Chasa

docstoc

Paste your unpaid invoices. Get the follow-up email already written, in the right tone for how late it is.

docstoc never emails your clients for you — it drafts follow-ups you copy into Gmail, Outlook, or Apple Mail. Tone escalates with days overdue (friendly → firm → direct).

Live URLs

Worker PUBLIC_APP_URL is https://docstoc.io (magic links, OAuth callbacks, Stripe return URLs, digest links).

Legacy chasa.io / api.chasa.io 301 to docstoc (Pages _middleware.ts + worker redirect). See scripts/oauth-redirect-uris.md for provider console URIs.

Go-live checklist

1. Attach docstoc.io on Cloudflare Pages project chasa and wait for Active.
2. www.docstoc.io → apex: handled by apps/web/functions/_middleware.ts (redeploy web).
3. chasa.io / www.chasa.io → docstoc.io: same middleware.
4. api.chasa.io → api.docstoc.io: worker middleware in apps/worker/src/lib/legacyHostRedirect.ts.
5. Register OAuth redirect URIs on api.docstoc.io — see scripts/oauth-redirect-uris.md.
6. Optional DMARC: ./scripts/dmarc-remove-rua.sh (removes rua= from _dmarc.docstoc.io).
7. Run ./scripts/go-live-verify.sh.

The order does not matter: browser-facing links are built from the origin the request came in on (see “App origin resolution” below), so pages.dev and chasa.io both keep working whichever is deployed first.

App origin resolution

Magic links, post-login redirects, Stripe return URLs and team invites use the origin the user is actually on, not PUBLIC_APP_URL. The Pages /api proxy forwards it as X-Docstoc-App-Origin, and the worker honours it only if it matches lib/appUrl.ts's allowlist (PUBLIC_APP_URL, docstoc.io, www.docstoc.io, legacy chasa.io hosts, *.pages.dev project/preview hosts, localhost). This keeps preview deploys self-contained and makes the domain cutover zero-downtime.

Requests that arrive without a trusted origin — provider OAuth callbacks hitting api.docstoc.io directly, and the digest cron — still fall back to PUBLIC_APP_URL.

---

Product specs

Plans & pricing

Stripe price IDs live in apps/worker/wrangler.toml as STRIPE_PRICE_SOLO (maps to Pro), STRIPE_PRICE_PRO / STRIPE_PRICE_ENTERPRISE (map to Business; non-secret). Billing portal and webhooks update accounts.plan and is_paid.

Feature matrix (by plan)

Workspace roles: owner is always admin. Invited members can use Pro+ features; admin-only actions: branding, webhooks, connector OAuth connect/import, API key CRUD, team invites.

App routes (/app/*)

All app routes except /login and /admin require a session. Unauthenticated users redirect to /login. SPA analytics require cookie consent (GDPR).

i18n (EN + ES)

Same path as Docracy: lightweight catalogs in apps/web/app/src/lib/i18n/ (no i18next). LocaleProvider + EN|ES switcher on login, sidebar, and More sheet. P1 covers login / shell / welcome; expand catalogs for the rest of the app next. Preference stored as chasa_locale. Marketing HTML stays English until a later pass.

Marketing & SEO (static HTML in apps/web/public/)

• Homepage with pricing, FAQ JSON-LD, competitor comparison
• SEO landing pages: /invoice-follow-up, /payment-reminder, /overdue-invoice, /chase-invoices, /freelancer-invoice-follow-up
• /features/ (index, AI tone, templates), /docs/, /ai, /about
• /blog/ (3 articles + dynamic post.html)
• /free-templates/ — 15 generated template pages + index
• Legal: /privacy, /terms, /imprint
• sitemap.xml, robots.txt, 404.html, cookie consent, scroll-depth analytics
• Self-hosted fonts (no Google Fonts); enforcing CSP via _headers

Regenerate free templates after editing apps/web/scripts/generate-free-templates.mjs:

npm run generate:templates --workspace apps/web

---

Architecture

Monorepo (npm workspaces):

apps/web/

app/ React SPA (/app/*) — lazy-loaded routes, AccountProvider src/pages/tool/ Tool module (components, CSV import, aging sync) src/pages/connector/ Connector module (OAuth, API keys) public/ Static marketing site + fonts + _headers scripts/ copy-fonts, generate-free-templates, validate-static-html

apps/worker/ src/routes/ HTTP handlers (auth, billing, emails, aging, mcp, …) src/lib/ auth, ai, billing, schemas (Zod), rate limits, webhooks migrations/ D1 SQL (0001–0011)

Data: Cloudflare D1 (chasa-db). OAuth tokens encrypted at rest (AES-GCM, TOKEN_SECRET). Sessions in sessions table; magic links single-use (atomic consume).

AI: Cloudflare Workers AI (@cf/meta/llama-3.1-8b-instruct-fp8). Prompts wrap user content in delimiters to reduce injection.

API surface (worker)

---

Security & compliance (implemented)

• Free-tier quota: 5 AI drafts/month enforced in D1 (ai_usage), not client-side
• Rate limits: AI drafts, MCP, analytics, admin login (D1 buckets)
• Turnstile: fail-closed in production HTTPS when secret is set; 60s magic-link cooldown per email
• HKDF token purposes: separate keys for session, magic-link, API key, admin, invite, OAuth state, webhook signing (legacy hash fallback on lookup)
• Session rotation: prior sessions invalidated on magic-link login; admin sessions cleared on admin login
• Session cleanup: daily cron purges expired sessions, magic links, rate-limit buckets
• RBAC: workspace admin for branding, webhooks, connector OAuth, API keys, team invites
• Input validation: Zod schemas on all JSON API routes (auth, emails, clients, team, webhooks, billing, admin, MCP draft args)
• Stripe webhooks: event-id deduplication (stripe_events)
• Outbound webhooks: X-Chasa-Signature: sha256=… HMAC
• Click tracking: redirects only to URLs stored when the tracked email was created
• Webhook URLs: SSRF checks (no localhost / private IPs)
• OAuth state: timing-safe HMAC compare
• CSP: enforcing policy on Pages with a nonce per page instead of 'unsafe-inline' (apps/web/functions/lib/csp.ts, applied in functions/_middleware.ts); report-uri → /api/csp-report. The API worker sends the same header set (apps/worker/src/lib/securityHeaders.ts).
• GDPR: cookie consent gates SPA analytics; no visitor IDs on page views (aggregate only)
• Secrets: never committed — wrangler secret put …

---

Local development

npm install

npm run dev:worker # wrangler dev --local, http://127.0.0.1:8787 npm run dev:web # vite, http://localhost:5173 (proxies /api to worker)

Without RESEND_API_KEY, magic links log to the worker console — copy the URL into your browser.

Quality checks

npm run lint          # ESLint (web app + worker)

npm run test # Vitest (schemas, crypto, dates) npm run typecheck # tsc worker + vite build web

CI (.github/workflows/ci.yml) runs lint → test → static HTML validation → typecheck on every PR; auto-deploys worker + web on push to `main` when CLOUDFLARE_API_TOKEN is set.

Deploy manually

npm run deploy:worker

npm run deploy:web # builds (copies fonts) then pages deploy, pings IndexNow, submits the sitemap to Google

The Google step (apps/web/scripts/gsc-sitemap.mjs) needs the service account key at ~/.config/docstoc/gsc-service-account.json (never in the repo) and the service account as a Full user of the docstoc.io Search Console property. Without the key it prints a note and exits 0.

After schema changes:

cd apps/worker

wrangler d1 migrations apply chasa-db --local # dev wrangler d1 migrations apply chasa-db --remote # p