@agilesyndrome/cf-genai-base 5.0.0 → 5.0.2

package/src/cli/users.js

@@ -0,0 +1,34 @@
+import { executeJson, parseJsonRows } from "./d1.js";
+
+function sql(value) { return "'" + String(value).replaceAll("'", "''") + "'"; }
+function query(database, target, command, options) { return parseJsonRows(executeJson(options.wranglerCommand, database, target, command, options)); }
+function csv(value) { return String(value).split(",").map((item) => item.trim()).filter(Boolean); }
+
+export function runUserCommand({ action, username, options }) {
+  const target = options.target || "local";
+  if (!["local", "staging", "production"].includes(target)) throw new Error("User target must be local, staging, or production.");
+  if (action === "list") {
+    const users = query(options.database, target, "SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM auth_users ORDER BY email COLLATE NOCASE;", options);
+    return console.log(JSON.stringify(users.map((user) => ({ ...user, tenants: query(options.database, target, "SELECT t.id,t.name FROM auth_tenants t JOIN auth_user_tenants ut ON ut.tenant_id=t.id WHERE ut.user_id=" + sql(user.id) + " ORDER BY t.name COLLATE NOCASE;", options) })), null, 2));
+  }
+  if (!username) throw new Error("A username, email, subject, or user id is required.");
+  const where = `(id=${sql(username)} OR email=${sql(username)} OR subject=${sql(username)})`;
+  const rows = query(options.database, target, `SELECT id,email,display_name,provider,subject,is_admin,created_at,updated_at FROM auth_users WHERE ${where} LIMIT 1;`, options);
+  if (!rows[0]) throw new Error(`User not found: ${username}`);
+  if (action === "get") {
+    const user = rows[0];
+    const scopes = query(options.database, target, `SELECT scope_name,granted_at FROM auth_user_scopes WHERE user_id=${sql(user.id)} ORDER BY scope_name;`, options);
+    const groups = query(options.database, target, `SELECT group_name,granted_at FROM auth_user_groups WHERE user_id=${sql(user.id)} ORDER BY group_name;`, options);
+    const tenants = query(options.database, target, `SELECT t.id,t.name,ut.joined_at FROM auth_tenants t JOIN auth_user_tenants ut ON ut.tenant_id=t.id WHERE ut.user_id=${sql(user.id)} ORDER BY t.name COLLATE NOCASE;`, options);
+    return console.log(JSON.stringify({ ...user, scopes, groups, tenants }, null, 2));
+  }
+  if (action !== "update") throw new Error("Unknown user action.");
+  const assignments = [];
+  if (options.roles !== undefined) assignments.push(`is_admin=${csv(options.roles).includes("admin") ? 1 : 0}`);
+  if (!assignments.length && options.scopes === undefined && options.groups === undefined && options.tenants === undefined) throw new Error("user:update requires --roles, --scopes, --groups, or --tenants.");
+  if (assignments.length) query(options.database, target, `UPDATE auth_users SET ${assignments.join(",")},updated_at=CURRENT_TIMESTAMP WHERE id=${sql(rows[0].id)};`, options);
+  if (options.scopes !== undefined) { query(options.database, target, "DELETE FROM auth_user_scopes WHERE user_id=" + sql(rows[0].id) + ";", options); for (const scope of csv(options.scopes)) query(options.database, target, "INSERT OR IGNORE INTO auth_user_scopes (user_id,scope_name,granted_by) VALUES (" + sql(rows[0].id) + "," + sql(scope) + ",'human:cli');", options); }
+  if (options.groups !== undefined) { query(options.database, target, "DELETE FROM auth_user_groups WHERE user_id=" + sql(rows[0].id) + ";", options); for (const group of csv(options.groups)) query(options.database, target, "INSERT OR IGNORE INTO auth_user_groups (user_id,group_name,granted_by) VALUES (" + sql(rows[0].id) + "," + sql(group) + ",'human:cli');", options); }
+  if (options.tenants !== undefined) { const tenants = csv(options.tenants); if (tenants.length) { const available = query(options.database, target, "SELECT id FROM auth_tenants WHERE id IN (" + tenants.map(sql).join(",") + ");", options); const found = new Set(available.map((tenant) => tenant.id)); if (found.size !== tenants.length) throw new Error("One or more tenants do not exist."); } query(options.database, target, "DELETE FROM auth_user_tenants WHERE user_id=" + sql(rows[0].id) + ";", options); for (const tenant of tenants) query(options.database, target, "INSERT OR IGNORE INTO auth_user_tenants (user_id,tenant_id) VALUES (" + sql(rows[0].id) + "," + sql(tenant) + ");", options); }
+  return runUserCommand({ action: "get", username: rows[0].id, options });
+}

package/src/cli/version.js

@@ -0,0 +1,54 @@
+import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+export const PACKAGE_NAME = "@agilesyndrome/cf-genai-base";
+
+export function localVersion() {
+  const packageUrl = new URL("../../package.json", import.meta.url);
+  return JSON.parse(readFileSync(packageUrl, "utf8")).version;
+}
+
+export function latestVersion(packageName = PACKAGE_NAME) {
+  const result = spawnSync("npm", ["view", packageName, "version"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf8",
+  });
+  if (result.error || result.status !== 0) return null;
+  const value = result.stdout.trim();
+  return value || null;
+}
+
+function parsedVersion(value) {
+  const match = String(value).trim().replace(/^v/, "").match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/);
+  if (!match) return null;
+  return {
+    numbers: match.slice(1, 4).map(Number),
+    prerelease: match[4]?.split(".") ?? [],
+  };
+}
+
+export function compareVersions(left, right) {
+  const a = parsedVersion(left);
+  const b = parsedVersion(right);
+  if (!a || !b) return String(left).localeCompare(String(right));
+  for (let index = 0; index < 3; index += 1) {
+    if (a.numbers[index] !== b.numbers[index]) return a.numbers[index] - b.numbers[index];
+  }
+  if (a.prerelease.length === 0 && b.prerelease.length > 0) return 1;
+  if (a.prerelease.length > 0 && b.prerelease.length === 0) return -1;
+  return String(a.prerelease).localeCompare(String(b.prerelease), undefined, { numeric: true });
+}
+
+export function formatVersionOutput({ local, latest, packageName = PACKAGE_NAME }) {
+  const lines = [`${packageName} local: ${local}`, `${packageName} latest: ${latest ?? "unavailable"}`];
+  if (latest && compareVersions(latest, local) > 0) {
+    lines.push("Upgrade available:", `  npm i -g ${packageName}`);
+  }
+  return lines.join("\n");
+}
+
+export function runVersionCommand() {
+  const local = localVersion();
+  const latest = latestVersion();
+  console.log(formatVersionOutput({ local, latest }));
+}

package/src/core/security.js

@@ -13,11 +13,11 @@ export async function readJsonClone(request, maxBytes = 64 * 1024) {
   const declared = Number(request.headers.get("Content-Length"));
   if (Number.isFinite(declared) && declared > maxBytes) return { error: secureJson({ error: "Request body is too large" }, 413) };
   try {
-    const value = await request.clone().json();
+    const value = await readBoundedJson(request, maxBytes);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Object required");
-    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maxBytes) return { error: secureJson({ error: "Request body is too large" }, 413) };
     return { value };
-  } catch {
+  } catch (error) {
+    if (error?.status === 413) return { error: secureJson({ error: "Request body is too large" }, 413) };
     return { error: secureJson({ error: "Invalid JSON object request" }, 400) };
   }
 }
@@ -28,9 +28,8 @@ export async function readJson(request, maxBytes = 64 * 1024) {
   if (Number.isFinite(declared) && declared > maxBytes) throw Object.assign(new Error("Request body is too large"), { status: 413 });
   if (!request.body) throw Object.assign(new Error("Request body required"), { status: 400 });
   try {
-    const value = await request.clone().json();
+    const value = await readBoundedJson(request, maxBytes);
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Object required");
-    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maxBytes) throw Object.assign(new Error("Request body is too large"), { status: 413 });
     return value;
   } catch (error) {
     if (error?.status) throw error;
@@ -38,6 +37,24 @@ export async function readJson(request, maxBytes = 64 * 1024) {
   }
 }
 
+async function readBoundedJson(request, maxBytes) {
+  const reader = request.clone().body?.getReader();
+  if (!reader) throw new Error("Request body required");
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) { void reader.cancel(); throw Object.assign(new Error("Request body is too large"), { status: 413 }); }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
+  return JSON.parse(new TextDecoder().decode(body));
+}
+
 export function secureJson(payload, status = 200, headers = {}) {
   return secureResponse(Response.json(payload, { status, headers: { "Cache-Control": "no-store", ...headers } }));
 }

package/src/runtime/worker.js

@@ -1,4 +1,4 @@
-import { ensureSubscriptionManifest, SubscriptionError } from "../auth/index.js";
+import { ensureScopes, ensureSubscriptionManifest, SubscriptionError } from "../auth/index.js";
 import { auditedD1, createEventHandler, listFeatureHealth, requestActor, requestContext, secureResponse } from "../core/index.js";
 import { jobResponse, liveEventsResponse } from "../api/jobs.js";
 import { createRepositories } from "../repository.js";
@@ -11,21 +11,25 @@ import { adminBoundary } from "../admin/routes.js";
 import { ensureFeatureManifests } from "./features.js";
 import { healthResponse } from "./health.js";
 
+const scopeManifestPromises = new WeakMap();
+
 export function createWorker({ fetch, scheduled, app = { name: "worker" }, auth, authorize, scopes = [], subscriptionManifest = [], scopeRoutes = [], apiRoutes = [], middleware = [], features = [], dataResources = [], repositories = [], publicTenantId = null, health, boot, security = true, eventHubBinding = "EVENT_HUB" }) {
   if (typeof fetch !== "function") throw new TypeError("createWorker requires a fetch handler");
   const application = defineApp(app); const provider = auth || features.find((feature) => typeof feature?.getUser === "function"); const eventHandler = createEventHandler(features, { eventHubBinding });
   const repositoryDefinitions = [...repositories, ...features.flatMap((feature) => Array.isArray(feature?.repositories) ? feature.repositories : [])];
   const registeredDataResources = normalizeDataResources([...dataResources, ...features.flatMap((feature) => Array.isArray(feature?.dataResources) ? feature.dataResources : []), ...repositoryDefinitions.filter((definition) => definition.resourceDefinition).map((definition) => definition.resourceDefinition)]);
   const featureRoutes = features.flatMap((feature) => Array.isArray(feature?.routes) ? [async (request, env, ctx, next, state) => { for (const route of feature.routes) { const matches = typeof route?.match === "function" ? await route.match(request, env, state) : route?.path === new URL(request.url).pathname; if (matches && typeof route.handle === "function") return route.handle({ request, env, ctx, state, next }); } return next(); }] : []);
-  const chain = [(request, env, ctx, next, state) => adminBoundary(request, env, ctx, next, state, { provider, authorize, scopes, scopeRoutes, features }), ...(apiRoutes.length ? [(request, env, ctx, next, state) => dispatchRoutes(request, env, ctx, state, apiRoutes).then((response) => response || next(request))] : []), ...features.flatMap((feature) => feature?.middleware ? [feature.middleware.bind(feature)] : []), ...featureRoutes, ...middleware, ...(auth ? [(request, env, ctx, next) => auth(request, env, ctx, next)] : [])].filter(Boolean);
+  const chain = [(request, env, ctx, next, state) => adminBoundary(request, env, ctx, next, state, { provider, authorize, scopes: [], scopeRoutes, features }), ...(apiRoutes.length ? [(request, env, ctx, next, state) => dispatchRoutes(request, env, ctx, state, apiRoutes).then((response) => response || next(request))] : []), ...features.flatMap((feature) => feature?.middleware ? [feature.middleware.bind(feature)] : []), ...featureRoutes, ...middleware, ...(auth ? [(request, env, ctx, next) => auth(request, env, ctx, next)] : [])].filter(Boolean);
   return {
     async fetch(request, env, ctx) {
       try {
         if (boot) await boot(env, { request, ctx });
         if (subscriptionManifest.length) await ensureSubscriptionManifest(env, subscriptionManifest, { who: "system:update" });
         const url = new URL(request.url); const state = Object.create(null); state.requestId = crypto.randomUUID();
+        if (env?.DB && scopes.length && isAdminPath(url.pathname)) await ensureScopeManifest(env, scopes);
         if (provider?.getUser) state.user = await provider.getUser(request, env).catch(() => null); if (state.user?.authUser) state.authUser = state.user.authUser;
-        state.data = createDataReader(env, { resources: registeredDataResources, context: () => requestDataContext(env, { state, request, publicTenantId }) });
+        let dataContext;
+        state.data = createDataReader(env, { resources: registeredDataResources, context: () => dataContext ||= requestDataContext(env, { state, request, publicTenantId }) });
         const requestEnv = Object.create(env || null);
         Object.assign(requestEnv, { app: application, DB: env?.DB ? auditedD1(env.DB, requestActor(state)) : env?.DB, data: state.data, repositories: createRepositories(requestEnv, repositoryDefinitions), user: state.user || null, authUser: state.authUser || null, userId: state.authUser?.id || null, eventHandler: (event, eventEnv, eventCtx) => eventHandler(event, eventEnv || requestEnv, eventCtx || ctx) });
         requestEnv.requestId = state.requestId; state.context = requestContext({ request, env: requestEnv, ctx, state, data: state.data }); requestEnv.context = state.context; requestEnv.event = state.context.event;
@@ -43,3 +47,12 @@ export function createWorker({ fetch, scheduled, app = { name: "worker" }, auth,
 }
 
 function withRequestId(response, requestId) { const headers = new Headers(response.headers); headers.set("X-Request-ID", String(requestId)); return new Response(response.body, { status: response.status, statusText: response.statusText, headers }); }
+function isAdminPath(pathname) { return pathname === "/admin" || pathname.startsWith("/admin/") || pathname === "/api/admin" || pathname.startsWith("/api/admin/"); }
+function ensureScopeManifest(env, scopes) {
+  let registrations = scopeManifestPromises.get(env.DB);
+  if (!registrations) { registrations = new Map(); scopeManifestPromises.set(env.DB, registrations); }
+  const key = JSON.stringify(scopes);
+  let promise = registrations.get(key);
+  if (!promise) { promise = ensureScopes(env, scopes, { who: "system:update" }); registrations.set(key, promise); promise.catch(() => registrations.delete(key)); }
+  return promise;
+}