feat(billing): AWS Marketplace SaaS contract registration, claim linking, and entitlement reconcile

- POST /api/marketplace/aws/register: the listing's fulfillment URL. Resolves the
  registration token with ResolveCustomer, rejects a foreign product, calls
  GetEntitlements for the license on every registration, upserts the license by ARN,
  and 303s to /marketplace/aws with a one-time httpOnly claim cookie when active.
- /marketplace/aws onboarding page: sign in or sign up, review the license, and link
  it to an organization the viewer owns or administers.
- GET /api/marketplace/aws/claim and POST /api/marketplace/aws/claim/link: contracted
  internal routes over application use cases. Linking requires the open claim and org
  admin, re-verifies the entitlement, refuses a license linked elsewhere, consumes the
  claim, audits the link, and emails the enterprise inbox. No subscription changes.
- GET /api/cron/aws-marketplace-reconcile: drains agreement events from SQS in bounded
  batches and re-verifies licenses not checked within a day, under a Redis lock.
- aws_marketplace_license table (migration 0454); AWS_MARKETPLACE_PRODUCT_CODE and
  AWS_MARKETPLACE_EVENTS_QUEUE_URL env vars. With no product code every surface is off.

Author: waleedlatif1

apps/sim/app/api/cron/aws-marketplace-reconcile/route.ts

@@ -0,0 +1,67 @@
+import { createLogger } from '@sim/logger'
+import { generateShortId } from '@sim/utils/id'
+import { type NextRequest, NextResponse } from 'next/server'
+import { verifyCronAuth } from '@/lib/auth/internal'
+import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import { reconcileAwsMarketplaceLicenses } from '@/lib/billing/aws-marketplace/reconcile'
+import { acquireLock, releaseLock } from '@/lib/core/config/redis'
+import { runDetached } from '@/lib/core/utils/background'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('AwsMarketplaceReconcileCron')
+
+const LOCK_KEY = 'aws-marketplace-reconcile-lock'
+/** Covers a full drain plus the re-verification batch; the schedule runs every 15 minutes. */
+const LOCK_TTL_SECONDS = 10 * 60
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Applies AWS Marketplace agreement events from the SQS queue and re-verifies licenses no event
+ * touched within a day. Acknowledges the cron call at once and works in the background; a Redis
+ * lock keeps runs from overlapping, and every write is idempotent, so a replayed run is harmless.
+ * A no-op on deployments without `AWS_MARKETPLACE_PRODUCT_CODE`.
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const authError = verifyCronAuth(request, 'AWS Marketplace reconcile')
+  if (authError) {
+    return authError
+  }
+
+  if (!getAwsMarketplaceProductCode()) {
+    return NextResponse.json({
+      success: true,
+      message: 'AWS Marketplace is not configured – skipped',
+      status: 'skip',
+    })
+  }
+
+  const lockValue = generateShortId()
+  const locked = await acquireLock(LOCK_KEY, lockValue, LOCK_TTL_SECONDS, {
+    reclaimOnFailure: true,
+  })
+  if (!locked) {
+    return NextResponse.json(
+      {
+        success: true,
+        message: 'AWS Marketplace reconcile already in progress – skipped',
+        status: 'skip',
+      },
+      { status: 202 }
+    )
+  }
+
+  runDetached('aws-marketplace-reconcile', async () => {
+    try {
+      const summary = await reconcileAwsMarketplaceLicenses()
+      logger.info('AWS Marketplace reconcile completed', { ...summary })
+    } finally {
+      await releaseLock(LOCK_KEY, lockValue).catch(() => {})
+    }
+  })
+
+  return NextResponse.json(
+    { success: true, message: 'AWS Marketplace reconcile started', status: 'started' },
+    { status: 202 }
+  )
+})

apps/sim/app/api/marketplace/aws/claim/link/route.ts

@@ -0,0 +1,33 @@
+import { linkAwsMarketplaceLicenseContract } from '@/lib/api/contracts/aws-marketplace'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { linkAwsMarketplaceLicense } from '@/lib/billing/aws-marketplace/application/use-cases'
+import {
+  AWS_MARKETPLACE_CLAIM_COOKIE,
+  serializeClaimCookie,
+} from '@/lib/billing/aws-marketplace/claim'
+
+export const POST = defineInternalJsonRoute({
+  contract: linkAwsMarketplaceLicenseContract,
+  operation: linkAwsMarketplaceLicense.operation,
+  useCase: linkAwsMarketplaceLicense,
+  auth: internalSessionAuth,
+  rateLimit: internalRateLimits.user({ bucketName: 'aws-marketplace-link' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+  mapInput: ({ body }, { request }) => ({
+    organizationId: body.organizationId,
+    licenseId: body.licenseId,
+    claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
+  }),
+  present: (_linked, { input }) => ({
+    success: true as const,
+    organizationId: input.organizationId,
+  }),
+  /** The claim is spent once the link commits; the cookie that carried it goes with it. */
+  finalizeResponse: () => ({ headers: { 'set-cookie': serializeClaimCookie(null) } }),
+})

apps/sim/app/api/marketplace/aws/claim/route.ts

@@ -0,0 +1,22 @@
+import { getAwsMarketplaceClaimContract } from '@/lib/api/contracts/aws-marketplace'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { readAwsMarketplaceClaim } from '@/lib/billing/aws-marketplace/application/use-cases'
+import { AWS_MARKETPLACE_CLAIM_COOKIE } from '@/lib/billing/aws-marketplace/claim'
+
+export const GET = defineInternalJsonRoute({
+  contract: getAwsMarketplaceClaimContract,
+  operation: readAwsMarketplaceClaim.operation,
+  useCase: readAwsMarketplaceClaim,
+  auth: internalSessionAuth,
+  rateLimit: internalRateLimits.user({ bucketName: 'aws-marketplace-claim' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+  mapInput: (_parsed, { request }) => ({
+    claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
+  }),
+})

apps/sim/app/api/marketplace/aws/register/route.ts

@@ -0,0 +1,83 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsMarketplaceRegistrationFormSchema } from '@/lib/api/contracts/aws-marketplace'
+import { serializeClaimCookie } from '@/lib/billing/aws-marketplace/claim'
+import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import {
+  AWS_MARKETPLACE_ONBOARDING_PATH,
+  type AwsMarketplaceOnboardingError,
+} from '@/lib/billing/aws-marketplace/onboarding'
+import { registerAwsMarketplaceBuyer } from '@/lib/billing/aws-marketplace/registration'
+import { enforceIpRateLimit, type TokenBucketConfig } from '@/lib/core/rate-limiter'
+import { readFormDataWithLimit } from '@/lib/core/utils/stream-limits'
+import { getBaseUrl } from '@/lib/core/utils/urls'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('AwsMarketplaceRegisterAPI')
+
+/** The form carries one opaque token; anything larger is not from AWS. */
+const MAX_FORM_BYTES = 16 * 1024
+
+const REGISTER_RATE_LIMIT: TokenBucketConfig = {
+  maxTokens: 20,
+  refillRate: 10,
+  refillIntervalMs: 60_000,
+}
+
+function redirectToOnboarding(error?: AwsMarketplaceOnboardingError): NextResponse {
+  const url = new URL(AWS_MARKETPLACE_ONBOARDING_PATH, getBaseUrl())
+  if (error) url.searchParams.set('error', error)
+  return NextResponse.redirect(url, 303)
+}
+
+async function readRegistrationToken(request: NextRequest): Promise<string | null> {
+  const mediaType = request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase()
+  if (mediaType !== 'application/x-www-form-urlencoded') return null
+  let form: FormData
+  try {
+    form = await readFormDataWithLimit(request, {
+      maxBytes: MAX_FORM_BYTES,
+      label: 'AWS Marketplace registration',
+    })
+  } catch {
+    return null
+  }
+  const parsed = awsMarketplaceRegistrationFormSchema.safeParse({
+    'x-amzn-marketplace-token': form.get('x-amzn-marketplace-token'),
+  })
+  return parsed.success ? parsed.data['x-amzn-marketplace-token'] : null
+}
+
+/**
+ * The listing's fulfillment URL. AWS sends the buyer's browser here with a cross-site form POST,
+ * so the request carries no Sim session and is authenticated only by the registration token,
+ * which ResolveCustomer verifies. The response is always a 303 to the onboarding page, carrying
+ * the claim cookie when the license is active. The token is never logged.
+ */
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const productCode = getAwsMarketplaceProductCode()
+  if (!productCode) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+  const rateLimited = await enforceIpRateLimit(
+    'aws-marketplace-register',
+    request,
+    REGISTER_RATE_LIMIT
+  )
+  if (rateLimited) return rateLimited
+
+  const token = await readRegistrationToken(request)
+  if (!token) {
+    logger.warn('AWS Marketplace registration arrived without a usable token')
+    return redirectToOnboarding('invalid')
+  }
+
+  const outcome = await registerAwsMarketplaceBuyer(productCode, token)
+  if (outcome.kind !== 'claimed') return redirectToOnboarding(outcome.kind)
+
+  const response = redirectToOnboarding()
+  response.headers.append('set-cookie', serializeClaimCookie(outcome.claimToken))
+  response.headers.set('Cache-Control', 'no-store')
+  return response
+})