@c9up/station 0.1.15 → 0.1.16

package/dist/StationProvider.d.ts

@@ -19,7 +19,8 @@
  */
 import "./augmentations.js";
 import type { ColumnMetadata } from "@c9up/atlas";
-import type { Resource } from "./types.js";
+import { type StationLoginRateLimitConfig } from "./loginLimiter.js";
+import type { Resource, SecurityAuditSink } from "./types.js";
 /**
  * Duck-typed slice of the host's IoC container — Station MUST stay
  * publishable without importing `@c9up/ream` directly (memory
@@ -99,11 +100,23 @@ export interface StationConfig {
      */
     requireAuth?: boolean;
     /**
-     * Role required to pass the auth gate. When omitted, any
-     * authenticated user can access `/admin/*` (the per-action
-     * `<resource>.<action>` permission gate still applies).
+     * Role required to pass the auth gate, on top of {@link accessPermission}.
      */
     requireRole?: string;
+    /**
+     * Namespace of every admin permission: actions are gated behind
+     * `<prefix>.<resource>.<action>` (e.g. `station.users.edit`) and entry
+     * behind `<prefix>.access`. Defaults to `"station"`, so a grant the
+     * application made for its own features (`users.edit`) never opens the
+     * admin.
+     */
+    permissionPrefix?: string;
+    /**
+     * Permission every request must hold to enter `/admin/*`, checked before
+     * the per-action one. Defaults to `<permissionPrefix>.access`. `false`
+     * removes this gate (the per-action permissions still apply).
+     */
+    accessPermission?: string | false;
     /**
      * Where to redirect on a failed auth check. Defaults to
      * `/admin/login`.
@@ -114,6 +127,29 @@ export interface StationConfig {
      * to avoid colliding with app-level session cookies.
      */
     cookieName?: string;
+    /**
+     * `Secure` flag of the auth cookie. Defaults to on everywhere except a
+     * development/test process served over plain HTTP, so an unknown
+     * environment behaves like production.
+     */
+    cookieSecure?: boolean;
+    /**
+     * Brute-force throttle on `POST /admin/login`: 5 attempts per IP and per
+     * identifier every 15 minutes by default, in this process's memory. Pass
+     * `limiter` (warden's `AuthRateLimiter` fits) to share counts across
+     * instances. `false` turns it off — only for an app that throttles the
+     * route itself (see {@link middleware}).
+     */
+    loginRateLimit?: StationLoginRateLimitConfig | false;
+    /** Named router middleware attached to every route Station mounts. */
+    middleware?: ReadonlyArray<string>;
+    /**
+     * Sink for the admin's security events: sign-in success, failure and
+     * throttling, logout, authorization denials and CSRF blocks, each with the
+     * client IP and request id. Write events keep going to each resource's
+     * own `audit`.
+     */
+    audit?: SecurityAuditSink;
 }
 /** @internal Reset module-level flags between tests. */
 export declare function resetStationProviderFlags(): void;
@@ -130,9 +166,9 @@ export declare function resourcesNeedValidation(resources: ReadonlyArray<Resourc
  * Derive a `@c9up/rune` validation schema (57.7) from an entity's writable
  * column metadata — the structural replacement for the hand-rolled
  * `filterWritableBody`. The mass-assignment guarantee is now INHERENT:
- * `schema.validateResult()` returns only declared-column keys, so unknown body keys
- * (`role`, `passwordHash`, PK, timestamps) are dropped automatically — no
- * explicit filtering pass.
+ * `schema.validateResult()` returns only the keys of the editable columns it
+ * was given, so any other body key — an unknown one, a column outside the
+ * allow-list, the PK, a timestamp — is dropped automatically.
  *
  * Excluded, exactly as the old guard did: the primary key, framework-managed
  * timestamps (both the Lucid-style `autoManaged` flag AND the `created_at /
@@ -153,10 +189,13 @@ export declare function resourcesNeedValidation(resources: ReadonlyArray<Resourc
  * Returns the built schema plus the set of boolean columns — the handler
  * default-fills an ABSENT boolean key to `false` before validating (an
  * unchecked checkbox submits nothing; this preserves the old edit-clears-box
- * behaviour).
+ * behaviour). `columns` is the editable allow-list; framework-owned columns
+ * are dropped here too, so no caller can make them writable. `updateSchema`
+ * differs only for `writeOnly` columns, which an edit may leave out.
  */
-export declare function deriveWritableSchema(columns: ReadonlyArray<ColumnMetadata>, pkColumn: string, autoManaged: ReadonlySet<string>, excludedProps: ReadonlySet<string>, rune: RuneModule): {
+export declare function deriveWritableSchema(columns: ReadonlyArray<ColumnMetadata>, pkColumn: string, autoManaged: ReadonlySet<string>, excludedProps: ReadonlySet<string>, rune: RuneModule, writeOnly?: ReadonlySet<string>): {
     schema: RuneSchema;
+    updateSchema: RuneSchema;
     booleanKeys: ReadonlySet<string>;
 };
 /**
@@ -165,9 +204,10 @@ export declare function deriveWritableSchema(columns: ReadonlyArray<ColumnMetada
  * preserving the old `filterWritableBody` checkbox semantics, then runs rune's
  * synchronous, never-throwing `validateResult()`. On success `result.data` holds only
  * declared-column keys (mass-assignment inherent). Exported for the unit tests
- * that pin the coercion CRUX.
+ * that pin the coercion CRUX. A blank `writeOnly` value counts as not
+ * submitted: the form never pre-fills those, so blank means "unchanged".
  */
-export declare function validateWritableBody(schema: RuneSchema, booleanKeys: ReadonlySet<string>, body: Record<string, unknown>): RuneValidationResult;
+export declare function validateWritableBody(schema: RuneSchema, booleanKeys: ReadonlySet<string>, body: Record<string, unknown>, writeOnly?: ReadonlySet<string>): RuneValidationResult;
 export default class StationProvider {
     #private;
     protected app: StationAppContext;

package/dist/StationProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StationProvider.d.ts","sourceRoot":"","sources":["../src/StationProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAEX,cAAc,EAGd,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAc,QAAQ,EAAkB,MAAM,YAAY,CAAC;AASvE;;;;GAIG;AACH,UAAU,gBAAgB;IACzB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACnD,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;CAC3B;AAED,UAAU,kBAAkB;IAC3B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,kBAAkB,CAAC;CAC3B;AA+LD,mEAAmE;AACnE,UAAU,aAAa;IACtB,QAAQ,IAAI,aAAa,CAAC;IAC1B,QAAQ,IAAI,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,aAAa,CAAC;CACtD;AAED,yEAAyE;AACzE,UAAU,SAAS;IAClB,MAAM,IAAI,aAAa,CAAC;IACxB,MAAM,IAAI,aAAa,CAAC;IACxB,OAAO,IAAI,aAAa,CAAC;IACzB,8FAA8F;IAC9F,GAAG,IAAI,aAAa,CAAC;CACrB;AAED,uCAAuC;AACvC,UAAU,mBAAmB;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uEAAuE;AACvE,KAAK,oBAAoB,GACtB;IACA,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B,GACD;IACA,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;CAChB,CAAC;AAEL;;;;;;;GAOG;AACH,UAAU,UAAU;IACnB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,oBAAoB,CAAC;CACpD;AAED,uEAAuE;AACvE,UAAU,UAAU;IACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,UAAU,CAAC;IAC1D,KAAK,EAAE,SAAS,CAAC;CACjB;AAyHD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAaD,wDAAwD;AACxD,wBAAgB,yBAAyB,IAAI,IAAI,CAMhD;AA+CD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACtC,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,GAChC,OAAO,CAIT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,IAAI,EAAE,UAAU,GACd;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,CAmC1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,oBAAoB,CAMtB;AAqND,MAAM,CAAC,OAAO,OAAO,eAAe;;IAyBvB,SAAS,CAAC,GAAG,EAAE,iBAAiB;gBAAtB,GAAG,EAAE,iBAAiB;IAE5C,QAAQ,IAAI,IAAI;IAWV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8F5B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsYtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAquB/B;AAkGD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAItD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAUzE"}
+{"version":3,"file":"StationProvider.d.ts","sourceRoot":"","sources":["../src/StationProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAEX,cAAc,EAGd,MAAM,aAAa,CAAC;AAQrB,OAAO,EAIN,KAAK,2BAA2B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAEX,QAAQ,EAGR,iBAAiB,EACjB,MAAM,YAAY,CAAC;AASpB;;;;GAIG;AACH,UAAU,gBAAgB;IACzB,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACnD,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;CAC3B;AAED,UAAU,kBAAkB;IAC3B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,kBAAkB,CAAC;CAC3B;AAqND,mEAAmE;AACnE,UAAU,aAAa;IACtB,QAAQ,IAAI,aAAa,CAAC;IAC1B,QAAQ,IAAI,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,aAAa,CAAC;CACtD;AAED,yEAAyE;AACzE,UAAU,SAAS;IAClB,MAAM,IAAI,aAAa,CAAC;IACxB,MAAM,IAAI,aAAa,CAAC;IACxB,OAAO,IAAI,aAAa,CAAC;IACzB,8FAA8F;IAC9F,GAAG,IAAI,aAAa,CAAC;CACrB;AAED,uCAAuC;AACvC,UAAU,mBAAmB;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uEAAuE;AACvE,KAAK,oBAAoB,GACtB;IACA,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B,GACD;IACA,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;CAChB,CAAC;AAEL;;;;;;;GAOG;AACH,UAAU,UAAU;IACnB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,oBAAoB,CAAC;CACpD;AAED,uEAAuE;AACvE,UAAU,UAAU;IACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,UAAU,CAAC;IAC1D,KAAK,EAAE,SAAS,CAAC;CACjB;AA+HD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;IACrD,sEAAsE;IACtE,UAAU,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAoBD,wDAAwD;AACxD,wBAAgB,yBAAyB,IAAI,IAAI,CAOhD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACtC,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,GAChC,OAAO,CAIT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,IAAI,EAAE,UAAU,EAChB,SAAS,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC;IACF,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACjC,CA4BA;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,oBAAoB,CAStB;AA4OD,MAAM,CAAC,OAAO,OAAO,eAAe;;IAgCvB,SAAS,CAAC,GAAG,EAAE,iBAAiB;gBAAtB,GAAG,EAAE,iBAAiB;IAE5C,QAAQ,IAAI,IAAI;IAWV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwG5B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyatB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA47B/B;AAiMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAItD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAUzE"}