@aruvili/api 0.1.0

package/src/middleware/auth.ts

@@ -0,0 +1,109 @@
+import { Context, Next } from 'hono';
+import crypto from 'crypto';
+
+export interface UserSession {
+  email: string;
+  roles: string[];
+  session_id: string; // Unique per-request correlation
+}
+
+/**
+ * Resolves request JWT signature and binds session properties to Hono request context.
+ * In production: validates HMAC-SHA256 signature against JWT_SECRET.
+ * In development: supports mock tokens for testing.
+ */
+export async function authMiddleware(c: Context, next: Next) {
+  const authHeader = c.req.header('Authorization');
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    // If no auth token is provided, assign Guest role session context
+    c.set('user', {
+      email: 'guest@system.local',
+      roles: ['Guest'],
+      session_id: crypto.randomUUID()
+    } as UserSession);
+    await next();
+    return;
+  }
+
+  const token = authHeader.split(' ')[1];
+  
+  if (!token || token.trim() === '') {
+    return c.json({ error: 'Unauthorized: Empty bearer token' }, 401);
+  }
+
+  // Enforce maximum token length to prevent abuse
+  if (token.length > 4096) {
+    return c.json({ error: 'Unauthorized: Token exceeds maximum allowed length' }, 401);
+  }
+
+  try {
+    const parts = token.split('.');
+
+    if (parts.length === 3) {
+      const jwtSecret = process.env.JWT_SECRET;
+      
+      if (jwtSecret) {
+        // Production: Verify HMAC-SHA256 signature
+        const [headerB64, payloadB64, signatureB64] = parts;
+        const signatureInput = `${headerB64}.${payloadB64}`;
+        const expectedSignature = crypto
+          .createHmac('sha256', jwtSecret)
+          .update(signatureInput)
+          .digest('base64url');
+        
+        if (signatureB64 !== expectedSignature) {
+          return c.json({ error: 'Unauthorized: Invalid token signature' }, 401);
+        }
+
+        // Decode and validate payload
+        const payloadJson = Buffer.from(payloadB64.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf-8');
+        const payload = JSON.parse(payloadJson);
+
+        // Check token expiry
+        if (payload.exp && Date.now() / 1000 > payload.exp) {
+          return c.json({ error: 'Unauthorized: Token has expired' }, 401);
+        }
+
+        // Check issued-at is not in the future (clock skew tolerance: 60s)
+        if (payload.iat && payload.iat > Date.now() / 1000 + 60) {
+          return c.json({ error: 'Unauthorized: Token issued in the future' }, 401);
+        }
+
+        c.set('user', {
+          email: payload.email || 'unknown@user.local',
+          roles: Array.isArray(payload.roles) ? payload.roles : ['Guest'],
+          session_id: crypto.randomUUID()
+        } as UserSession);
+      } else {
+        // Development fallback: decode without verification (JWT_SECRET not set)
+        console.warn('[AUTH] JWT_SECRET not configured. Running in development mode - tokens are NOT verified.');
+        const payloadB64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const payloadJson = Buffer.from(payloadB64, 'base64').toString('utf-8');
+        const payload = JSON.parse(payloadJson);
+
+        c.set('user', {
+          email: payload.email || 'unknown@user.local',
+          roles: Array.isArray(payload.roles) ? payload.roles : ['Guest'],
+          session_id: crypto.randomUUID()
+        } as UserSession);
+      }
+    } else {
+      // Mock/testing token support (non-JWT format)
+      if (process.env.NODE_ENV === 'production') {
+        return c.json({ error: 'Unauthorized: Invalid token format' }, 401);
+      }
+
+      if (token === 'admin-token') {
+        c.set('user', { email: 'admin@system.local', roles: ['System Manager'], session_id: crypto.randomUUID() } as UserSession);
+      } else if (token === 'user-token') {
+        c.set('user', { email: 'user@system.local', roles: ['Employee'], session_id: crypto.randomUUID() } as UserSession);
+      } else {
+        return c.json({ error: 'Unauthorized: Invalid authentication signature' }, 401);
+      }
+    }
+    await next();
+  } catch (err) {
+    return c.json({ error: 'Unauthorized: Could not resolve session token' }, 401);
+  }
+}

package/src/middleware/body-limit.d.ts

@@ -0,0 +1,9 @@
+import { Context, Next } from 'hono';
+/**
+ * Enforces max request body size to prevent memory exhaustion attacks.
+ */
+export declare function bodyLimitMiddleware(c: Context, next: Next): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+    max_bytes: number;
+}, 413, "json">) | undefined>;
+//# sourceMappingURL=body-limit.d.ts.map

package/src/middleware/body-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGrC;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;;;8BAS/D"}

package/src/middleware/body-limit.js

@@ -0,0 +1,15 @@
+import { config } from '../config.js';
+/**
+ * Enforces max request body size to prevent memory exhaustion attacks.
+ */
+export async function bodyLimitMiddleware(c, next) {
+    const contentLength = c.req.header('content-length');
+    if (contentLength && parseInt(contentLength) > config.bodyLimitBytes) {
+        return c.json({
+            error: 'Payload Too Large',
+            max_bytes: config.bodyLimitBytes
+        }, 413);
+    }
+    await next();
+}
+//# sourceMappingURL=body-limit.js.map

package/src/middleware/body-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["body-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,CAAU,EAAE,IAAU;IAC9D,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,mBAAmB;YAC1B,SAAS,EAAE,MAAM,CAAC,cAAc;SACjC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/src/middleware/body-limit.ts

@@ -0,0 +1,16 @@
+import { Context, Next } from 'hono';
+import { config } from '../config.js';
+
+/**
+ * Enforces max request body size to prevent memory exhaustion attacks.
+ */
+export async function bodyLimitMiddleware(c: Context, next: Next) {
+  const contentLength = c.req.header('content-length');
+  if (contentLength && parseInt(contentLength) > config.bodyLimitBytes) {
+    return c.json({
+      error: 'Payload Too Large',
+      max_bytes: config.bodyLimitBytes
+    }, 413);
+  }
+  await next();
+}

package/src/middleware/rate-limit.d.ts

@@ -0,0 +1,6 @@
+import { Context, Next } from 'hono';
+export declare function rateLimitMiddleware(c: Context, next: Next): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+    retry_after_ms: number;
+}, 429, "json">) | undefined>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/src/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAuBrC,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;;;8BAuB/D"}

package/src/middleware/rate-limit.js

@@ -0,0 +1,40 @@
+import { config } from '../config.js';
+/**
+ * Simple in-memory sliding window rate limiter.
+ * Enterprise: replace with Redis-backed limiter for multi-instance deployments.
+ */
+const windows = new Map();
+// Periodic cleanup to prevent memory leak
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, val] of windows) {
+        if (now > val.resetAt)
+            windows.delete(key);
+    }
+}, 60_000);
+function getClientKey(c) {
+    const user = c.get('user');
+    if (user?.email && user.email !== 'guest@system.local')
+        return `user:${user.email}`;
+    return `ip:${c.req.header('x-forwarded-for') || c.req.header('x-real-ip') || 'unknown'}`;
+}
+export async function rateLimitMiddleware(c, next) {
+    const key = getClientKey(c);
+    const now = Date.now();
+    const limit = config.rateLimitMax;
+    const windowMs = config.rateLimitWindowMs;
+    let entry = windows.get(key);
+    if (!entry || now > entry.resetAt) {
+        entry = { count: 0, resetAt: now + windowMs };
+        windows.set(key, entry);
+    }
+    entry.count++;
+    c.header('X-RateLimit-Limit', String(limit));
+    c.header('X-RateLimit-Remaining', String(Math.max(0, limit - entry.count)));
+    c.header('X-RateLimit-Reset', String(Math.ceil(entry.resetAt / 1000)));
+    if (entry.count > limit) {
+        return c.json({ error: 'Too Many Requests', retry_after_ms: entry.resetAt - now }, 429);
+    }
+    await next();
+}
+//# sourceMappingURL=rate-limit.js.map

package/src/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;;GAGG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8C,CAAC;AAEtE,0CAA0C;AAC1C,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC,EAAE,MAAM,CAAC,CAAC;AAEX,SAAS,YAAY,CAAC,CAAU;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,oBAAoB;QAAE,OAAO,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;IACpF,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,SAAS,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,CAAU,EAAE,IAAU;IAC9D,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE1C,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/src/middleware/rate-limit.ts

@@ -0,0 +1,47 @@
+import { Context, Next } from 'hono';
+import { config } from '../config.js';
+
+/**
+ * Simple in-memory sliding window rate limiter.
+ * Enterprise: replace with Redis-backed limiter for multi-instance deployments.
+ */
+const windows = new Map<string, { count: number; resetAt: number }>();
+
+// Periodic cleanup to prevent memory leak
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, val] of windows) {
+    if (now > val.resetAt) windows.delete(key);
+  }
+}, 60_000);
+
+function getClientKey(c: Context): string {
+  const user = c.get('user');
+  if (user?.email && user.email !== 'guest@system.local') return `user:${user.email}`;
+  return `ip:${c.req.header('x-forwarded-for') || c.req.header('x-real-ip') || 'unknown'}`;
+}
+
+export async function rateLimitMiddleware(c: Context, next: Next) {
+  const key = getClientKey(c);
+  const now = Date.now();
+  const limit = config.rateLimitMax;
+  const windowMs = config.rateLimitWindowMs;
+
+  let entry = windows.get(key);
+  if (!entry || now > entry.resetAt) {
+    entry = { count: 0, resetAt: now + windowMs };
+    windows.set(key, entry);
+  }
+
+  entry.count++;
+
+  c.header('X-RateLimit-Limit', String(limit));
+  c.header('X-RateLimit-Remaining', String(Math.max(0, limit - entry.count)));
+  c.header('X-RateLimit-Reset', String(Math.ceil(entry.resetAt / 1000)));
+
+  if (entry.count > limit) {
+    return c.json({ error: 'Too Many Requests', retry_after_ms: entry.resetAt - now }, 429);
+  }
+
+  await next();
+}

package/src/middleware/rbac.d.ts

@@ -0,0 +1,10 @@
+import { Context, Next } from 'hono';
+/**
+ * Enforces metadata-driven Role-Based Access Control (RBAC) security boundaries on all requests.
+ */
+export declare function rbacMiddleware(c: Context, next: Next): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 404, "json">) | undefined>;
+//# sourceMappingURL=rbac.d.ts.map

package/src/middleware/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["rbac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAIrC;;GAEG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;;;;8BA+D1D"}

package/src/middleware/rbac.js

@@ -0,0 +1,61 @@
+import { registry } from '../registry.js';
+/**
+ * Enforces metadata-driven Role-Based Access Control (RBAC) security boundaries on all requests.
+ */
+export async function rbacMiddleware(c, next) {
+    const user = c.get('user');
+    const doctypeName = c.req.param('doctype');
+    if (!user || !user.roles) {
+        return c.json({ error: 'Forbidden: Missing request authentication context' }, 403);
+    }
+    if (!doctypeName) {
+        await next();
+        return;
+    }
+    // Load DocType schema definition
+    const doctype = await registry.get(doctypeName);
+    if (!doctype) {
+        return c.json({ error: `DocType ${doctypeName} not found` }, 404);
+    }
+    const method = c.req.method;
+    const path = c.req.path;
+    let action = 'read';
+    if (method === 'POST') {
+        if (path.endsWith('/submit')) {
+            action = 'submit';
+        }
+        else if (path.endsWith('/cancel')) {
+            action = 'cancel';
+        }
+        else {
+            action = 'create';
+        }
+    }
+    else if (method === 'PUT') {
+        action = 'update';
+    }
+    else if (method === 'DELETE') {
+        action = 'delete';
+    }
+    else if (method === 'GET') {
+        action = 'read';
+    }
+    // Admin bypass
+    if (user.roles.includes('System Manager')) {
+        await next();
+        return;
+    }
+    // Check user roles against PermissionRules
+    const permitted = doctype.permissions.some(rule => {
+        const roleMatches = user.roles.includes(rule.role);
+        if (!roleMatches)
+            return false;
+        // Check action boolean
+        return !!rule[action];
+    });
+    if (!permitted) {
+        return c.json({ error: `Forbidden: User does not hold ${action} permissions for DocType '${doctypeName}'` }, 403);
+    }
+    await next();
+}
+//# sourceMappingURL=rbac.js.map

package/src/middleware/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAU,EAAE,IAAU;IACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mDAAmD,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,WAAW,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAExB,IAAI,MAAM,GAAyB,MAAM,CAAC;IAE1C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IAED,eAAe;IACf,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAE/B,uBAAuB;QACvB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,iCAAiC,MAAM,6BAA6B,WAAW,GAAG,EAAE,EAC7F,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/src/middleware/rbac.ts

@@ -0,0 +1,71 @@
+import { Context, Next } from 'hono';
+import { registry } from '../registry.js';
+import { PermissionRule } from '@aruvili/core';
+
+/**
+ * Enforces metadata-driven Role-Based Access Control (RBAC) security boundaries on all requests.
+ */
+export async function rbacMiddleware(c: Context, next: Next) {
+  const user = c.get('user');
+  const doctypeName = c.req.param('doctype');
+
+  if (!user || !user.roles) {
+    return c.json({ error: 'Forbidden: Missing request authentication context' }, 403);
+  }
+
+  if (!doctypeName) {
+    await next();
+    return;
+  }
+
+  // Load DocType schema definition
+  const doctype = await registry.get(doctypeName);
+  if (!doctype) {
+    return c.json({ error: `DocType ${doctypeName} not found` }, 404);
+  }
+
+  const method = c.req.method;
+  const path = c.req.path;
+  
+  let action: keyof PermissionRule = 'read';
+
+  if (method === 'POST') {
+    if (path.endsWith('/submit')) {
+      action = 'submit';
+    } else if (path.endsWith('/cancel')) {
+      action = 'cancel';
+    } else {
+      action = 'create';
+    }
+  } else if (method === 'PUT') {
+    action = 'update';
+  } else if (method === 'DELETE') {
+    action = 'delete';
+  } else if (method === 'GET') {
+    action = 'read';
+  }
+
+  // Admin bypass
+  if (user.roles.includes('System Manager')) {
+    await next();
+    return;
+  }
+
+  // Check user roles against PermissionRules
+  const permitted = doctype.permissions.some(rule => {
+    const roleMatches = user.roles.includes(rule.role);
+    if (!roleMatches) return false;
+
+    // Check action boolean
+    return !!rule[action];
+  });
+
+  if (!permitted) {
+    return c.json(
+      { error: `Forbidden: User does not hold ${action} permissions for DocType '${doctypeName}'` },
+      403
+    );
+  }
+
+  await next();
+}

package/src/middleware/tenant.d.ts

@@ -0,0 +1,3 @@
+import { MiddlewareHandler } from 'hono';
+export declare const tenantMiddleware: MiddlewareHandler;
+//# sourceMappingURL=tenant.d.ts.map

package/src/middleware/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["tenant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAKzC,eAAO,MAAM,gBAAgB,EAAE,iBAkB9B,CAAC"}

package/src/middleware/tenant.js

@@ -0,0 +1,19 @@
+import { requestContext } from '../context.js';
+const TENANT_REGEX = /^[a-zA-Z0-9_]{1,63}$/;
+export const tenantMiddleware = async (c, next) => {
+    const tenantHeader = c.req.header('X-Tenant-ID');
+    // Resolve tenant. Default to public if not provided.
+    let tenantId = 'public';
+    if (tenantHeader) {
+        tenantId = tenantHeader.toLowerCase().trim();
+    }
+    // Validate tenantId to block SQL Injection in search path
+    if (!TENANT_REGEX.test(tenantId)) {
+        return c.json({ error: 'Invalid Tenant ID format' }, 400);
+    }
+    // Bind tenant to context store
+    return requestContext.run({ tenantId, user: c.get('user') }, async () => {
+        await next();
+    });
+};
+//# sourceMappingURL=tenant.js.map

package/src/middleware/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["tenant.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEjD,qDAAqD;IACrD,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,+BAA+B;IAC/B,OAAO,cAAc,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/src/middleware/tenant.ts

@@ -0,0 +1,24 @@
+import { MiddlewareHandler } from 'hono';
+import { requestContext } from '../context.js';
+
+const TENANT_REGEX = /^[a-zA-Z0-9_]{1,63}$/;
+
+export const tenantMiddleware: MiddlewareHandler = async (c, next) => {
+  const tenantHeader = c.req.header('X-Tenant-ID');
+  
+  // Resolve tenant. Default to public if not provided.
+  let tenantId = 'public';
+  if (tenantHeader) {
+    tenantId = tenantHeader.toLowerCase().trim();
+  }
+
+  // Validate tenantId to block SQL Injection in search path
+  if (!TENANT_REGEX.test(tenantId)) {
+    return c.json({ error: 'Invalid Tenant ID format' }, 400);
+  }
+
+  // Bind tenant to context store
+  return requestContext.run({ tenantId, user: c.get('user') }, async () => {
+    await next();
+  });
+};

package/src/registry.d.ts

@@ -0,0 +1,26 @@
+import { DocTypeDefinition } from '@aruvili/core';
+import { z } from 'zod';
+declare class DocTypeRegistry {
+    private cache;
+    private zodSchemas;
+    /**
+     * Clears in-memory metadata caches.
+     */
+    invalidate(doctypeName: string): void;
+    /**
+     * Retrieves a DocTypeDefinition schema structure.
+     * Loads dynamically from database into cache if missing.
+     */
+    get(doctypeName: string): Promise<DocTypeDefinition | null>;
+    /**
+     * Sets definition details to registry and clear caches.
+     */
+    set(doctypeName: string, definition: DocTypeDefinition): void;
+    /**
+     * Compiles and returns a runtime Zod validator matching the fields configuration.
+     */
+    getValidator(doctypeName: string): Promise<z.ZodObject<any> | null>;
+}
+export declare const registry: DocTypeRegistry;
+export {};
+//# sourceMappingURL=registry.d.ts.map

package/src/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,cAAM,eAAe;IACnB,OAAO,CAAC,KAAK,CAAwC;IACrD,OAAO,CAAC,UAAU,CAAuC;IAEzD;;OAEG;IACI,UAAU,CAAC,WAAW,EAAE,MAAM;IAKrC;;;OAGG;IACU,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAoBxE;;OAEG;IACI,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB;IAK7D;;OAEG;IACU,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CAqEjF;AAED,eAAO,MAAM,QAAQ,iBAAwB,CAAC"}

package/src/registry.js

@@ -0,0 +1,112 @@
+import { z } from 'zod';
+import { query } from './db.js';
+class DocTypeRegistry {
+    cache = new Map();
+    zodSchemas = new Map();
+    /**
+     * Clears in-memory metadata caches.
+     */
+    invalidate(doctypeName) {
+        this.cache.delete(doctypeName);
+        this.zodSchemas.delete(doctypeName);
+    }
+    /**
+     * Retrieves a DocTypeDefinition schema structure.
+     * Loads dynamically from database into cache if missing.
+     */
+    async get(doctypeName) {
+        if (this.cache.has(doctypeName)) {
+            return this.cache.get(doctypeName);
+        }
+        // Attempt to load from PostgreSQL meta configuration table
+        try {
+            const res = await query('SELECT definition FROM _doctype_meta WHERE name = $1', [doctypeName]);
+            if (res.rows.length === 0) {
+                return null;
+            }
+            const definition = res.rows[0].definition;
+            this.cache.set(doctypeName, definition);
+            return definition;
+        }
+        catch (err) {
+            console.error(`Failed to load DocType ${doctypeName} from database:`, err);
+            return null;
+        }
+    }
+    /**
+     * Sets definition details to registry and clear caches.
+     */
+    set(doctypeName, definition) {
+        this.cache.set(doctypeName, definition);
+        this.zodSchemas.delete(doctypeName);
+    }
+    /**
+     * Compiles and returns a runtime Zod validator matching the fields configuration.
+     */
+    async getValidator(doctypeName) {
+        if (this.zodSchemas.has(doctypeName)) {
+            return this.zodSchemas.get(doctypeName);
+        }
+        const definition = await this.get(doctypeName);
+        if (!definition)
+            return null;
+        const shape = {
+            name: z.string().max(255).optional(),
+            docstatus: z.number().int().min(0).max(2).optional()
+        };
+        for (const field of definition.fields) {
+            let validator;
+            switch (field.fieldtype) {
+                case 'Select':
+                    if (field.options) {
+                        const list = field.options.split(',').map(s => s.trim());
+                        validator = z.enum(list);
+                    }
+                    else {
+                        validator = z.string().max(255);
+                    }
+                    break;
+                case 'Text':
+                case 'Link':
+                    validator = z.string().max(255);
+                    break;
+                case 'Small Text':
+                case 'Long Text':
+                    validator = z.string();
+                    break;
+                case 'Int':
+                    validator = z.number().int();
+                    break;
+                case 'Float':
+                case 'Currency':
+                    validator = z.number();
+                    break;
+                case 'Check':
+                    validator = z.boolean();
+                    break;
+                case 'Date':
+                    validator = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, 'Must be in YYYY-MM-DD format');
+                    break;
+                case 'Datetime':
+                    validator = z.string().datetime();
+                    break;
+                case 'Table':
+                    // Child table fields are arrays of validations compiled from the child schema.
+                    // Note: to prevent recursion, retrieve the child validator dynamically.
+                    validator = z.array(z.any()); // Validated down the pipeline inside CRUD controller transaction loop
+                    break;
+                default:
+                    validator = z.any();
+            }
+            if (!field.required) {
+                validator = validator.optional().nullable();
+            }
+            shape[field.fieldname] = validator;
+        }
+        const compiled = z.object(shape);
+        this.zodSchemas.set(doctypeName, compiled);
+        return compiled;
+    }
+}
+export const registry = new DocTypeRegistry();
+//# sourceMappingURL=registry.js.map

package/src/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAEhC,MAAM,eAAe;IACX,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC7C,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEzD;;OAEG;IACI,UAAU,CAAC,WAAmB;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,GAAG,CAAC,WAAmB;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/F,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAA+B,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,0BAA0B,WAAW,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACI,GAAG,CAAC,WAAmB,EAAE,UAA6B;QAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,WAAmB;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,KAAK,GAAiC;YAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SACrD,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,SAAuB,CAAC;YAE5B,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;gBACxB,KAAK,QAAQ;oBACX,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;wBAClB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;wBACzD,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAA6B,CAAC,CAAC;oBACpD,CAAC;yBAAM,CAAC;wBACN,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAClC,CAAC;oBACD,MAAM;gBACR,KAAK,MAAM,CAAC;gBACZ,KAAK,MAAM;oBACT,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChC,MAAM;gBACR,KAAK,YAAY,CAAC;gBAClB,KAAK,WAAW;oBACd,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACvB,MAAM;gBACR,KAAK,KAAK;oBACR,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;oBAC7B,MAAM;gBACR,KAAK,OAAO,CAAC;gBACb,KAAK,UAAU;oBACb,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACvB,MAAM;gBACR,KAAK,OAAO;oBACV,SAAS,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;oBACxB,MAAM;gBACR,KAAK,MAAM;oBACT,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;oBACpF,MAAM;gBACR,KAAK,UAAU;oBACb,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;oBAClC,MAAM;gBACR,KAAK,OAAO;oBACV,+EAA+E;oBAC/E,wEAAwE;oBACxE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,sEAAsE;oBACpG,MAAM;gBACR;oBACE,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,CAAC;YAED,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC"}