(
+        user,
+        process.env.FRONTEND_URL || 'https://post.crove.com'
+      );
+      return { portal: url };
+    }
     const { url } = await (await this.provider(org)).portalLink(org.id);
     return {
       portal: url,
     };
   }
 
   @Get('/')
-  getCurrentBilling(@GetOrgFromRequest() org: Organization) {
+  async getCurrentBilling(
+    @GetOrgFromRequest() org: Organization,
+    @GetUserFromRequest() user: User
+  ) {
+    if (this._dosBilling.enabled() && user && !user.isSuperAdmin) {
+      try {
+        await this._dosBilling.syncOrg(user, org.id);
+      } catch {}
+      return this._subscriptionService.getSubscriptionByOrganizationId(org.id);
+    }
     return this._paymentService.getSubscription(org.id);
   }
 
@@ -176,17 +205,49 @@ export class BillingController {
       user.email
     );
 
+    if (this._dosBilling.enabled()) {
+      await this._dosBilling.cancel(user);
+      try {
+        await this._dosBilling.syncOrg(user, org.id);
+      } catch {}
+      const sub =
+        await this._subscriptionService.getSubscriptionByOrganizationId(org.id);
+      return { cancel_at: sub?.cancelAt || null };
+    }
+
     return (await this.provider(org)).setToCancel(org.id);
   }
 
   @Post('/prorate')
   async prorate(
     @GetOrgFromRequest() org: Organization,
+    @GetUserFromRequest() user: User,
     @Body() body: BillingSubscribeDto
   ) {
+    if (this._dosBilling.enabled()) {
+      return { price: body.billing === 'PRO' ? 19 : 9 };
+    }
     return (await this.provider(org)).prorate(org.id, body);
   }
 
+  private async subscribeThroughDos(user: User, billing: string) {
+    const result = await this._dosBilling.checkout(
+      user,
+      billing,
+      process.env.FRONTEND_URL || 'https://post.crove.com'
+    );
+    if ('updated' in result && result.updated) {
+      return {};
+    }
+    if ('url' in result && result.url) {
+      return { url: result.url };
+    }
+    if ('portal_url' in result && result.portal_url) {
+      return { portal: result.portal_url };
+    }
+    return result;
+  }
+
   @Get('/charges')
   async getCharges(
     @GetUserFromRequest() user: User,