@bhooai/nexus-core 2.0.4 → 2.0.6

package/src/app/userModel.ts

@@ -0,0 +1,101 @@
+/**
+ * User model — framework-provided Mongo-backed User schema.
+ *
+ * Registered via `initUserModel()` once a connection exists (the app boot
+ * flow calls `connect()` from `@bhooai/nexus-data` first). `passwordHash` is
+ * `select: false`, so it is excluded from normal queries; `findUserForLogin`
+ * uses the raw driver lookup to fetch it explicitly.
+ */
+import { Schema, model, type DocumentInstance, type Model, type ObjectId } from '@bhooai/nexus-data';
+
+export interface UserDoc {
+  _id?: ObjectId;
+  email: string;
+  passwordHash?: string;
+  name?: string;
+  roles: string[];
+  emailVerified: boolean;
+  /** Linked OAuth identities (for account linking). */
+  oauthAccounts: Array<{ provider: string; providerUserId: string }>;
+  createdAt?: Date;
+  updatedAt?: Date;
+}
+
+export type UserInstance = DocumentInstance & UserDoc;
+export type UserModel = Model<UserInstance>;
+
+export const userSchema = new Schema<UserDoc>(
+  {
+    email: {
+      type: String,
+      required: true,
+      unique: true,
+      match: /.+@.+\..+/,
+      transform: (v: unknown) => String(v).toLowerCase(),
+    },
+    passwordHash: { type: String, select: false },
+    name: { type: String },
+    roles: { type: [String], default: () => ['user'] },
+    emailVerified: { type: Boolean, default: false },
+    oauthAccounts: { type: Array, default: () => [] },
+  },
+  { timestamps: true, collection: 'users' },
+);
+
+let User: UserModel | undefined;
+
+/** Register the User model on the default connection (call after `connect()`). */
+export function initUserModel(): UserModel {
+  if (User) return User;
+  User = model<UserInstance>('User', userSchema);
+  return User;
+}
+
+export function getUserModel(): UserModel {
+  if (!User) throw new Error('User model not initialized — call initUserModel() after connect().');
+  return User;
+}
+
+/** Fetch a user by email INCLUDING the select:false passwordHash (raw driver lookup). */
+export async function findUserForLogin(email: string): Promise<UserInstance | null> {
+  const User = getUserModel();
+  const coll = await User.collection;
+  const raw = await coll.findOne({ email: String(email).toLowerCase() });
+  return raw ? (User.hydrate(raw as Record<string, unknown>) as UserInstance) : null;
+}
+
+/** Find-or-create a user from an OAuth profile (account linking by provider+id). */
+export async function upsertOAuthUser(profile: {
+  provider: string;
+  providerUserId: string;
+  email?: string;
+  name?: string;
+}): Promise<UserInstance> {
+  const User = getUserModel();
+  const coll = await User.collection;
+  const existing = await coll.findOne({
+    oauthAccounts: { $elemMatch: { provider: profile.provider, providerUserId: profile.providerUserId } },
+  });
+  if (existing) return User.hydrate(existing as Record<string, unknown>) as UserInstance;
+
+  // Link to an existing email account if present, else create a new one.
+  if (profile.email) {
+    const byEmail = await coll.findOne({ email: profile.email.toLowerCase() });
+    if (byEmail) {
+      await User.updateOne({ _id: byEmail._id }, {
+        $addToSet: { oauthAccounts: { provider: profile.provider, providerUserId: profile.providerUserId } },
+      });
+      const refreshed = await coll.findOne({ _id: byEmail._id });
+      if (refreshed) return User.hydrate(refreshed as Record<string, unknown>) as UserInstance;
+    }
+  }
+
+  const [created] = await User.create({
+    email: profile.email ?? `${profile.provider}-${profile.providerUserId}@oauth.local`,
+    name: profile.name,
+    emailVerified: true,
+    oauthAccounts: [{ provider: profile.provider, providerUserId: profile.providerUserId }],
+    roles: ['user'],
+  });
+  return created as UserInstance;
+}

package/src/config/runtimeJson.ts

@@ -39,9 +39,32 @@ export async function writeRuntimeJson(projectRoot: string, data: Record<string,
   }
 }
 
+/**
+ * Recursively drop any value that equals the redaction mask (••••••••).
+ * The admin config editor round-trips masked values from GET /admin/config,
+ * so without this guard a redacted secret/cookie-name would be persisted as a
+ * literal placeholder — e.g. auth.refreshCookieName = "••••••••", which then
+ * breaks Set-Cookie writing ("Invalid character in header content").
+ */
+export function stripRedactionMask<T>(value: T): T | undefined {
+  if (typeof value === 'string') return (value === '••••••••' ? undefined : value) as T;
+  if (Array.isArray(value)) {
+    return value.map(stripRedactionMask).filter((v) => v !== undefined) as T;
+  }
+  if (value && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      const clean = stripRedactionMask(v);
+      if (clean !== undefined) out[k] = clean;
+    }
+    return out as T;
+  }
+  return value;
+}
+
 /**
  * Merge a partial update into the runtime JSON (deep merge on `ai.providers`,
- * shallow merge everywhere else).
+ * shallow merge everywhere else). Masked placeholders are never written back.
  */
 export async function mergeRuntimeJson(projectRoot: string, patch: Record<string, unknown>): Promise<void> {
   const existing = await readRuntimeJson(projectRoot);
@@ -51,5 +74,5 @@ export async function mergeRuntimeJson(projectRoot: string, patch: Record<string
   if (patch.ai && typeof patch.ai === 'object' && existing.ai && typeof existing.ai === 'object') {
     merged.ai = { ...(existing as { ai: Record<string, unknown> }).ai, ...(patch.ai as Record<string, unknown>) };
   }
-  await writeRuntimeJson(projectRoot, merged);
+  await writeRuntimeJson(projectRoot, stripRedactionMask(merged) as Record<string, unknown>);
 }