@bhooai/nexus-core 2.0.12 → 2.0.15

package/src/app/Upload.ts

@@ -0,0 +1,114 @@
+/**
+ * Upload — single DB entry per unique image (sha256), multiple logical placements.
+ *
+ * Physical file is stored once (canonical) + symlinked for duplicates across
+ * directories/disks. DB is source of truth for millions of images.
+ *
+ * Schema: one document per sha256, placements[] holds every logical path.
+ * Separate directories (media, avatars, products) are just placements entries.
+ */
+import { Schema, model } from '@bhooai/nexus-data';
+import type { DocumentInstance } from '@bhooai/nexus-data';
+
+export interface ImageVariantDoc {
+  path: string;
+  url: string;
+  width: number;
+  height: number;
+  format: string;
+  size: number;
+  sha256: string;
+}
+
+export interface PlacementDoc {
+  id: string;
+  disk: string;
+  path: string;
+  url: string;
+  dir: string;
+  userId?: string | null;
+  createdAt: Date;
+}
+
+export interface UploadDoc extends DocumentInstance {
+  sha256: string;
+  originalName: string;
+  mime: string;
+  size: number;
+  width?: number;
+  height?: number;
+  canonical: { disk: string; path: string; url: string };
+  placements: PlacementDoc[];
+  variants?: Record<string, ImageVariantDoc>;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+const uploadSchema = new Schema(
+  {
+    sha256: { type: String, required: true, unique: true, index: true },
+    originalName: { type: String, required: true },
+    mime: { type: String, required: true },
+    size: { type: Number, required: true },
+    width: { type: Number },
+    height: { type: Number },
+    canonical: { type: Object, required: true }, // {disk, path, url}
+    placements: { type: Array, default: [] },
+    variants: { type: Object, default: {} },
+    createdAt: { type: Date, default: () => new Date() },
+    updatedAt: { type: Date, default: () => new Date() },
+  },
+  { timestamps: false },
+);
+
+// Additional indexes for millions-scale queries + search
+// sha256 unique is already defined via field `unique:true` → index sha256_1 (unique), do not add duplicate
+uploadSchema.indexes.push({ spec: { 'placements.path': 1 }, options: {} });
+uploadSchema.indexes.push({ spec: { mime: 1 }, options: {} });
+uploadSchema.indexes.push({ spec: { createdAt: -1 }, options: {} });
+// Text index for admin search (originalName, mime, sha256) — single text index per collection
+uploadSchema.indexes.push({
+  spec: { originalName: 'text', mime: 'text', sha256: 'text' } as any,
+  options: { name: 'uploads_text_idx', weights: { originalName: 10, sha256: 5, mime: 2 } as any, default_language: 'english' },
+});
+
+let _cached: any = null;
+
+export function getUploadModel(): any {
+  if (_cached) return _cached;
+  try {
+    _cached = model<UploadDoc>('uploads', uploadSchema);
+    // Ensure indexes in background (non-blocking)
+    void _cached.createIndexes().catch(() => {});
+    return _cached;
+  } catch (e) {
+    // Not connected yet — caller should fallback to filesystem-only
+    return null;
+  }
+}
+
+export function toFileView(doc: any, placementPath?: string) {
+  if (!doc) return null;
+  const obj = typeof doc.toObject === 'function' ? doc.toObject() : doc;
+  const placements: PlacementDoc[] = obj.placements ?? [];
+  // Pick placement matching requested path or first
+  const placement = placementPath ? placements.find((p: any) => p.path === placementPath) ?? placements[0] : placements[0];
+  const variants: Record<string, ImageVariantDoc> = obj.variants ?? {};
+  return {
+    id: obj.sha256, // single entry id is sha256 (stable dedup)
+    _id: obj._id,
+    sha256: obj.sha256,
+    originalName: obj.originalName,
+    mime: obj.mime,
+    size: obj.size,
+    width: obj.width,
+    height: obj.height,
+    disk: placement?.disk ?? obj.canonical?.disk,
+    path: placement?.path ?? obj.canonical?.path,
+    url: placement?.url ?? obj.canonical?.url,
+    canonical: obj.canonical,
+    placements,
+    variants,
+    createdAt: obj.createdAt,
+  };
+}

package/src/app/adminModule.ts

@@ -40,6 +40,7 @@ import type { Router } from '../http/Router.js';
 import type { Middleware, RequestContext } from '../http/context.js';
 import { AiClient } from '@bhooai/nexus-ai-client';
 import { discoverUserConfigPath, frameworkDefaultConfigPath, mergeConfig } from '../config/ConfigLoader.js';
+import { mongoEnabled, mongoUri } from '../config/dbAccess.js';
 import { readRuntimeJson, writeRuntimeJson, mergeRuntimeJson } from '../config/runtimeJson.js';
 import { readEnvFile, writeEnvEntries, writeEnvKey, deleteEnvKey } from '../config/envFile.js';
 import {
@@ -50,9 +51,11 @@ import {
   getProjectInfoCollection,
   upsertProjectInfo,
   deleteProjectInfo,
-  ObjectId,
   type ProjectInfo,
 } from '@bhooai/nexus-data';
+import { getUserStore } from './userStore.js';
+import { getAppFusion } from './fusionEngine.js';
+import { activeDatabase } from '../config/dbAccess.js';
 import { ROLE_CATALOG, findRole } from './roleCatalog.js';
 import { registerPreflightRoutes, aiHealthUrl } from './preflightModule.js';
 import { registerLintRoutes } from './lintModule.js';
@@ -140,7 +143,10 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   // Open the shared project-info connection so /admin/config, /admin/project
   // and the payment provider persistence can read/write the registry. Failure
   // is non-fatal — the affected endpoints degrade gracefully.
-  try { connectProjectInfo(config.db.uri); } catch { /* Mongo may be down */ }
+  // Skipped when mongodb is disabled (fusion-active backends).
+  if (mongoEnabled(config)) {
+    try { connectProjectInfo(mongoUri(config)); } catch { /* Mongo may be down */ }
+  }
 
   // ------------------------------------------------------------------
   // /admin/supervisor — report where `nexus dev`'s control API is bound so the
@@ -162,8 +168,8 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   // /admin/health/services — TCP probes for infra services
   // ------------------------------------------------------------------
   router.get('/admin/health/services', async (ctx) => {
-    const mongoHost = hostOf(config.db.uri, 'localhost');
-    const mongoPort = portOf(config.db.uri, 27017);
+    const mongoHost = hostOf(mongoUri(config), 'localhost');
+    const mongoPort = portOf(mongoUri(config), 27017);
     const redisHost = hostOf(config.redis.url, 'localhost');
     const redisPort = portOf(config.redis.url, 6379);
     const aiPort = portOf(config.ai.serverUrl, 8000);
@@ -185,12 +191,12 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   });
 
   // ------------------------------------------------------------------
-  // /admin/apps — registry + per-app /health probe
+  // /admin/apps — nexus.config.ts `apps[]` + per-app /health probe
   // ------------------------------------------------------------------
   router.get('/admin/apps', async (ctx) => {
-    const registry = await readRegistry(projectRoot);
+    const entries = (config.apps ?? []).filter((a) => a.enabled !== false);
     const apps = await Promise.all(
-      Object.entries(registry).map(async ([appName, port]) => {
+      entries.map(async ({ name: appName, port }) => {
         const kind = kindOf(appName);
         const probe = await probeHealth(port, kind);
         return {
@@ -219,6 +225,42 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
     ctx.json({ ok: true });
   });
 
+  // ------------------------------------------------------------------
+  // /admin/certs — TLS cert status + self-signed generation
+  // ------------------------------------------------------------------
+  router.get('/admin/certs/status', async (ctx) => {
+    try {
+      const { getCertStatus } = await import('../certs/generator.js');
+      ctx.json(await getCertStatus(projectRoot, config));
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
+  router.post('/admin/certs/generate', async (ctx) => {
+    const body = (ctx.body ?? {}) as { force?: unknown; keyType?: unknown; rsaModulus?: unknown; validityDays?: unknown; commonName?: unknown };
+    const force = body.force === true;
+    const keyType = body.keyType === 'ec' || body.keyType === 'rsa' ? (body.keyType as 'ec' | 'rsa') : undefined;
+    const rsaModulus = typeof body.rsaModulus === 'number' && Number.isFinite(body.rsaModulus) ? body.rsaModulus : undefined;
+    const validityDays = typeof body.validityDays === 'number' && Number.isFinite(body.validityDays) ? body.validityDays : undefined;
+    const commonName = typeof body.commonName === 'string' && body.commonName.trim() ? body.commonName.trim() : undefined;
+    try {
+      const { generateSelfSignedCerts, getCertStatus } = await import('../certs/generator.js');
+      const result = await generateSelfSignedCerts(projectRoot, config, { force, keyType, rsaModulus, validityDays, commonName });
+      // Persist the generated paths so the next boot can use them when https is toggled on
+      try {
+        await mergeRuntimeJson(projectRoot, { server: { certFile: result.certFile, keyFile: result.keyFile } });
+        // keep in-memory config in sync so status reflects new files without restart
+        (config.server as unknown as Record<string, unknown>).certFile = result.certFile;
+        (config.server as unknown as Record<string, unknown>).keyFile = result.keyFile;
+      } catch { /* non-fatal */ }
+      const status = await getCertStatus(projectRoot, config);
+      ctx.json({ ok: true, method: result.method, overwritten: result.overwritten, certFile: result.certFile, keyFile: result.keyFile, status });
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
   // ------------------------------------------------------------------
   // /admin/config — read-only, redacted (+ runtime overrides, config file, project)
   // ------------------------------------------------------------------
@@ -238,16 +280,11 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   });
 
   // ------------------------------------------------------------------
-  // /admin/users + /admin/payments — lazy Mongo
+  // /admin/users + /admin/payments — via the user store / orders collection
   // ------------------------------------------------------------------
   router.get('/admin/users', async (ctx) => {
-    const db = await lazy.db();
-    if (!db) {
-      ctx.json({ ok: false, reason: 'MongoDB not reachable' });
-      return;
-    }
     try {
-      const users = await db.collection('users').find({}).sort({ createdAt: -1 }).limit(200).toArray();
+      const users = await getUserStore().list(200);
       ctx.json({
         ok: true,
         users: users.map((u) => ({
@@ -266,24 +303,11 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   });
 
   router.get('/admin/payments', async (ctx) => {
-    const db = await lazy.db();
-    if (!db) {
-      ctx.json({ ok: false, reason: 'MongoDB not reachable' });
-      return;
-    }
     try {
-      const orders = await db.collection('orders').find({}).sort({ createdAt: -1 }).limit(50).toArray();
+      const orders = await listOrders(config, lazy, 50);
       ctx.json({
         ok: true,
-        orders: orders.map((o) => ({
-          id: String(o._id),
-          userId: o.userId,
-          provider: o.provider,
-          amount: o.amount,
-          currency: o.currency,
-          status: o.status,
-          createdAt: o.createdAt,
-        })),
+        orders,
         providers: providerStatus(config),
       });
     } catch (err) {
@@ -569,8 +593,6 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   });
 
   router.put('/admin/users/:id', async (ctx) => {
-    const db = await lazy.db();
-    if (!db) { ctx.json({ error: 'MongoDB not reachable' }, 503); return; }
     const body = (ctx.body ?? {}) as { roles?: unknown };
     const incoming = body.roles;
     if (!Array.isArray(incoming) || !incoming.length || incoming.some((r) => typeof r !== 'string')) {
@@ -585,24 +607,23 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
     }
 
     const id = String(ctx.params.id ?? '');
-    let oid: import('mongodb').ObjectId;
-    try { oid = new ObjectId(id); } catch { ctx.json({ error: 'invalid user id' }, 400); return; }
-    const target = await db.collection('users').findOne({ _id: oid });
+    if (!id) { ctx.json({ error: 'invalid user id' }, 400); return; }
+    const store = getUserStore();
+    const target = await store.findById(id);
     if (!target) { ctx.json({ error: 'user not found' }, 404); return; }
 
-    const currentRoles = (target.roles ?? []) as string[];
+    const currentRoles = target.roles ?? [];
     const isAdmin = currentRoles.includes('admin');
     const keepsAdmin = nextRoles.includes('admin');
     const caller = ctx.state.user as { id?: string; roles?: string[] } | undefined;
 
     if (isAdmin && !keepsAdmin) {
-      const adminCount = await db.collection('users').countDocuments({ roles: 'admin' });
+      const adminCount = await store.countAdmins();
       if (adminCount <= 1) { ctx.json({ error: 'cannot remove the last admin from the system' }, 400); return; }
       if (caller?.id === id) { ctx.json({ error: 'you cannot remove your own admin role' }, 400); return; }
     }
 
-    await db.collection('users').updateOne({ _id: oid }, { $set: { roles: nextRoles } });
-    const updated = await db.collection('users').findOne({ _id: oid });
+    const updated = await store.setRoles(id, nextRoles);
     ctx.json({ ok: true, user: updated });
   });
 
@@ -856,6 +877,163 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
     ctx.json({ series: { range: r, points } });
   });
 
+  // ------------------------------------------------------------------
+  // Uploads — search index admin (millions-scale)
+  // ------------------------------------------------------------------
+  router.get('/admin/uploads', async (ctx) => {
+    const q = typeof ctx.query.q === 'string' ? ctx.query.q.trim() : '';
+    const mime = typeof ctx.query.mime === 'string' ? ctx.query.mime.trim() : '';
+    const page = Math.max(1, parseInt(String(ctx.query.page ?? '1'), 10) || 1);
+    const limit = clampInt(ctx.query.limit, 50);
+    const sort = typeof ctx.query.sort === 'string' ? ctx.query.sort : 'recent';
+    const skip = (page - 1) * limit;
+    try {
+      const { getUploadModel } = await import('./Upload.js');
+      const M = getUploadModel();
+      if (!M) { ctx.json({ ok: false, reason: 'MongoDB not reachable' }, 503); return; }
+      const filter: Record<string, unknown> = {};
+      if (mime) filter.mime = mime;
+      let cursor: any;
+      let useText = false;
+      if (q) {
+        // Try text search first, fallback to regex if no index or no results
+        const textFilter = { ...filter, $text: { $search: q } };
+        const countText = await M.find(textFilter).countDocuments().catch(() => 0);
+        if (countText > 0) {
+          filter.$text = { $search: q };
+          useText = true;
+        } else {
+          const rx = new RegExp(q.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i');
+          filter.$or = [{ originalName: rx }, { sha256: rx }, { mime: rx }, { 'placements.dir': rx }, { 'placements.path': rx }];
+        }
+      }
+      const sortSpec: Record<string, 1 | -1> = sort === 'oldest' ? { createdAt: 1 } : sort === 'size' ? { size: -1 } : sort === 'name' ? { originalName: 1 } : { createdAt: -1 };
+      if (useText) (sortSpec as any).score = { $meta: 'textScore' } as any;
+      const docs = await M.find(filter).sort(sortSpec as any).skip(skip).limit(limit).exec().catch(async () => {
+        // Fallback if $text fails (no index)
+        const fallbackFilter: Record<string, unknown> = { ...filter };
+        if (fallbackFilter.$text) delete fallbackFilter.$text;
+        if (q && !fallbackFilter.$or) {
+          const rx = new RegExp(q.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i');
+          fallbackFilter.$or = [{ originalName: rx }, { sha256: rx }, { mime: rx }];
+        }
+        return M.find(fallbackFilter).sort({ createdAt: -1 }).skip(skip).limit(limit).exec();
+      });
+      const total = await M.countDocuments(filter).catch(() => docs.length);
+      ctx.json({
+        ok: true,
+        page,
+        limit,
+        total,
+        pages: Math.ceil(total / limit),
+        q,
+        mime,
+        sort,
+        uploads: docs.map((d: any) => {
+          const o = typeof d.toObject === 'function' ? d.toObject() : d;
+          const p = o.placements?.[0] ?? o.canonical;
+          return {
+            id: o.sha256,
+            sha256: o.sha256,
+            originalName: o.originalName,
+            mime: o.mime,
+            size: o.size,
+            width: o.width,
+            height: o.height,
+            disk: p?.disk ?? o.canonical?.disk,
+            path: p?.path ?? o.canonical?.path,
+            url: p?.url ?? o.canonical?.url,
+            canonical: o.canonical,
+            placements: o.placements,
+            placementsCount: o.placements?.length ?? 0,
+            variants: o.variants,
+            createdAt: o.createdAt,
+          };
+        }),
+      });
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
+  router.get('/admin/uploads/stats', async (ctx) => {
+    try {
+      const { getUploadModel } = await import('./Upload.js');
+      const M = getUploadModel();
+      if (!M) { ctx.json({ ok: false, reason: 'MongoDB not reachable' }, 503); return; }
+      const [total, totalSizeAgg, mimeAgg, recent] = await Promise.all([
+        M.countDocuments({}),
+        M.aggregate([{ $group: { _id: null, totalSize: { $sum: '$size' } } }]).catch(() => []),
+        M.aggregate([{ $group: { _id: '$mime', count: { $sum: 1 } } }, { $sort: { count: -1 } }, { $limit: 10 }]).catch(() => []),
+        M.find({}).sort({ createdAt: -1 }).limit(5).exec().catch(() => []),
+      ]);
+      const totalSize = (totalSizeAgg[0] as any)?.totalSize ?? 0;
+      ctx.json({
+        ok: true,
+        total,
+        totalSize,
+        mimeBreakdown: mimeAgg,
+        recent: (recent as any[]).map((d: any) => {
+          const o = typeof d.toObject === 'function' ? d.toObject() : d;
+          return { sha256: o.sha256, originalName: o.originalName, mime: o.mime, size: o.size, createdAt: o.createdAt };
+        }),
+      });
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
+  router.get('/admin/uploads/index', async (ctx) => {
+    try {
+      const { getUploadModel } = await import('./Upload.js');
+      const M = getUploadModel();
+      if (!M) { ctx.json({ ok: false, reason: 'MongoDB not reachable' }, 503); return; }
+      const coll = await (M as any).collection;
+      const indexes = await coll.indexes().catch(() => []);
+      const hasText = indexes.some((idx: any) => idx.name === 'uploads_text_idx');
+      const hasSha256 = indexes.some((idx: any) => idx.key?.sha256);
+      ctx.json({ ok: true, indexes, hasText, hasSha256, count: await M.countDocuments({}).catch(() => 0) });
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
+  router.post('/admin/uploads/index/rebuild', async (ctx) => {
+    try {
+      const { getUploadModel } = await import('./Upload.js');
+      const M = getUploadModel();
+      if (!M) { ctx.json({ ok: false, reason: 'MongoDB not reachable' }, 503); return; }
+      const coll = await (M as any).collection;
+      // Drop existing text index if present, then recreate all
+      try {
+        await coll.dropIndex('uploads_text_idx');
+      } catch {}
+      await (M as any).createIndexes().catch(() => {});
+      // Ensure text index
+      try {
+        await coll.createIndex({ originalName: 'text', mime: 'text', sha256: 'text', 'placements.dir': 'text' } as any, { name: 'uploads_text_idx', weights: { originalName: 10, sha256: 5, mime: 2 } } as any);
+      } catch {}
+      const indexes = await coll.indexes().catch(() => []);
+      ctx.json({ ok: true, indexes });
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
+  router.post('/admin/uploads/reindex', async (ctx) => {
+    // Alias for rebuild
+    try {
+      const { getUploadModel } = await import('./Upload.js');
+      const M = getUploadModel();
+      if (!M) { ctx.json({ ok: false, reason: 'MongoDB not reachable' }, 503); return; }
+      const coll = await (M as any).collection;
+      await (M as any).createIndexes().catch(() => {});
+      ctx.json({ ok: true, reindexed: true, count: await M.countDocuments({}).catch(() => 0) });
+    } catch (err) {
+      ctx.json({ ok: false, reason: String((err as Error).message) }, 500);
+    }
+  });
+
   // ------------------------------------------------------------------
   // Wire the rest of the admin surface modules (guarded via /admin).
   // ------------------------------------------------------------------
@@ -866,7 +1044,7 @@ export function registerAdminRoutes(router: Router, opts: AdminModuleOptions, lo
   });
   registerPreflightRoutes(router, config, { graphqlMounted: opts.graphqlMounted });
   registerLintRoutes(router, config, projectRoot);
-  registerDatabaseAdminRoutes(router, lazy);
+  registerDatabaseAdminRoutes(router, lazy, activeDatabase(config));
   registerAiSchemaRoutes(router, {
     serverUrl: config.ai.serverUrl,
     timeoutMs: config.ai.timeoutMs,
@@ -909,16 +1087,6 @@ async function probeHealth(port: number, kind: string): Promise<{ ok: boolean; u
   }
 }
 
-async function readRegistry(projectRoot: string): Promise<Record<string, number>> {
-  const p = resolve(projectRoot, '.nexus-ports.json');
-  if (!existsSync(p)) return {};
-  try {
-    return JSON.parse(await readFile(p, 'utf-8')) as Record<string, number>;
-  } catch {
-    return {};
-  }
-}
-
 function hostOf(uri: string, fallback: string): string {
   try {
     const u = new URL(uri);
@@ -978,15 +1146,51 @@ function providerEnvKey(providerId: string): string {
   return `NEXUS_AI_${providerId.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`;
 }
 
+/** Orders for /admin/payments — Fusion `orders` collection or legacy Mongo. */
+async function listOrders(
+  config: NexusConfig,
+  lazy: LazyDb,
+  limit: number,
+): Promise<Array<Record<string, unknown>>> {
+  if (activeDatabase(config) === 'fusion') {
+    const snap = await getAppFusion()
+      .collection<Record<string, unknown>>('orders')
+      .orderByField('createdAt', 'desc')
+      .limit(limit)
+      .get();
+    return snap.docs.map((d) => ({
+      id: d.id,
+      userId: d.data.userId,
+      provider: d.data.provider,
+      amount: d.data.amount,
+      currency: d.data.currency,
+      status: d.data.status,
+      createdAt: d.data.createdAt,
+    }));
+  }
+  const db = await lazy.db();
+  if (!db) throw new Error('MongoDB not reachable');
+  const orders = await db.collection('orders').find({}).sort({ createdAt: -1 }).limit(limit).toArray();
+  return orders.map((o) => ({
+    id: String(o._id),
+    userId: o.userId,
+    provider: o.provider,
+    amount: o.amount,
+    currency: o.currency,
+    status: o.status,
+    createdAt: o.createdAt,
+  }));
+}
+
 /** Convenience for wiring: create a lazy Mongo db resolver from a config. */
-export function createLazyDb(config: NexusConfig): LazyDb {
-  let cached: import('mongodb').Db | null | undefined;
+export function createLazyDb(config: NexusConfig): LazyDb {  let cached: import('mongodb').Db | null | undefined;
   return {
     async db() {
       if (cached !== undefined) return cached;
+      if (!mongoEnabled(config)) { cached = null; return null; }
       try {
         const { connect } = await import('@bhooai/nexus-data');
-        const connection = connect(config.db.uri, { maxPoolSize: 2 });
+        const connection = connect(mongoUri(config), { maxPoolSize: 2 });
         cached = await connection.db;
         return cached;
       } catch (err) {