@aruvili/api 0.1.0

package/src/registry.ts

@@ -0,0 +1,123 @@
+import { DocTypeDefinition } from '@aruvili/core';
+import { z } from 'zod';
+import { query } from './db.js';
+
+class DocTypeRegistry {
+  private cache = new Map<string, DocTypeDefinition>();
+  private zodSchemas = new Map<string, z.ZodObject<any>>();
+
+  /**
+   * Clears in-memory metadata caches.
+   */
+  public invalidate(doctypeName: string) {
+    this.cache.delete(doctypeName);
+    this.zodSchemas.delete(doctypeName);
+  }
+
+  /**
+   * Retrieves a DocTypeDefinition schema structure.
+   * Loads dynamically from database into cache if missing.
+   */
+  public async get(doctypeName: string): Promise<DocTypeDefinition | null> {
+    if (this.cache.has(doctypeName)) {
+      return this.cache.get(doctypeName)!;
+    }
+
+    // Attempt to load from PostgreSQL meta configuration table
+    try {
+      const res = await query('SELECT definition FROM _doctype_meta WHERE name = $1', [doctypeName]);
+      if (res.rows.length === 0) {
+        return null;
+      }
+      const definition = res.rows[0].definition as DocTypeDefinition;
+      this.cache.set(doctypeName, definition);
+      return definition;
+    } catch (err) {
+      console.error(`Failed to load DocType ${doctypeName} from database:`, err);
+      return null;
+    }
+  }
+
+  /**
+   * Sets definition details to registry and clear caches.
+   */
+  public set(doctypeName: string, definition: DocTypeDefinition) {
+    this.cache.set(doctypeName, definition);
+    this.zodSchemas.delete(doctypeName);
+  }
+
+  /**
+   * Compiles and returns a runtime Zod validator matching the fields configuration.
+   */
+  public async getValidator(doctypeName: string): Promise<z.ZodObject<any> | null> {
+    if (this.zodSchemas.has(doctypeName)) {
+      return this.zodSchemas.get(doctypeName)!;
+    }
+
+    const definition = await this.get(doctypeName);
+    if (!definition) return null;
+
+    const shape: Record<string, z.ZodTypeAny> = {
+      name: z.string().max(255).optional(),
+      docstatus: z.number().int().min(0).max(2).optional()
+    };
+
+    for (const field of definition.fields) {
+      let validator: z.ZodTypeAny;
+
+      switch (field.fieldtype) {
+        case 'Select':
+          if (field.options) {
+            const list = field.options.split(',').map(s => s.trim());
+            validator = z.enum(list as [string, ...string[]]);
+          } else {
+            validator = z.string().max(255);
+          }
+          break;
+        case 'Text':
+        case 'Link':
+          validator = z.string().max(255);
+          break;
+        case 'Small Text':
+        case 'Long Text':
+          validator = z.string();
+          break;
+        case 'Int':
+          validator = z.number().int();
+          break;
+        case 'Float':
+        case 'Currency':
+          validator = z.number();
+          break;
+        case 'Check':
+          validator = z.boolean();
+          break;
+        case 'Date':
+          validator = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, 'Must be in YYYY-MM-DD format');
+          break;
+        case 'Datetime':
+          validator = z.string().datetime();
+          break;
+        case 'Table':
+          // Child table fields are arrays of validations compiled from the child schema.
+          // Note: to prevent recursion, retrieve the child validator dynamically.
+          validator = z.array(z.any()); // Validated down the pipeline inside CRUD controller transaction loop
+          break;
+        default:
+          validator = z.any();
+      }
+
+      if (!field.required) {
+        validator = validator.optional().nullable();
+      }
+
+      shape[field.fieldname] = validator;
+    }
+
+    const compiled = z.object(shape);
+    this.zodSchemas.set(doctypeName, compiled);
+    return compiled;
+  }
+}
+
+export const registry = new DocTypeRegistry();

package/src/routes/auth.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from 'hono';
+export declare const authRouter: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=auth.d.ts.map

package/src/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,eAAO,MAAM,UAAU,4EAAa,CAAC"}

package/src/routes/auth.js

@@ -0,0 +1,141 @@
+import { Hono } from 'hono';
+import { config } from '../config.js';
+import { query, withTransaction } from '../db.js';
+import crypto from 'crypto';
+export const authRouter = new Hono();
+/**
+ * Hash password using native crypto (no bcrypt dependency needed in Bun).
+ */
+async function hashPassword(password) {
+    const salt = crypto.randomBytes(32).toString('hex');
+    return new Promise((resolve, reject) => {
+        crypto.scrypt(password, salt, 64, (err, derived) => {
+            if (err)
+                reject(err);
+            resolve(`${salt}:${derived.toString('hex')}`);
+        });
+    });
+}
+async function verifyPassword(password, hash) {
+    const [salt, key] = hash.split(':');
+    return new Promise((resolve, reject) => {
+        crypto.scrypt(password, salt, 64, (err, derived) => {
+            if (err)
+                reject(err);
+            resolve(derived.toString('hex') === key);
+        });
+    });
+}
+/**
+ * Generate a signed JWT token.
+ */
+function signJWT(payload) {
+    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+    const now = Math.floor(Date.now() / 1000);
+    const body = Buffer.from(JSON.stringify({
+        ...payload,
+        iat: now,
+        exp: now + config.jwtExpiresIn
+    })).toString('base64url');
+    const signature = crypto
+        .createHmac('sha256', config.jwtSecret)
+        .update(`${header}.${body}`)
+        .digest('base64url');
+    return `${header}.${body}.${signature}`;
+}
+/**
+ * POST /api/auth/signup
+ */
+authRouter.post('/signup', async (c) => {
+    const { email, password, full_name } = await c.req.json();
+    if (!email || !password) {
+        return c.json({ error: 'Email and password are required' }, 400);
+    }
+    if (typeof password !== 'string' || password.length < 8) {
+        return c.json({ error: 'Password must be at least 8 characters' }, 400);
+    }
+    if (typeof email !== 'string' || !email.includes('@')) {
+        return c.json({ error: 'Invalid email address' }, 400);
+    }
+    try {
+        const existing = await query('SELECT name FROM _users WHERE email = $1', [email.toLowerCase()]);
+        if (existing.rows.length > 0) {
+            return c.json({ error: 'An account with this email already exists' }, 409);
+        }
+        const hashed = await hashPassword(password);
+        const userId = crypto.randomUUID();
+        await withTransaction(async (client) => {
+            await client.query(`INSERT INTO _users (name, uuid, email, full_name, hashed_password, roles, enabled)
+         VALUES ($1, gen_random_uuid(), $2, $3, $4, $5, true)`, [userId, email.toLowerCase(), full_name || '', hashed, JSON.stringify(['Guest'])]);
+        });
+        const token = signJWT({ email: email.toLowerCase(), roles: ['Guest'], user_id: userId });
+        return c.json({ token, user: { name: userId, email: email.toLowerCase(), roles: ['Guest'] } }, 201);
+    }
+    catch (err) {
+        console.error('[AUTH] Signup failed:', err.message);
+        return c.json({ error: 'Registration failed' }, 500);
+    }
+});
+/**
+ * POST /api/auth/login
+ */
+authRouter.post('/login', async (c) => {
+    const { email, password } = await c.req.json();
+    if (!email || !password) {
+        return c.json({ error: 'Email and password are required' }, 400);
+    }
+    try {
+        const res = await query('SELECT name, email, hashed_password, roles, enabled FROM _users WHERE email = $1', [email.toLowerCase()]);
+        if (res.rows.length === 0) {
+            return c.json({ error: 'Invalid email or password' }, 401);
+        }
+        const user = res.rows[0];
+        if (!user.enabled) {
+            return c.json({ error: 'Account is disabled' }, 403);
+        }
+        const valid = await verifyPassword(password, user.hashed_password);
+        if (!valid) {
+            return c.json({ error: 'Invalid email or password' }, 401);
+        }
+        const roles = Array.isArray(user.roles) ? user.roles : JSON.parse(user.roles || '["Guest"]');
+        const token = signJWT({ email: user.email, roles, user_id: user.name });
+        // Update last login
+        await query('UPDATE _users SET last_login = NOW() WHERE name = $1', [user.name]);
+        return c.json({ token, user: { name: user.name, email: user.email, roles } });
+    }
+    catch (err) {
+        console.error('[AUTH] Login failed:', err.message);
+        return c.json({ error: 'Authentication failed' }, 500);
+    }
+});
+/**
+ * GET /api/auth/me — returns current session user info
+ */
+authRouter.get('/me', async (c) => {
+    const authHeader = c.req.header('Authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+        return c.json({ error: 'Not authenticated' }, 401);
+    }
+    const token = authHeader.split(' ')[1];
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return c.json({ error: 'Invalid token' }, 401);
+        const sig = crypto.createHmac('sha256', config.jwtSecret).update(`${parts[0]}.${parts[1]}`).digest('base64url');
+        if (sig !== parts[2])
+            return c.json({ error: 'Invalid token' }, 401);
+        const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString());
+        if (payload.exp && Date.now() / 1000 > payload.exp)
+            return c.json({ error: 'Token expired' }, 401);
+        const res = await query('SELECT name, email, full_name, roles, enabled, last_login FROM _users WHERE email = $1', [payload.email]);
+        if (res.rows.length === 0)
+            return c.json({ error: 'User not found' }, 404);
+        const user = res.rows[0];
+        user.roles = Array.isArray(user.roles) ? user.roles : JSON.parse(user.roles || '[]');
+        return c.json(user);
+    }
+    catch {
+        return c.json({ error: 'Invalid token' }, 401);
+    }
+});
+//# sourceMappingURL=auth.js.map

package/src/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;AAErC;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YACjD,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC1D,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YACjD,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAC,OAA4B;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACtC,GAAG,OAAO;QACV,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,YAAY;KAC/B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;SACtC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAE1D,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,0CAA0C,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEnC,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,CAAC,KAAK,CAChB;8DACsD,EACtD,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAClF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACtG,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAE/C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,kFAAkF,EAClF,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACtB,CAAC;QAEF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExE,oBAAoB;QACpB,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QAEvE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChH,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QAEnG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wFAAwF,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/src/routes/auth.ts

@@ -0,0 +1,164 @@
+import { Hono } from 'hono';
+import { config } from '../config.js';
+import { query, withTransaction } from '../db.js';
+import crypto from 'crypto';
+
+export const authRouter = new Hono();
+
+/**
+ * Hash password using native crypto (no bcrypt dependency needed in Bun).
+ */
+async function hashPassword(password: string): Promise<string> {
+  const salt = crypto.randomBytes(32).toString('hex');
+  return new Promise((resolve, reject) => {
+    crypto.scrypt(password, salt, 64, (err, derived) => {
+      if (err) reject(err);
+      resolve(`${salt}:${derived.toString('hex')}`);
+    });
+  });
+}
+
+async function verifyPassword(password: string, hash: string): Promise<boolean> {
+  const [salt, key] = hash.split(':');
+  return new Promise((resolve, reject) => {
+    crypto.scrypt(password, salt, 64, (err, derived) => {
+      if (err) reject(err);
+      resolve(derived.toString('hex') === key);
+    });
+  });
+}
+
+/**
+ * Generate a signed JWT token.
+ */
+function signJWT(payload: Record<string, any>): string {
+  const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+  const now = Math.floor(Date.now() / 1000);
+  const body = Buffer.from(JSON.stringify({
+    ...payload,
+    iat: now,
+    exp: now + config.jwtExpiresIn
+  })).toString('base64url');
+  const signature = crypto
+    .createHmac('sha256', config.jwtSecret)
+    .update(`${header}.${body}`)
+    .digest('base64url');
+  return `${header}.${body}.${signature}`;
+}
+
+/**
+ * POST /api/auth/signup
+ */
+authRouter.post('/signup', async (c) => {
+  const { email, password, full_name } = await c.req.json();
+
+  if (!email || !password) {
+    return c.json({ error: 'Email and password are required' }, 400);
+  }
+  if (typeof password !== 'string' || password.length < 8) {
+    return c.json({ error: 'Password must be at least 8 characters' }, 400);
+  }
+  if (typeof email !== 'string' || !email.includes('@')) {
+    return c.json({ error: 'Invalid email address' }, 400);
+  }
+
+  try {
+    const existing = await query('SELECT name FROM _users WHERE email = $1', [email.toLowerCase()]);
+    if (existing.rows.length > 0) {
+      return c.json({ error: 'An account with this email already exists' }, 409);
+    }
+
+    const hashed = await hashPassword(password);
+    const userId = crypto.randomUUID();
+
+    await withTransaction(async (client) => {
+      await client.query(
+        `INSERT INTO _users (name, uuid, email, full_name, hashed_password, roles, enabled)
+         VALUES ($1, gen_random_uuid(), $2, $3, $4, $5, true)`,
+        [userId, email.toLowerCase(), full_name || '', hashed, JSON.stringify(['Guest'])]
+      );
+    });
+
+    const token = signJWT({ email: email.toLowerCase(), roles: ['Guest'], user_id: userId });
+
+    return c.json({ token, user: { name: userId, email: email.toLowerCase(), roles: ['Guest'] } }, 201);
+  } catch (err: any) {
+    console.error('[AUTH] Signup failed:', err.message);
+    return c.json({ error: 'Registration failed' }, 500);
+  }
+});
+
+/**
+ * POST /api/auth/login
+ */
+authRouter.post('/login', async (c) => {
+  const { email, password } = await c.req.json();
+
+  if (!email || !password) {
+    return c.json({ error: 'Email and password are required' }, 400);
+  }
+
+  try {
+    const res = await query(
+      'SELECT name, email, hashed_password, roles, enabled FROM _users WHERE email = $1',
+      [email.toLowerCase()]
+    );
+
+    if (res.rows.length === 0) {
+      return c.json({ error: 'Invalid email or password' }, 401);
+    }
+
+    const user = res.rows[0];
+
+    if (!user.enabled) {
+      return c.json({ error: 'Account is disabled' }, 403);
+    }
+
+    const valid = await verifyPassword(password, user.hashed_password);
+    if (!valid) {
+      return c.json({ error: 'Invalid email or password' }, 401);
+    }
+
+    const roles = Array.isArray(user.roles) ? user.roles : JSON.parse(user.roles || '["Guest"]');
+    const token = signJWT({ email: user.email, roles, user_id: user.name });
+
+    // Update last login
+    await query('UPDATE _users SET last_login = NOW() WHERE name = $1', [user.name]);
+
+    return c.json({ token, user: { name: user.name, email: user.email, roles } });
+  } catch (err: any) {
+    console.error('[AUTH] Login failed:', err.message);
+    return c.json({ error: 'Authentication failed' }, 500);
+  }
+});
+
+/**
+ * GET /api/auth/me — returns current session user info
+ */
+authRouter.get('/me', async (c) => {
+  const authHeader = c.req.header('Authorization');
+  if (!authHeader?.startsWith('Bearer ')) {
+    return c.json({ error: 'Not authenticated' }, 401);
+  }
+
+  const token = authHeader.split(' ')[1];
+  try {
+    const parts = token.split('.');
+    if (parts.length !== 3) return c.json({ error: 'Invalid token' }, 401);
+
+    const sig = crypto.createHmac('sha256', config.jwtSecret).update(`${parts[0]}.${parts[1]}`).digest('base64url');
+    if (sig !== parts[2]) return c.json({ error: 'Invalid token' }, 401);
+
+    const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString());
+    if (payload.exp && Date.now() / 1000 > payload.exp) return c.json({ error: 'Token expired' }, 401);
+
+    const res = await query('SELECT name, email, full_name, roles, enabled, last_login FROM _users WHERE email = $1', [payload.email]);
+    if (res.rows.length === 0) return c.json({ error: 'User not found' }, 404);
+
+    const user = res.rows[0];
+    user.roles = Array.isArray(user.roles) ? user.roles : JSON.parse(user.roles || '[]');
+    return c.json(user);
+  } catch {
+    return c.json({ error: 'Invalid token' }, 401);
+  }
+});

package/src/routes/crud.d.ts

@@ -0,0 +1,7 @@
+import { Hono } from 'hono';
+export declare const crudRouter: Hono<{
+    Variables: {
+        user: any;
+    };
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=crud.d.ts.map

package/src/routes/crud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crud.d.ts","sourceRoot":"","sources":["crud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,eAAO,MAAM,UAAU;eAAyB;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE;yCAAK,CAAC"}