@bhooai/nexus-core 2.0.13 → 2.0.15

package/src/app/userStore.ts

@@ -0,0 +1,321 @@
+import { randomUUID } from 'node:crypto';
+import type { FusionDatabase } from '@bhooai/nexus-fusion';
+import { ObjectId } from '@bhooai/nexus-data';
+import { ConflictError } from '../errors.js';
+import { initUserModel, getUserModel, findUserForLogin, type UserInstance } from './userModel.js';
+
+/**
+ * UserStore — persistence behind /auth/*, account admin and OAuth linking.
+ *
+ * Two implementations: MongoUserStore (the original Mongoose-backed logic,
+ * default) and FusionUserStore (embedded engine, selected with
+ * `db.active: 'fusion'`). Callers see plain lean-shaped records.
+ */
+
+export interface OAuthIdentity {
+  provider: string;
+  providerUserId: string;
+}
+
+export interface StoredUser {
+  _id: unknown;
+  email: string;
+  name?: string;
+  passwordHash?: string;
+  roles: string[];
+  emailVerified: boolean;
+  oauthAccounts: OAuthIdentity[];
+  createdAt?: unknown;
+  updatedAt?: unknown;
+}
+
+export interface NewUser {
+  email: string;
+  name?: string;
+  passwordHash?: string;
+  roles: string[];
+  emailVerified?: boolean;
+  oauthAccounts?: OAuthIdentity[];
+}
+
+export interface UserStore {
+  findByEmail(email: string): Promise<StoredUser | null>;
+  findForLogin(email: string): Promise<StoredUser | null>;
+  findById(id: string): Promise<StoredUser | null>;
+  findPasswordHash(id: string): Promise<string | undefined>;
+  create(input: NewUser): Promise<StoredUser>;
+  setName(id: string, name: string): Promise<StoredUser | null>;
+  setPassword(id: string, passwordHash: string): Promise<void>;
+  setRoles(id: string, roles: string[]): Promise<StoredUser | null>;
+  count(): Promise<number>;
+  countAdmins(): Promise<number>;
+  list(limit: number): Promise<StoredUser[]>;
+  findOAuthUser(provider: string, providerUserId: string): Promise<StoredUser | null>;
+  linkOAuth(userId: string, provider: string, providerUserId: string): Promise<StoredUser | null>;
+}
+
+const EMAIL_RE = /.+@.+\..+/;
+
+function normalizeEmail(email: string): string {
+  return String(email).toLowerCase();
+}
+
+/* ─── Mongo implementation (original behavior, moved verbatim) ─── */
+
+export class MongoUserStore implements UserStore {
+  async findByEmail(email: string): Promise<StoredUser | null> {
+    const User = getUserModel();
+    return (await User.findOne({ email: normalizeEmail(email) }).lean()) as unknown as StoredUser | null;
+  }
+
+  async findForLogin(email: string): Promise<StoredUser | null> {
+    const user = await findUserForLogin(email);
+    return user as unknown as StoredUser | null;
+  }
+
+  async findById(id: string): Promise<StoredUser | null> {
+    const User = getUserModel();
+    return (await User.findById(id).lean()) as unknown as StoredUser | null;
+  }
+
+  async findPasswordHash(id: string): Promise<string | undefined> {
+    const User = getUserModel();
+    const coll = await User.collection;
+    const raw = (await coll.findOne({ _id: new ObjectId(id) })) as unknown as Record<string, unknown> | null;
+    return raw?.passwordHash as string | undefined;
+  }
+
+  async create(input: NewUser): Promise<StoredUser> {
+    const User = getUserModel();
+    const [user] = await User.create({ ...input, email: normalizeEmail(input.email) });
+    return user as unknown as StoredUser;
+  }
+
+  async setName(id: string, name: string): Promise<StoredUser | null> {
+    const User = getUserModel();
+    await User.updateOne({ _id: id }, { $set: { name } });
+    return this.findById(id);
+  }
+
+  async setPassword(id: string, passwordHash: string): Promise<void> {
+    const User = getUserModel();
+    await User.updateOne({ _id: id }, { $set: { passwordHash } });
+  }
+
+  async setRoles(id: string, roles: string[]): Promise<StoredUser | null> {
+    const User = getUserModel();
+    await User.updateOne({ _id: id }, { $set: { roles } });
+    return this.findById(id);
+  }
+
+  async count(): Promise<number> {
+    return getUserModel().countDocuments();
+  }
+
+  async countAdmins(): Promise<number> {
+    const User = getUserModel();
+    const coll = await User.collection;
+    return coll.countDocuments({ roles: 'admin' });
+  }
+
+  async list(limit: number): Promise<StoredUser[]> {
+    const User = getUserModel();
+    const coll = await User.collection;
+    const rows = await coll.find({}).sort({ createdAt: -1 }).limit(limit).toArray();
+    return rows as unknown as StoredUser[];
+  }
+
+  async findOAuthUser(provider: string, providerUserId: string): Promise<StoredUser | null> {
+    const User = getUserModel();
+    const coll = await User.collection;
+    const existing = (await coll.findOne({
+      oauthAccounts: { $elemMatch: { provider, providerUserId } },
+    })) as unknown as Record<string, unknown> | null;
+    if (!existing) return null;
+    return User.hydrate(existing) as unknown as StoredUser;
+  }
+
+  async linkOAuth(userId: string, provider: string, providerUserId: string): Promise<StoredUser | null> {
+    const User = getUserModel();
+    await User.updateOne({ _id: userId }, {
+      $addToSet: { oauthAccounts: { provider, providerUserId } },
+    });
+    return this.findById(userId);
+  }
+}
+
+/* ─── Fusion implementation ─── */
+
+interface FusionUserData {
+  id: string;
+  email: string;
+  name?: string;
+  passwordHash?: string;
+  roles: string[];
+  emailVerified: boolean;
+  oauthAccounts: OAuthIdentity[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+const USERS = 'users';
+const OAUTH_LINKS = 'oauth_links';
+
+/** doc.get() throws when the collection doesn't exist yet — map that to null. */
+async function getDocOrNull<T>(ref: { get(): Promise<{ id: string; data: T } | null> }): Promise<{ id: string; data: T } | null> {
+  try {
+    return await ref.get();
+  } catch (err) {
+    if (err instanceof Error && /path not found/i.test(err.message)) return null;
+    throw err;
+  }
+}
+
+/** Query paths throw on missing collections too — treat as empty. */
+function hasCollection(db: FusionDatabase, name: string): boolean {
+  try {
+    return db.listCollections().includes(name);
+  } catch {
+    return false;
+  }
+}
+
+export class FusionUserStore implements UserStore {
+  constructor(private db: FusionDatabase) {}
+
+  private toStored(data: FusionUserData): StoredUser {
+    return { _id: data.id, ...data };
+  }
+
+  async findByEmail(email: string): Promise<StoredUser | null> {
+    const doc = await getDocOrNull(this.db.collection<FusionUserData>(USERS).doc(normalizeEmail(email)));
+    return doc ? this.toStored(doc.data) : null;
+  }
+
+  async findForLogin(email: string): Promise<StoredUser | null> {
+    return this.findByEmail(email);
+  }
+
+  async findById(id: string): Promise<StoredUser | null> {
+    if (!hasCollection(this.db, USERS)) return null;
+    const snap = await this.db.collection<FusionUserData>(USERS).where('id', '==', id).limit(1).get();
+    const hit = snap.docs[0];
+    return hit ? this.toStored(hit.data) : null;
+  }
+
+  async findPasswordHash(id: string): Promise<string | undefined> {
+    return (await this.findById(id))?.passwordHash;
+  }
+
+  async create(input: NewUser): Promise<StoredUser> {
+    const email = normalizeEmail(input.email);
+    if (!EMAIL_RE.test(email)) throw new ConflictError('Invalid email address');
+    const exists = await getDocOrNull(this.db.collection(USERS).doc(email));
+    if (exists) throw new ConflictError('A user with that email already exists');
+    const now = new Date().toISOString();
+    const data: FusionUserData = {
+      id: randomUUID(),
+      email,
+      ...(input.name !== undefined ? { name: input.name } : {}),
+      ...(input.passwordHash !== undefined ? { passwordHash: input.passwordHash } : {}),
+      roles: input.roles.length > 0 ? input.roles : ['user'],
+      emailVerified: input.emailVerified ?? false,
+      oauthAccounts: input.oauthAccounts ?? [],
+      createdAt: now,
+      updatedAt: now,
+    };
+    await this.db.collection(USERS).doc(email).set(data as unknown as Record<string, unknown>);
+    for (const o of data.oauthAccounts) {
+      await this.db.collection(OAUTH_LINKS).doc(`${o.provider}:${o.providerUserId}`).set({ userId: data.id });
+    }
+    return this.toStored(data);
+  }
+
+  private async updateById(id: string, patch: Partial<FusionUserData>): Promise<StoredUser | null> {
+    const current = await this.findById(id);
+    if (!current) return null;
+    const email = normalizeEmail(String((current as StoredUser & { email: string }).email));
+    const updated = await this.db
+      .collection<FusionUserData>(USERS)
+      .doc(email)
+      .update({ ...patch, updatedAt: new Date().toISOString() } as unknown as Record<string, unknown>);
+    return this.toStored(updated.data);
+  }
+
+  async setName(id: string, name: string): Promise<StoredUser | null> {
+    return this.updateById(id, { name });
+  }
+
+  async setPassword(id: string, passwordHash: string): Promise<void> {
+    await this.updateById(id, { passwordHash });
+  }
+
+  async setRoles(id: string, roles: string[]): Promise<StoredUser | null> {
+    return this.updateById(id, { roles });
+  }
+
+  async count(): Promise<number> {
+    if (!hasCollection(this.db, USERS)) return 0;
+    const snap = await this.db.collection(USERS).get();
+    return snap.size;
+  }
+
+  async countAdmins(): Promise<number> {
+    // No array-contains op in the query compiler — filter the (small) users table.
+    if (!hasCollection(this.db, USERS)) return 0;
+    const snap = await this.db.collection<FusionUserData>(USERS).get();
+    return snap.docs.filter((d) => (d.data.roles ?? []).includes('admin')).length;
+  }
+
+  async list(limit: number): Promise<StoredUser[]> {
+    if (!hasCollection(this.db, USERS)) return [];
+    const snap = await this.db
+      .collection<FusionUserData>(USERS)
+      .orderByField('createdAt', 'desc')
+      .limit(limit)
+      .get();
+    return snap.docs.map((d) => this.toStored(d.data));
+  }
+
+  async findOAuthUser(provider: string, providerUserId: string): Promise<StoredUser | null> {
+    const link = await getDocOrNull(
+      this.db.collection<{ userId: string }>(OAUTH_LINKS).doc(`${provider}:${providerUserId}`),
+    );
+    if (!link) return null;
+    return this.findById(link.data.userId);
+  }
+
+  async linkOAuth(userId: string, provider: string, providerUserId: string): Promise<StoredUser | null> {
+    const current = await this.findById(userId);
+    if (!current) return null;
+    const seen = new Set(current.oauthAccounts.map((o) => `${o.provider}:${o.providerUserId}`));
+    const key = `${provider}:${providerUserId}`;
+    if (!seen.has(key)) {
+      await this.updateById(userId, {
+        oauthAccounts: [...current.oauthAccounts, { provider, providerUserId }],
+      });
+    }
+    await this.db.collection(OAUTH_LINKS).doc(key).set({ userId });
+    return this.findById(userId);
+  }
+}
+
+/* ─── Singleton (mirrors initUserModel/getUserModel lifecycle) ─── */
+
+let store: UserStore | undefined;
+
+export function initUserStore(s: UserStore): UserStore {
+  store = s;
+  return store;
+}
+
+/** Lazily fall back to the Mongo store so direct registerAuthRoutes() users keep working. */
+export function getUserStore(): UserStore {
+  if (!store) {
+    initUserModel();
+    store = new MongoUserStore();
+  }
+  return store;
+}
+
+export type { UserInstance };

package/src/config/dbAccess.ts

@@ -0,0 +1,26 @@
+import type { NexusConfig, ActiveDatabase } from './types.js';
+
+/**
+ * Database accessors — read the normalized `db` block (see schema.ts, which
+ * maps the legacy flat `{ uri, … }` shape into `mongodb.*` at load).
+ */
+
+export function activeDatabase(config: NexusConfig): ActiveDatabase {
+  return config.db.active;
+}
+
+export function mongoEnabled(config: NexusConfig): boolean {
+  return config.db.mongodb.enabled;
+}
+
+export function mongoUri(config: NexusConfig): string {
+  return config.db.mongodb.uri;
+}
+
+export function fusionEnabled(config: NexusConfig): boolean {
+  return config.db.fusion.enabled;
+}
+
+export function fusionDir(config: NexusConfig): string {
+  return config.db.fusion.dir;
+}

package/src/config/defaults.ts

@@ -8,7 +8,7 @@ export const defaults: NexusConfig = {
   env: 'development',
   server: {
     port: 4000,
-    host: '127.0.0.1',
+    host: 'localhost',
     https: false,
     trustProxy: false,
      bodyLimit: 12 * 1024 * 1024, // 12 MiB, allowing a 10 MiB upload plus multipart overhead
@@ -21,9 +21,21 @@ export const defaults: NexusConfig = {
     allowedTypes: [],
   },
   db: {
-    uri: 'mongodb://localhost:27017/nexus',
-    maxPoolSize: 10,
-    autoIndex: true,
+    active: 'mongodb',
+    mongodb: {
+      enabled: true,
+      uri: 'mongodb://localhost:27017/nexus',
+      maxPoolSize: 10,
+      autoIndex: true,
+    },
+    fusion: {
+      enabled: false,
+      dir: 'storage/fusion',
+      persist: true,
+      cacheCapacity: 10_000,
+      cacheTtlMs: 5_000,
+      walCompactThreshold: 1_000,
+    },
   },
   redis: {
     url: 'redis://localhost:6379',
@@ -91,6 +103,7 @@ export const defaults: NexusConfig = {
     timeoutMs: 60_000,
     defaultProvider: 'ollama',
     schemaModel: 'llama3.1:8b',
+    embedModel: 'qwen3-embedding:4b',
     providers: [
       { id: 'ollama', label: 'Ollama (local)', baseUrl: 'http://localhost:11434', enabled: true, defaultModel: 'llama3.1:8b' },
       { id: 'openai', label: 'OpenAI', baseUrl: 'https://api.openai.com/v1', enabled: false, defaultModel: 'gpt-4o-mini' },
@@ -136,4 +149,21 @@ export const defaults: NexusConfig = {
     host: 'localhost',
     enabled: true,
   },
+  fusion: {
+    dir: 'storage/fusion',
+    persist: true,
+    cacheCapacity: 10_000,
+    cacheTtlMs: 5_000,
+    walCompactThreshold: 1_000,
+  },
+  cache: {
+    dir: 'storage/fusion/cache',
+    persist: true,
+    cacheCapacity: 10_000,
+    cacheTtlMs: 5_000,
+    walCompactThreshold: 1_000,
+    db: 'cache',
+    branch: 'prod',
+  },
+  apps: [],
 };

package/src/config/index.ts

@@ -3,4 +3,5 @@ export * from './defaults.js';
 export * from './merge.js';
 export * from './env.js';
 export * from './schema.js';
+export * from './dbAccess.js';
 export * from './ConfigLoader.js';

package/src/config/schema.ts

@@ -27,12 +27,55 @@ export const nexusConfigSchema = z.object({
     maxFiles: z.number().int().positive(),
     allowedTypes: z.array(z.string()),
   }),
-  db: z.object({
-    uri: z.string().min(1),
-    name: z.string().optional(),
-    maxPoolSize: z.number().int().positive(),
-    autoIndex: z.boolean(),
-  }),
+  db: z
+    .object({
+      active: z.enum(['mongodb', 'fusion']).default('mongodb'),
+      mongodb: z
+        .object({
+          enabled: z.boolean().default(true),
+          uri: z.string().min(1),
+          name: z.string().optional(),
+          maxPoolSize: z.number().int().positive(),
+          autoIndex: z.boolean(),
+        })
+        .default({
+          enabled: true,
+          uri: 'mongodb://localhost:27017/nexus',
+          maxPoolSize: 10,
+          autoIndex: true,
+        }),
+      fusion: z
+        .object({
+          enabled: z.boolean().default(false),
+          dir: z.string().min(1),
+          persist: z.boolean().default(true),
+          cacheCapacity: z.number().int().positive(),
+          cacheTtlMs: z.number().int().positive(),
+          walCompactThreshold: z.number().int().positive(),
+        })
+        .default({
+          enabled: false,
+          dir: 'storage/fusion',
+          persist: true,
+          cacheCapacity: 10_000,
+          cacheTtlMs: 5_000,
+          walCompactThreshold: 1_000,
+        }),
+      // Legacy flat shape — mapped into mongodb.* below.
+      uri: z.string().min(1).optional(),
+      name: z.string().optional(),
+      maxPoolSize: z.number().int().positive().optional(),
+      autoIndex: z.boolean().optional(),
+    })
+    .transform((v) => {
+      const mongodb = { ...v.mongodb };
+      if (v.uri !== undefined) mongodb.uri = v.uri;
+      if (v.name !== undefined) mongodb.name = v.name;
+      if (v.maxPoolSize !== undefined) mongodb.maxPoolSize = v.maxPoolSize;
+      if (v.autoIndex !== undefined) mongodb.autoIndex = v.autoIndex;
+      const { uri: _u, name: _n, maxPoolSize: _m, autoIndex: _a, ...rest } = v;
+      return { ...rest, mongodb };
+    }),
   redis: z.object({ url: z.string().min(1), keyPrefix: z.string() }),
   graphql: z.object({
     path: z.string().min(1),
@@ -124,6 +167,7 @@ export const nexusConfigSchema = z.object({
     timeoutMs: z.number().int().positive(),
     defaultProvider: z.enum(['openai', 'ollama', 'auto']),
     schemaModel: z.string().min(1).optional(),
+    embedModel: z.string().min(1).optional(),
     providers: z.array(z.object({
       id: z.string().min(1),
       label: z.string().min(1),
@@ -157,6 +201,28 @@ export const nexusConfigSchema = z.object({
     host: z.string().min(1),
     enabled: z.boolean(),
   }),
+  fusion: z.object({
+    dir: z.string().min(1).default('storage/fusion'),
+    persist: z.boolean().default(true),
+    cacheCapacity: z.number().int().positive().default(10_000),
+    cacheTtlMs: z.number().int().positive().default(5_000),
+    walCompactThreshold: z.number().int().positive().default(1_000),
+  }),
+  cache: z.object({
+    dir: z.string().min(1).default('storage/fusion/cache'),
+    persist: z.boolean().default(true),
+    cacheCapacity: z.number().int().positive().default(10_000),
+    cacheTtlMs: z.number().int().positive().default(5_000),
+    walCompactThreshold: z.number().int().positive().default(1_000),
+    db: z.string().min(1).default('cache'),
+    branch: z.string().min(1).default('prod'),
+  }),
+  /** Multi-app port layout (replaces `.nexus-ports.json`). */
+  apps: z.array(z.object({
+    name: z.string().min(1),
+    port: z.number().int().min(1).max(65535),
+    enabled: z.boolean().optional(),
+  })).default([]),
 });
 
 export type ValidatedNexusConfig = z.infer<typeof nexusConfigSchema>;

package/src/config/types.ts

@@ -35,7 +35,11 @@ export interface UploadsConfig {
   allowedTypes: string[];
 }
 
-export interface DbConfig {
+export type ActiveDatabase = 'mongodb' | 'fusion';
+
+export interface MongoDbConfig {
+  /** Connect to MongoDB at boot when true. Default true. */
+  enabled: boolean;
   uri: string;
   /** Database name override; otherwise taken from the URI. */
   name?: string;
@@ -45,6 +49,37 @@ export interface DbConfig {
   autoIndex: boolean;
 }
 
+export interface FusionDbConfig {
+  /** Open the Fusion engine at boot when true. Default false. */
+  enabled: boolean;
+  /** Durable storage dir, relative to the project root. Omit/empty for in-memory. */
+  dir: string;
+  /** Persist the WAL to `dir` (persist=false runs purely in-memory). */
+  persist: boolean;
+  /** L1 cache capacity (entries). */
+  cacheCapacity: number;
+  /** L1 cache TTL in ms. */
+  cacheTtlMs: number;
+  /** WAL compaction threshold (records). */
+  walCompactThreshold: number;
+}
+
+export interface DbConfig {
+  /** Which database backs the user store + ODM models. Default 'mongodb'. */
+  active: ActiveDatabase;
+  mongodb: MongoDbConfig;
+  fusion: FusionDbConfig;
+  /** @deprecated Legacy flat shape — `{ uri, name?, maxPoolSize, autoIndex }`.
+   *  Still accepted in nexus.config.ts and mapped into `mongodb.*` at load. */
+  uri?: string;
+  /** @deprecated See `uri`. Mapped into `mongodb.name`. */
+  name?: string;
+  /** @deprecated See `uri`. Mapped into `mongodb.maxPoolSize`. */
+  maxPoolSize?: number;
+  /** @deprecated See `uri`. Mapped into `mongodb.autoIndex`. */
+  autoIndex?: boolean;
+}
+
 export interface RedisConfig {
   url: string;
   /** Key prefix for namespacing. */
@@ -197,6 +232,8 @@ export interface AiConfig {
   defaultProvider: 'openai' | 'ollama' | 'auto';
   /** Model used by the admin AI schema generator (e.g. "gpt-4o-mini"). */
   schemaModel: string;
+  /** Embedding model for semantic search (e.g. "qwen3-embedding:4b"). Optional — defaults in code. */
+  embedModel?: string;
   /** Configured AI providers with API keys + enable state. Optional —
    *  defaults are provided in code. */
   providers?: AiProviderConfig[];
@@ -248,6 +285,58 @@ export interface AdminConfig {
   enabled: boolean;
 }
 
+/**
+ * One entry in the multi-app port layout.
+ *
+ * `apps` is the single source of truth for every dev-service port and fully
+ * replaces the legacy `.nexus-ports.json` registry. `name` is the service /
+ * app directory name (`backend`, `backend-shop`, `frontend`, `admin`,
+ * `ai-server`, `pyserver`, `fusion`, …). `server` / `frontend` / `admin`
+ * stay the single-app defaults; `apps` entries override them by name.
+ */
+export interface AppPortConfig {
+  /** Service / app name, e.g. 'backend', 'backend-shop', 'frontend', 'admin', 'ai-server', 'pyserver', 'fusion'. */
+  name: string;
+  /** Canonical configured port for this app. */
+  port: number;
+  /** Participate in `nexus dev` startup. Defaults to true. */
+  enabled?: boolean;
+}
+
+export interface FusionConfig {
+  /** Durable storage dir, resolved against the backend's projectRoot. Empty or
+   *  persist=false runs the engine purely in-memory. Default 'storage/fusion'. */
+  dir: string;
+  /** When false, ignore `dir` and run purely in-memory. Default true. */
+  persist: boolean;
+  /** L1 cache capacity (entries). Default 10_000. */
+  cacheCapacity: number;
+  /** L1 cache TTL in ms. Default 5_000. */
+  cacheTtlMs: number;
+  /** WAL compaction threshold (records). Default 1_000. */
+  walCompactThreshold: number;
+}
+
+/** Redis-like FusionCache settings (`@bhooai/nexus-fusion/cache`). */
+export interface CacheConfig {
+  /** Durable storage dir, resolved against the backend's projectRoot. Cache
+   *  lives in its own subdir (default 'storage/fusion/cache') so it never
+   *  shares a WAL with the main fusion engine. */
+  dir: string;
+  /** When false, run purely in-memory (volatile, like a non-persistent Redis).
+   *  Default true. */
+  persist: boolean;
+  /** Engine L1 cache capacity (entries). Default 10_000. */
+  cacheCapacity: number;
+  /** Engine L1 cache TTL in ms. Default 5_000. */
+  cacheTtlMs: number;
+  /** WAL compaction threshold (records). Default 1_000. */
+  walCompactThreshold: number;
+  /** Database/branch namespaces. Defaults db='cache', branch='prod'. */
+  db: string;
+  branch: string;
+}
+
 export interface NexusConfig {
   env: Env;
   server: ServerConfig;
@@ -267,6 +356,10 @@ export interface NexusConfig {
   plugins: PluginsConfig;
   frontend: FrontendConfig;
   admin: AdminConfig;
+  fusion: FusionConfig;
+  cache: CacheConfig;
+  /** Multi-app port layout. Empty = every service uses its section default. */
+  apps: AppPortConfig[];
 }
 
 /** Deep partial used for user config files and runtime overrides. */