Implement premium features and GDPR compliance in bot and WebUI

- Added new models for premium tier configurations and assignments, enabling feature limits for free and premium users.
- Introduced GDPR deletion logging and commands for user data management.
- Enhanced logging configuration with retention days for audit logs.
- Updated bot commands and job processing to include new premium and GDPR functionalities.
- Improved localization with new keys for premium features and GDPR commands in both English and German.
- Added UI components for managing premium settings and logging retention in the WebUI.

apps/webui/src/app/api/guilds/[guildId]/feeds/route.ts

@@ -2,7 +2,7 @@ import { SocialFeedDashboardCreateSchema } from '@nexumi/shared';
 import { type NextRequest, NextResponse } from 'next/server';
 import { requireGuildAccess, toApiErrorResponse } from '@/lib/auth';
 import { writeDashboardAudit } from '@/lib/audit';
-import { createFeed, listFeeds } from '@/lib/module-configs/feeds';
+import { createFeed, FeedPremiumError, listFeeds } from '@/lib/module-configs/feeds';
 import { prisma } from '@/lib/prisma';
 
 interface RouteParams {
@@ -39,6 +39,9 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
 
     return NextResponse.json(feed, { status: 201 });
   } catch (error) {
+    if (error instanceof FeedPremiumError) {
+      return NextResponse.json({ error: error.code }, { status: 403 });
+    }
     return toApiErrorResponse(error);
   }
 }

apps/webui/src/app/api/guilds/[guildId]/guildbackup/route.ts

@@ -2,7 +2,7 @@ import { GuildBackupCreateDashboardSchema } from '@nexumi/shared';
 import { type NextRequest, NextResponse } from 'next/server';
 import { requireGuildAccess, toApiErrorResponse } from '@/lib/auth';
 import { writeDashboardAudit } from '@/lib/audit';
-import { createGuildBackupDashboard, listGuildBackupsDashboard } from '@/lib/module-configs/guildbackup';
+import { createGuildBackupDashboard, BackupPremiumError, listGuildBackupsDashboard } from '@/lib/module-configs/guildbackup';
 import { prisma } from '@/lib/prisma';
 
 interface RouteParams {
@@ -39,6 +39,9 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
 
     return NextResponse.json(backup, { status: 201 });
   } catch (error) {
+    if (error instanceof BackupPremiumError) {
+      return NextResponse.json({ error: error.code }, { status: 403 });
+    }
     return toApiErrorResponse(error);
   }
 }

apps/webui/src/app/api/guilds/[guildId]/tags/route.ts

@@ -2,7 +2,7 @@ import { TagDashboardCreateSchema } from '@nexumi/shared';
 import { type NextRequest, NextResponse } from 'next/server';
 import { requireGuildAccess, toApiErrorResponse } from '@/lib/auth';
 import { writeDashboardAudit } from '@/lib/audit';
-import { createTag, listTags, TagConflictError } from '@/lib/module-configs/tags';
+import { createTag, listTags, TagConflictError, TagPremiumError } from '@/lib/module-configs/tags';
 import { prisma } from '@/lib/prisma';
 
 interface RouteParams {
@@ -42,6 +42,9 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
     if (error instanceof TagConflictError) {
       return NextResponse.json({ error: error.message }, { status: 409 });
     }
+    if (error instanceof TagPremiumError) {
+      return NextResponse.json({ error: error.code }, { status: 403 });
+    }
     return toApiErrorResponse(error);
   }
 }

apps/webui/src/app/api/owner/premium/route.ts

@@ -0,0 +1,185 @@
+import { NextResponse } from 'next/server';
+import {
+  GuildPremiumAssignSchema,
+  PremiumTierConfigPatchSchema,
+  PremiumTierSchema,
+  UserPremiumAssignSchema
+} from '@nexumi/shared';
+import { toApiErrorResponse } from '@/lib/auth';
+import { writeOwnerAudit } from '@/lib/owner-audit';
+import { requireOwner } from '@/lib/owner-auth';
+import { ensurePremiumTierConfigs } from '@/lib/premium';
+import { prisma } from '@/lib/prisma';
+
+export async function GET() {
+  try {
+    await requireOwner('VIEWER');
+    const [tiers, guilds, users] = await Promise.all([
+      ensurePremiumTierConfigs(prisma),
+      prisma.guildPremiumAssignment.findMany({ orderBy: { updatedAt: 'desc' } }),
+      prisma.userPremiumAssignment.findMany({ orderBy: { updatedAt: 'desc' } })
+    ]);
+    return NextResponse.json({
+      tiers,
+      guilds: guilds.map((row) => ({
+        ...row,
+        expiresAt: row.expiresAt?.toISOString() ?? null,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString()
+      })),
+      users: users.map((row) => ({
+        ...row,
+        expiresAt: row.expiresAt?.toISOString() ?? null,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString()
+      }))
+    });
+  } catch (error) {
+    return toApiErrorResponse(error);
+  }
+}
+
+export async function PATCH(request: Request) {
+  try {
+    const session = await requireOwner('ADMIN');
+    const body = await request.json();
+    const tier = PremiumTierSchema.parse(body.tier);
+    const patch = PremiumTierConfigPatchSchema.parse(body);
+    await ensurePremiumTierConfigs(prisma);
+    const before = await prisma.premiumTierConfig.findUniqueOrThrow({ where: { tier } });
+    const after = await prisma.premiumTierConfig.update({
+      where: { tier },
+      data: {
+        ...(patch.maxTags !== undefined ? { maxTags: patch.maxTags } : {}),
+        ...(patch.maxFeeds !== undefined ? { maxFeeds: patch.maxFeeds } : {}),
+        ...(patch.maxBackups !== undefined ? { maxBackups: patch.maxBackups } : {}),
+        ...(patch.features !== undefined ? { features: patch.features } : {})
+      }
+    });
+    await writeOwnerAudit(prisma, {
+      actorUserId: session.user.id,
+      action: 'premium.tier.update',
+      targetType: 'PremiumTierConfig',
+      targetId: tier,
+      before,
+      after
+    });
+    return NextResponse.json(after);
+  } catch (error) {
+    return toApiErrorResponse(error);
+  }
+}
+
+export async function PUT(request: Request) {
+  try {
+    const session = await requireOwner('ADMIN');
+    const body = await request.json();
+    const kind = body.kind === 'user' ? 'user' : 'guild';
+
+    if (kind === 'user') {
+      const input = UserPremiumAssignSchema.parse(body);
+      const before = await prisma.userPremiumAssignment.findUnique({ where: { userId: input.userId } });
+      const after = await prisma.userPremiumAssignment.upsert({
+        where: { userId: input.userId },
+        create: {
+          userId: input.userId,
+          tier: input.tier,
+          note: input.note ?? null,
+          assignedById: session.user.id,
+          expiresAt: input.expiresAt ? new Date(input.expiresAt) : null
+        },
+        update: {
+          tier: input.tier,
+          note: input.note ?? null,
+          assignedById: session.user.id,
+          expiresAt: input.expiresAt ? new Date(input.expiresAt) : null
+        }
+      });
+      await writeOwnerAudit(prisma, {
+        actorUserId: session.user.id,
+        action: before ? 'premium.user.update' : 'premium.user.assign',
+        targetType: 'UserPremiumAssignment',
+        targetId: after.userId,
+        before,
+        after
+      });
+      return NextResponse.json(after);
+    }
+
+    const input = GuildPremiumAssignSchema.parse(body);
+    await prisma.guild.upsert({ where: { id: input.guildId }, update: {}, create: { id: input.guildId } });
+    const before = await prisma.guildPremiumAssignment.findUnique({ where: { guildId: input.guildId } });
+    const after = await prisma.guildPremiumAssignment.upsert({
+      where: { guildId: input.guildId },
+      create: {
+        guildId: input.guildId,
+        tier: input.tier,
+        note: input.note ?? null,
+        assignedById: session.user.id,
+        expiresAt: input.expiresAt ? new Date(input.expiresAt) : null
+      },
+      update: {
+        tier: input.tier,
+        note: input.note ?? null,
+        assignedById: session.user.id,
+        expiresAt: input.expiresAt ? new Date(input.expiresAt) : null
+      }
+    });
+    await writeOwnerAudit(prisma, {
+      actorUserId: session.user.id,
+      action: before ? 'premium.guild.update' : 'premium.guild.assign',
+      targetType: 'GuildPremiumAssignment',
+      targetId: after.guildId,
+      before,
+      after
+    });
+    return NextResponse.json(after);
+  } catch (error) {
+    return toApiErrorResponse(error);
+  }
+}
+
+export async function DELETE(request: Request) {
+  try {
+    const session = await requireOwner('ADMIN');
+    const url = new URL(request.url);
+    const guildId = url.searchParams.get('guildId');
+    const userId = url.searchParams.get('userId');
+
+    if (guildId) {
+      const before = await prisma.guildPremiumAssignment.findUnique({ where: { guildId } });
+      if (!before) {
+        return NextResponse.json({ error: 'Not found' }, { status: 404 });
+      }
+      await prisma.guildPremiumAssignment.delete({ where: { guildId } });
+      await writeOwnerAudit(prisma, {
+        actorUserId: session.user.id,
+        action: 'premium.guild.remove',
+        targetType: 'GuildPremiumAssignment',
+        targetId: guildId,
+        before
+      });
+      return NextResponse.json({ ok: true });
+    }
+
+    if (userId) {
+      const before = await prisma.userPremiumAssignment.findUnique({ where: { userId } });
+      if (!before) {
+        return NextResponse.json({ error: 'Not found' }, { status: 404 });
+      }
+      await prisma.userPremiumAssignment.delete({ where: { userId } });
+      await writeOwnerAudit(prisma, {
+        actorUserId: session.user.id,
+        action: 'premium.user.remove',
+        targetType: 'UserPremiumAssignment',
+        targetId: userId,
+        before
+      });
+      return NextResponse.json({ ok: true });
+    }
+
+    return NextResponse.json({ error: 'guildId or userId required' }, { status: 400 });
+  } catch (error) {
+    return toApiErrorResponse(error);
+  }
+}