@astralibx/staff-engine 0.2.0 → 0.2.1

package/dist/index.mjs

@@ -1,9 +1,9 @@
-import { z } from 'zod';
 import { AlxError, sendError, noopLogger, sendSuccess } from '@astralibx/core';
 export { sendSuccess } from '@astralibx/core';
 import { PERMISSION_TYPE_VALUES, STAFF_STATUS, STAFF_STATUS_VALUES, STAFF_ROLE_VALUES, PERMISSION_TYPE, STAFF_ROLE, DEFAULT_OPTIONS } from '@astralibx/staff-types';
 export { DEFAULT_OPTIONS } from '@astralibx/staff-types';
 import { Schema } from 'mongoose';
+import { z } from 'zod';
 import jwt2 from 'jsonwebtoken';
 import { Router } from 'express';
 
@@ -399,6 +399,50 @@ function validatePermissionPairs(permissions, allGroups) {
     throw new InvalidPermissionError(missingViewKeys);
   }
 }
+var StaffEngineConfigSchema = z.object({
+  db: z.object({
+    connection: z.unknown().refine((v) => v !== void 0 && v !== null, {
+      message: "db.connection is required"
+    }),
+    collectionPrefix: z.string().optional()
+  }),
+  redis: z.object({
+    connection: z.unknown(),
+    keyPrefix: z.string().optional()
+  }).optional(),
+  logger: z.object({
+    info: z.function(),
+    warn: z.function(),
+    error: z.function()
+  }).optional(),
+  tenantId: z.string().optional(),
+  auth: z.object({
+    jwtSecret: z.string().min(1),
+    staffTokenExpiry: z.string().optional(),
+    ownerTokenExpiry: z.string().optional(),
+    permissionCacheTtlMs: z.number().int().positive().optional()
+  }),
+  adapters: z.object({
+    hashPassword: z.function(),
+    comparePassword: z.function()
+  }),
+  hooks: z.object({
+    onStaffCreated: z.function().optional(),
+    onLogin: z.function().optional(),
+    onLoginFailed: z.function().optional(),
+    onPermissionsChanged: z.function().optional(),
+    onStatusChanged: z.function().optional(),
+    onMetric: z.function().optional()
+  }).optional(),
+  options: z.object({
+    requireEmailUniqueness: z.boolean().optional(),
+    allowSelfPasswordChange: z.boolean().optional(),
+    rateLimiter: z.object({
+      windowMs: z.number().int().positive().optional(),
+      maxAttempts: z.number().int().positive().optional()
+    }).optional()
+  }).optional()
+});
 
 // src/services/staff.service.ts
 var StaffService = class {
@@ -407,105 +451,22 @@ var StaffService = class {
   adapters;
   hooks;
   permissionCache;
-  rateLimiter;
   logger;
   tenantId;
-  jwtSecret;
-  staffTokenExpiry;
-  ownerTokenExpiry;
   requireEmailUniqueness;
-  allowSelfPasswordChange;
   constructor(deps) {
     this.Staff = deps.Staff;
     this.PermissionGroup = deps.PermissionGroup;
     this.adapters = deps.adapters;
     this.hooks = deps.hooks;
     this.permissionCache = deps.permissionCache;
-    this.rateLimiter = deps.rateLimiter;
     this.logger = deps.logger;
     this.tenantId = deps.tenantId;
-    this.jwtSecret = deps.jwtSecret;
-    this.staffTokenExpiry = deps.staffTokenExpiry;
-    this.ownerTokenExpiry = deps.ownerTokenExpiry;
     this.requireEmailUniqueness = deps.requireEmailUniqueness;
-    this.allowSelfPasswordChange = deps.allowSelfPasswordChange;
   }
   get tenantFilter() {
     return this.tenantId ? { tenantId: this.tenantId } : {};
   }
-  generateToken(staffId, role) {
-    const expiresIn = role === STAFF_ROLE.Owner ? this.ownerTokenExpiry : this.staffTokenExpiry;
-    return jwt2.sign({ staffId, role }, this.jwtSecret, { expiresIn });
-  }
-  async setupOwner(data) {
-    const count = await this.Staff.countDocuments(this.tenantFilter);
-    if (count > 0) throw new SetupError();
-    const hashedPassword = await this.adapters.hashPassword(data.password);
-    let staff;
-    try {
-      const doc = await this.Staff.create({
-        name: data.name,
-        email: data.email.toLowerCase().trim(),
-        password: hashedPassword,
-        role: STAFF_ROLE.Owner,
-        status: STAFF_STATUS.Active,
-        permissions: [],
-        ...this.tenantFilter
-      });
-      staff = doc.toObject();
-    } catch (err) {
-      if (err && typeof err === "object" && "code" in err && err.code === 11e3) {
-        throw new SetupError();
-      }
-      throw err;
-    }
-    const token = this.generateToken(staff._id.toString(), STAFF_ROLE.Owner);
-    this.logger.info("Owner setup complete", { staffId: staff._id.toString() });
-    this.hooks.onStaffCreated?.(staff);
-    this.hooks.onMetric?.({ name: "staff_setup_complete", value: 1 });
-    return { staff, token };
-  }
-  async login(email, password, ip) {
-    if (ip) {
-      const limit = await this.rateLimiter.checkLimit(ip);
-      if (!limit.allowed) {
-        this.hooks.onLoginFailed?.(email, ip);
-        throw new RateLimitError(limit.retryAfterMs);
-      }
-    }
-    const staff = await this.Staff.findOne({
-      email: email.toLowerCase().trim(),
-      ...this.tenantFilter
-    }).select("+password");
-    if (!staff) {
-      if (ip) await this.rateLimiter.recordAttempt(ip);
-      this.hooks.onLoginFailed?.(email, ip);
-      throw new AuthenticationError(ERROR_CODE.InvalidCredentials);
-    }
-    const valid = await this.adapters.comparePassword(password, staff.password);
-    if (!valid) {
-      if (ip) await this.rateLimiter.recordAttempt(ip);
-      this.hooks.onLoginFailed?.(email, ip);
-      throw new AuthenticationError(ERROR_CODE.InvalidCredentials);
-    }
-    if (staff.status === STAFF_STATUS.Inactive) {
-      throw new AuthenticationError(ERROR_CODE.AccountInactive, ERROR_MESSAGE.AccountInactive);
-    }
-    if (staff.status === STAFF_STATUS.Pending) {
-      throw new AuthenticationError(ERROR_CODE.AccountPending, ERROR_MESSAGE.AccountPending);
-    }
-    staff.lastLoginAt = /* @__PURE__ */ new Date();
-    if (ip) staff.lastLoginIp = ip;
-    await staff.save();
-    if (ip) await this.rateLimiter.reset(ip);
-    const token = this.generateToken(staff._id.toString(), staff.role);
-    this.hooks.onLogin?.(staff.toObject(), ip);
-    this.hooks.onMetric?.({ name: "staff_login", value: 1, labels: { role: staff.role } });
-    this.logger.info("Staff login", { staffId: staff._id.toString() });
-    const staffObj = staff.toObject();
-    delete staffObj.password;
-    return { staff: staffObj, token };
-  }
   async create(data) {
     if (this.requireEmailUniqueness) {
       const existing = await this.Staff.findOne({
@@ -606,6 +567,106 @@ var StaffService = class {
     this.logger.info("Staff status updated", { staffId, oldStatus, newStatus: status });
     return staff.toObject();
   }
+};
+var AuthService = class {
+  Staff;
+  adapters;
+  hooks;
+  rateLimiter;
+  logger;
+  tenantId;
+  jwtSecret;
+  staffTokenExpiry;
+  ownerTokenExpiry;
+  allowSelfPasswordChange;
+  constructor(deps) {
+    this.Staff = deps.Staff;
+    this.adapters = deps.adapters;
+    this.hooks = deps.hooks;
+    this.rateLimiter = deps.rateLimiter;
+    this.logger = deps.logger;
+    this.tenantId = deps.tenantId;
+    this.jwtSecret = deps.jwtSecret;
+    this.staffTokenExpiry = deps.staffTokenExpiry;
+    this.ownerTokenExpiry = deps.ownerTokenExpiry;
+    this.allowSelfPasswordChange = deps.allowSelfPasswordChange;
+  }
+  get tenantFilter() {
+    return this.tenantId ? { tenantId: this.tenantId } : {};
+  }
+  generateToken(staffId, role) {
+    const expiresIn = role === STAFF_ROLE.Owner ? this.ownerTokenExpiry : this.staffTokenExpiry;
+    return jwt2.sign({ staffId, role }, this.jwtSecret, { expiresIn });
+  }
+  async setupOwner(data) {
+    const count = await this.Staff.countDocuments(this.tenantFilter);
+    if (count > 0) throw new SetupError();
+    const hashedPassword = await this.adapters.hashPassword(data.password);
+    let staff;
+    try {
+      const doc = await this.Staff.create({
+        name: data.name,
+        email: data.email.toLowerCase().trim(),
+        password: hashedPassword,
+        role: STAFF_ROLE.Owner,
+        status: STAFF_STATUS.Active,
+        permissions: [],
+        ...this.tenantFilter
+      });
+      staff = doc.toObject();
+    } catch (err) {
+      if (err && typeof err === "object" && "code" in err && err.code === 11e3) {
+        throw new SetupError();
+      }
+      throw err;
+    }
+    const token = this.generateToken(staff._id.toString(), STAFF_ROLE.Owner);
+    this.logger.info("Owner setup complete", { staffId: staff._id.toString() });
+    this.hooks.onStaffCreated?.(staff);
+    this.hooks.onMetric?.({ name: "staff_setup_complete", value: 1 });
+    return { staff, token };
+  }
+  async login(email, password, ip) {
+    if (ip) {
+      const limit = await this.rateLimiter.checkLimit(ip);
+      if (!limit.allowed) {
+        this.hooks.onLoginFailed?.(email, ip);
+        throw new RateLimitError(limit.retryAfterMs);
+      }
+    }
+    const staff = await this.Staff.findOne({
+      email: email.toLowerCase().trim(),
+      ...this.tenantFilter
+    }).select("+password");
+    if (!staff) {
+      if (ip) await this.rateLimiter.recordAttempt(ip);
+      this.hooks.onLoginFailed?.(email, ip);
+      throw new AuthenticationError(ERROR_CODE.InvalidCredentials);
+    }
+    const valid = await this.adapters.comparePassword(password, staff.password);
+    if (!valid) {
+      if (ip) await this.rateLimiter.recordAttempt(ip);
+      this.hooks.onLoginFailed?.(email, ip);
+      throw new AuthenticationError(ERROR_CODE.InvalidCredentials);
+    }
+    if (staff.status === STAFF_STATUS.Inactive) {
+      throw new AuthenticationError(ERROR_CODE.AccountInactive, ERROR_MESSAGE.AccountInactive);
+    }
+    if (staff.status === STAFF_STATUS.Pending) {
+      throw new AuthenticationError(ERROR_CODE.AccountPending, ERROR_MESSAGE.AccountPending);
+    }
+    staff.lastLoginAt = /* @__PURE__ */ new Date();
+    if (ip) staff.lastLoginIp = ip;
+    await staff.save();
+    if (ip) await this.rateLimiter.reset(ip);
+    const token = this.generateToken(staff._id.toString(), staff.role);
+    this.hooks.onLogin?.(staff.toObject(), ip);
+    this.hooks.onMetric?.({ name: "staff_login", value: 1, labels: { role: staff.role } });
+    this.logger.info("Staff login", { staffId: staff._id.toString() });
+    const staffObj = staff.toObject();
+    delete staffObj.password;
+    return { staff: staffObj, token };
+  }
   async resetPassword(staffId, newPassword) {
     const staff = await this.Staff.findOne({ _id: staffId, ...this.tenantFilter });
     if (!staff) throw new StaffNotFoundError(staffId);
@@ -758,11 +819,11 @@ function handleStaffError(res, error, logger) {
 }
 
 // src/routes/auth.routes.ts
-function createAuthRoutes(staffService, auth, logger, allowSelfPasswordChange) {
+function createAuthRoutes(staffService, authService, auth, logger, allowSelfPasswordChange) {
   const router = Router();
   router.post("/setup", async (req, res) => {
     try {
-      const result = await staffService.setupOwner(req.body);
+      const result = await authService.setupOwner(req.body);
       sendSuccess(res, result, 201);
     } catch (error) {
       handleStaffError(res, error, logger);
@@ -772,7 +833,7 @@ function createAuthRoutes(staffService, auth, logger, allowSelfPasswordChange) {
     try {
       const { email, password } = req.body;
       const ip = req.ip || req.socket.remoteAddress || "";
-      const result = await staffService.login(email, password, ip);
+      const result = await authService.login(email, password, ip);
       sendSuccess(res, result);
     } catch (error) {
       handleStaffError(res, error, logger);
@@ -792,7 +853,7 @@ function createAuthRoutes(staffService, auth, logger, allowSelfPasswordChange) {
       try {
         const user = req.user;
         const { oldPassword, newPassword } = req.body;
-        await staffService.changeOwnPassword(user.staffId, oldPassword, newPassword);
+        await authService.changeOwnPassword(user.staffId, oldPassword, newPassword);
         sendSuccess(res, { message: "Password changed successfully" });
       } catch (error) {
         handleStaffError(res, error, logger);
@@ -801,7 +862,7 @@ function createAuthRoutes(staffService, auth, logger, allowSelfPasswordChange) {
   }
   return router;
 }
-function createStaffRoutes(staffService, logger) {
+function createStaffRoutes(staffService, logger, authService) {
   const router = Router();
   router.get("/", async (req, res) => {
     try {
@@ -857,7 +918,10 @@ function createStaffRoutes(staffService, logger) {
   });
   router.put("/:staffId/password", async (req, res) => {
     try {
-      await staffService.resetPassword(req.params["staffId"], req.body.password);
+      if (!authService) {
+        throw new Error("AuthService not available");
+      }
+      await authService.resetPassword(req.params["staffId"], req.body.password);
       sendSuccess(res, { message: "Password reset successfully" });
     } catch (error) {
       handleStaffError(res, error, logger);
@@ -905,55 +969,11 @@ function createPermissionGroupRoutes(permissionService, auth, logger) {
 // src/routes/index.ts
 function createRoutes(services, auth, logger, allowSelfPasswordChange) {
   const router = Router();
-  router.use("/", createAuthRoutes(services.staff, auth, logger, allowSelfPasswordChange));
-  router.use("/", auth.verifyToken, auth.ownerOnly, createStaffRoutes(services.staff, logger));
+  router.use("/", createAuthRoutes(services.staff, services.auth, auth, logger, allowSelfPasswordChange));
+  router.use("/", auth.verifyToken, auth.ownerOnly, createStaffRoutes(services.staff, logger, services.auth));
   router.use("/permission-groups", createPermissionGroupRoutes(services.permissions, auth, logger));
   return router;
 }
-var StaffEngineConfigSchema = z.object({
-  db: z.object({
-    connection: z.unknown().refine((v) => v !== void 0 && v !== null, {
-      message: "db.connection is required"
-    }),
-    collectionPrefix: z.string().optional()
-  }),
-  redis: z.object({
-    connection: z.unknown(),
-    keyPrefix: z.string().optional()
-  }).optional(),
-  logger: z.object({
-    info: z.function(),
-    warn: z.function(),
-    error: z.function()
-  }).optional(),
-  tenantId: z.string().optional(),
-  auth: z.object({
-    jwtSecret: z.string().min(1),
-    staffTokenExpiry: z.string().optional(),
-    ownerTokenExpiry: z.string().optional(),
-    permissionCacheTtlMs: z.number().int().positive().optional()
-  }),
-  adapters: z.object({
-    hashPassword: z.function(),
-    comparePassword: z.function()
-  }),
-  hooks: z.object({
-    onStaffCreated: z.function().optional(),
-    onLogin: z.function().optional(),
-    onLoginFailed: z.function().optional(),
-    onPermissionsChanged: z.function().optional(),
-    onStatusChanged: z.function().optional(),
-    onMetric: z.function().optional()
-  }).optional(),
-  options: z.object({
-    requireEmailUniqueness: z.boolean().optional(),
-    allowSelfPasswordChange: z.boolean().optional(),
-    rateLimiter: z.object({
-      windowMs: z.number().int().positive().optional(),
-      maxAttempts: z.number().int().positive().optional()
-    }).optional()
-  }).optional()
-});
 function createStaffEngine(config) {
   const parseResult = StaffEngineConfigSchema.safeParse(config);
   if (!parseResult.success) {
@@ -1008,13 +1028,20 @@ function createStaffEngine(config) {
     adapters: config.adapters,
     hooks: config.hooks ?? {},
     permissionCache,
+    logger,
+    tenantId: config.tenantId,
+    requireEmailUniqueness: resolvedOptions.requireEmailUniqueness
+  });
+  const authService = new AuthService({
+    Staff: StaffModel,
+    adapters: config.adapters,
+    hooks: config.hooks ?? {},
     rateLimiter,
     logger,
     tenantId: config.tenantId,
     jwtSecret: resolvedAuth.jwtSecret,
     staffTokenExpiry: resolvedAuth.staffTokenExpiry,
     ownerTokenExpiry: resolvedAuth.ownerTokenExpiry,
-    requireEmailUniqueness: resolvedOptions.requireEmailUniqueness,
     allowSelfPasswordChange: resolvedOptions.allowSelfPasswordChange
   });
   const auth = createAuthMiddleware(
@@ -1025,7 +1052,7 @@ function createStaffEngine(config) {
     config.tenantId
   );
   const routes = createRoutes(
-    { staff: staffService, permissions: permissionService },
+    { staff: staffService, auth: authService, permissions: permissionService },
     auth,
     logger,
     resolvedOptions.allowSelfPasswordChange
@@ -1038,12 +1065,13 @@ function createStaffEngine(config) {
     routes,
     auth,
     staff: staffService,
+    authService,
     permissions: permissionService,
     models: { Staff: StaffModel, PermissionGroup: PermissionGroupModel },
     destroy
   };
 }
 
-export { AlxStaffError, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, GroupNotFoundError, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, StaffNotFoundError, StaffService, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
+export { AlxStaffError, AuthService, AuthenticationError, AuthorizationError, DEFAULTS, DEFAULT_AUTH, DuplicateError, ERROR_CODE, ERROR_MESSAGE, GroupNotFoundError, InvalidConfigError, InvalidPermissionError, LastOwnerError, PermissionCacheService, PermissionService, RateLimitError, RateLimiterService, SetupError, StaffEngineConfigSchema, StaffNotFoundError, StaffService, TokenError, createAuthMiddleware, createPermissionGroupModel, createRoutes, createStaffEngine, createStaffModel, handleStaffError, validatePermissionPairs };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map