@camstack/core 0.1.15 → 0.1.16

package/dist/chunk-3BK2Y7GY.mjs

@@ -1,593 +0,0 @@
-// src/builtins/local-auth/local-auth.addon.ts
-import { BaseAddon, authProviderCapability, userManagementCapability } from "@camstack/types";
-
-// src/auth/auth-manager.ts
-import * as jwt from "jsonwebtoken";
-import * as bcrypt from "bcryptjs";
-import * as crypto from "crypto";
-var noopLogger = {
-  debug() {
-  },
-  info() {
-  },
-  warn() {
-  },
-  error() {
-  },
-  child() {
-    return noopLogger;
-  },
-  withTags() {
-    return noopLogger;
-  }
-};
-var AuthManager = class {
-  constructor(config, logger = noopLogger) {
-    this.config = config;
-    this.logger = logger;
-    const configured = this.config.get("auth.jwtSecret");
-    if (configured) {
-      this.jwtSecret = configured;
-    } else {
-      const secret = crypto.randomBytes(32).toString("hex");
-      this.config.update("auth", { jwtSecret: secret });
-      this.logger.info("Generated JWT secret and saved to config.yaml (auth.jwtSecret)");
-      this.jwtSecret = secret;
-    }
-  }
-  config;
-  jwtSecret;
-  scopedTokenManager = null;
-  logger;
-  signToken(payload) {
-    return jwt.sign({ ...payload }, this.jwtSecret, { expiresIn: "24h" });
-  }
-  verifyToken(token) {
-    return jwt.verify(token, this.jwtSecret);
-  }
-  async hashPassword(password) {
-    return bcrypt.hash(password, 10);
-  }
-  async comparePassword(password, hash2) {
-    return bcrypt.compare(password, hash2);
-  }
-  generateApiKey() {
-    const token = crypto.randomBytes(32).toString("hex");
-    const hash2 = crypto.createHash("sha256").update(token).digest("hex");
-    const prefix = token.slice(0, 8);
-    return { token, hash: hash2, prefix };
-  }
-  validateApiKey(token, storedHash) {
-    const hash2 = crypto.createHash("sha256").update(token).digest("hex");
-    return hash2 === storedHash;
-  }
-  /**
-   * Create a service token for agent/worker authentication.
-   * Used when forking workers or when agents register.
-   */
-  createServiceToken(opts) {
-    const payload = {
-      userId: opts.agentId,
-      username: opts.agentId,
-      role: opts.role ?? "agent",
-      type: "service",
-      agentId: opts.agentId,
-      allowedProviders: "*",
-      allowedDevices: {}
-    };
-    const expiresIn = opts.expiresIn ?? "24h";
-    return jwt.sign(payload, this.jwtSecret, { expiresIn });
-  }
-  /**
-   * Set the scoped token manager for the auth chain.
-   */
-  setScopedTokenManager(manager) {
-    this.scopedTokenManager = manager;
-  }
-  /**
-   * Validate a scoped token string.
-   * Returns the token record if valid, null otherwise.
-   */
-  async validateScopedToken(rawToken) {
-    if (!this.scopedTokenManager) {
-      return null;
-    }
-    return this.scopedTokenManager.validate(rawToken);
-  }
-  /**
-   * Check whether a scoped token grants access to a given addon/route/capability.
-   */
-  matchesScopedTokenScope(token, addonId, routePath, capability) {
-    if (!this.scopedTokenManager) {
-      return false;
-    }
-    return this.scopedTokenManager.matchesScope(token, addonId, routePath, capability);
-  }
-};
-
-// src/auth/user-manager.ts
-import * as crypto2 from "crypto";
-import { UserRecordSchema } from "@camstack/types";
-
-// src/auth/parse-record.ts
-function parseRecord(kind, schema, data) {
-  try {
-    return schema.parse(data);
-  } catch (err) {
-    const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
-    const detail = err instanceof Error ? err.message : String(err);
-    const looksDoubleWrapped = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data;
-    const hint = looksDoubleWrapped ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/core build." : "";
-    throw new Error(
-      `Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`,
-      { cause: err }
-    );
-  }
-}
-
-// src/auth/user-manager.ts
-var USERS_COLLECTION = "users";
-function parseUser(data) {
-  return parseRecord("user", UserRecordSchema, data);
-}
-var UserManager = class {
-  constructor(storageAccess, auth, config) {
-    this.storageAccess = storageAccess;
-    this.auth = auth;
-    this.config = config;
-  }
-  storageAccess;
-  auth;
-  config;
-  get store() {
-    return this.storageAccess.getStore();
-  }
-  async create(input) {
-    const existing = await this.findByUsername(input.username);
-    if (existing) throw new Error(`User with username "${input.username}" already exists`);
-    const passwordHash = await this.auth.hashPassword(input.password);
-    const now = Date.now();
-    const record = {
-      id: crypto2.randomUUID(),
-      username: input.username,
-      passwordHash,
-      role: input.role,
-      allowedProviders: input.allowedProviders ?? "*",
-      allowedDevices: input.allowedDevices ?? {},
-      createdAt: now,
-      updatedAt: now
-    };
-    await this.store.insert.mutate({ collection: USERS_COLLECTION, record: { id: record.id, data: { ...record } } });
-    return record;
-  }
-  async findByUsername(username) {
-    const results = await this.store.query.query({ collection: USERS_COLLECTION, filter: { where: { username } } });
-    if (results.length === 0) return null;
-    return parseUser(results[0].data);
-  }
-  async findById(id) {
-    const results = await this.store.query.query({ collection: USERS_COLLECTION, filter: { where: { id } } });
-    if (results.length === 0) return null;
-    return parseUser(results[0].data);
-  }
-  async validateCredentials(username, password) {
-    const user = await this.findByUsername(username);
-    if (!user) return null;
-    const valid = await this.auth.comparePassword(password, user.passwordHash);
-    return valid ? user : null;
-  }
-  async listAll() {
-    const results = await this.store.query.query({ collection: USERS_COLLECTION });
-    return results.map((r) => {
-      const parsed = parseUser(r.data);
-      const { passwordHash: _ph, ...rest } = parsed;
-      return rest;
-    });
-  }
-  async update(id, data) {
-    const existing = await this.findById(id);
-    if (!existing) throw new Error(`User with id "${id}" not found`);
-    await this.store.update.mutate({ collection: USERS_COLLECTION, id, data: { ...existing, ...data, updatedAt: Date.now() } });
-  }
-  async delete(id) {
-    await this.store.delete.mutate({ collection: USERS_COLLECTION, key: id });
-  }
-  async resetPassword(id, newPassword) {
-    const existing = await this.findById(id);
-    if (!existing) throw new Error(`User with id "${id}" not found`);
-    const passwordHash = await this.auth.hashPassword(newPassword);
-    await this.store.update.mutate({ collection: USERS_COLLECTION, id, data: { ...existing, passwordHash, updatedAt: Date.now() } });
-  }
-  async ensureAdminExists() {
-    const adminUsername = this.config.get("auth.adminUsername");
-    const adminPassword = this.config.get("auth.adminPassword");
-    if (!adminUsername || !adminPassword) return;
-    const existing = await this.findByUsername(adminUsername);
-    if (existing) {
-      const matches = await this.auth.comparePassword(adminPassword, existing.passwordHash);
-      if (!matches) {
-        await this.resetPassword(existing.id, adminPassword);
-      }
-      return;
-    }
-    await this.create({ username: adminUsername, password: adminPassword, role: "super_admin", allowedProviders: "*", allowedDevices: {} });
-  }
-};
-
-// src/auth/api-key-manager.ts
-import * as crypto3 from "crypto";
-import { ApiKeyRecordSchema } from "@camstack/types";
-var API_KEYS_COLLECTION = "api_keys";
-function parseApiKey(data) {
-  return parseRecord("api-key", ApiKeyRecordSchema, data);
-}
-var ApiKeyManager = class {
-  constructor(storageAccess, auth) {
-    this.storageAccess = storageAccess;
-    this.auth = auth;
-  }
-  storageAccess;
-  auth;
-  get store() {
-    return this.storageAccess.getStore();
-  }
-  async create(input) {
-    const { token: rawToken, hash: hash2, prefix } = this.auth.generateApiKey();
-    const now = Date.now();
-    const record = {
-      id: crypto3.randomUUID(),
-      label: input.label,
-      role: input.role,
-      allowedProviders: input.allowedProviders ?? "*",
-      allowedDevices: input.allowedDevices ?? {},
-      tokenHash: hash2,
-      tokenPrefix: prefix,
-      createdAt: now
-    };
-    await this.store.insert.mutate({ collection: API_KEYS_COLLECTION, record: { id: record.id, data: { ...record } } });
-    return { record, token: rawToken };
-  }
-  async validateToken(token) {
-    const allKeys = await this.store.query.query({ collection: API_KEYS_COLLECTION });
-    for (const entry of allKeys) {
-      const record = parseApiKey(entry.data);
-      if (this.auth.validateApiKey(token, record.tokenHash)) {
-        const updatedData = { ...record, lastUsedAt: Date.now() };
-        await this.store.update.mutate({ collection: API_KEYS_COLLECTION, id: record.id, data: { ...updatedData } });
-        return updatedData;
-      }
-    }
-    return null;
-  }
-  async listAll() {
-    const results = await this.store.query.query({ collection: API_KEYS_COLLECTION });
-    return results.map((r) => {
-      const parsed = parseApiKey(r.data);
-      const { tokenHash: _th, ...rest } = parsed;
-      return rest;
-    });
-  }
-  async revoke(id) {
-    await this.store.delete.mutate({ collection: API_KEYS_COLLECTION, key: id });
-  }
-  async findById(id) {
-    const results = await this.store.query.query({ collection: API_KEYS_COLLECTION, filter: { where: { id } } });
-    if (results.length === 0) return null;
-    return parseApiKey(results[0].data);
-  }
-};
-
-// src/auth/scoped-token-manager.ts
-import * as crypto4 from "crypto";
-import { ScopedTokenSchema } from "@camstack/types";
-var TOKENS_COLLECTION = "scoped_tokens";
-var TOKEN_PREFIX = "cst_";
-function parseToken(data) {
-  return parseRecord("scoped-token", ScopedTokenSchema, data);
-}
-var ScopedTokenManager = class {
-  constructor(store) {
-    this.store = store;
-  }
-  store;
-  async create(userId, name, scopes, expiresAt) {
-    const rawHex = crypto4.randomBytes(32).toString("hex");
-    const rawToken = `${TOKEN_PREFIX}${rawHex}`;
-    const tokenHash = crypto4.createHash("sha256").update(rawToken).digest("hex");
-    const tokenPrefix = rawToken.slice(0, 12);
-    const record = {
-      id: crypto4.randomUUID(),
-      userId,
-      name,
-      tokenHash,
-      tokenPrefix,
-      scopes: scopes.map((s) => ({ ...s })),
-      expiresAt,
-      lastUsedAt: void 0,
-      createdAt: Date.now()
-    };
-    await this.store.insert.mutate({ collection: TOKENS_COLLECTION, record: { id: record.id, data: { ...record } } });
-    return { token: rawToken, record };
-  }
-  async validate(rawToken) {
-    if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
-    const tokenHash = crypto4.createHash("sha256").update(rawToken).digest("hex");
-    const results = await this.store.query.query({ collection: TOKENS_COLLECTION, filter: { where: { tokenHash } } });
-    if (results.length === 0) return null;
-    const record = parseToken(results[0].data);
-    if (record.expiresAt !== void 0 && record.expiresAt !== null && Date.now() > record.expiresAt) return null;
-    this.updateLastUsed(record.id).catch(() => {
-    });
-    return record;
-  }
-  matchesScope(token, addonId, routePath, capability) {
-    for (const scope of token.scopes) {
-      switch (scope.type) {
-        case "addon":
-          if (addonId && scope.target === addonId) return true;
-          break;
-        case "route-prefix":
-          if (routePath && routePath.startsWith(scope.target)) return true;
-          break;
-        case "capability":
-          if (capability && scope.target === capability) return true;
-          break;
-      }
-    }
-    return false;
-  }
-  async revoke(tokenId) {
-    await this.store.delete.mutate({ collection: TOKENS_COLLECTION, key: tokenId });
-  }
-  async listForUser(userId) {
-    const results = await this.store.query.query({ collection: TOKENS_COLLECTION, filter: { where: { userId } } });
-    return results.map((r) => parseToken(r.data));
-  }
-  async updateLastUsed(tokenId) {
-    const results = await this.store.query.query({ collection: TOKENS_COLLECTION, filter: { where: { id: tokenId } } });
-    if (results.length === 0) return;
-    const existing = parseToken(results[0].data);
-    await this.store.update.mutate({ collection: TOKENS_COLLECTION, id: tokenId, data: { ...existing, lastUsedAt: Date.now() } });
-  }
-};
-
-// src/builtins/local-auth/auth-schema.ts
-var USERS_COLLECTION2 = "users";
-var API_KEYS_COLLECTION2 = "api_keys";
-var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
-var USERS_COLUMNS = [
-  { name: "id", type: "TEXT", primaryKey: true, notNull: true },
-  { name: "username", type: "TEXT", notNull: true, unique: true },
-  { name: "passwordHash", type: "TEXT", notNull: true },
-  { name: "role", type: "TEXT", notNull: true },
-  { name: "allowedProviders", type: "JSON" },
-  { name: "allowedDevices", type: "JSON" },
-  { name: "createdAt", type: "INTEGER", notNull: true },
-  { name: "updatedAt", type: "INTEGER", notNull: true }
-];
-var API_KEYS_COLUMNS = [
-  { name: "id", type: "TEXT", primaryKey: true, notNull: true },
-  { name: "label", type: "TEXT", notNull: true },
-  { name: "role", type: "TEXT", notNull: true },
-  { name: "tokenHash", type: "TEXT", notNull: true, unique: true },
-  { name: "tokenPrefix", type: "TEXT", notNull: true },
-  { name: "allowedProviders", type: "JSON" },
-  { name: "allowedDevices", type: "JSON" },
-  { name: "createdAt", type: "INTEGER", notNull: true },
-  { name: "lastUsedAt", type: "INTEGER" }
-];
-var SCOPED_TOKENS_COLUMNS = [
-  { name: "id", type: "TEXT", primaryKey: true, notNull: true },
-  { name: "userId", type: "TEXT", notNull: true },
-  { name: "name", type: "TEXT", notNull: true },
-  { name: "tokenHash", type: "TEXT", notNull: true, unique: true },
-  { name: "tokenPrefix", type: "TEXT", notNull: true },
-  { name: "scopes", type: "JSON" },
-  { name: "expiresAt", type: "INTEGER" },
-  { name: "lastUsedAt", type: "INTEGER" },
-  { name: "createdAt", type: "INTEGER", notNull: true }
-];
-async function declareAuthSchema(store) {
-  await store.declareCollection.mutate({
-    collection: USERS_COLLECTION2,
-    columns: USERS_COLUMNS
-  });
-  await store.declareCollection.mutate({
-    collection: API_KEYS_COLLECTION2,
-    columns: API_KEYS_COLUMNS,
-    indexes: [
-      { name: "idx_api_keys_token_prefix", columns: ["tokenPrefix"] }
-    ]
-  });
-  await store.declareCollection.mutate({
-    collection: SCOPED_TOKENS_COLLECTION,
-    columns: SCOPED_TOKENS_COLUMNS,
-    indexes: [
-      { name: "idx_scoped_tokens_user_id", columns: ["userId"] }
-    ]
-  });
-}
-
-// src/builtins/local-auth/local-auth.addon.ts
-function toAuthResult(user) {
-  return {
-    userId: user.id,
-    username: user.username,
-    displayName: user.username,
-    roles: [user.role]
-  };
-}
-var LocalAuthAddon = class extends BaseAddon {
-  authManager = null;
-  userManager = null;
-  apiKeyManager = null;
-  scopedTokenManager = null;
-  constructor() {
-    super({ jwtSecret: "", adminUsername: "", adminPassword: "" });
-  }
-  async onInitialize() {
-    const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-    const resolvedJwtSecret = typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "";
-    const resolvedAdminUser = typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "";
-    const resolvedAdminPass = typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "";
-    const reader = {
-      get(path) {
-        if (path === "auth.jwtSecret") return resolvedJwtSecret;
-        if (path === "auth.adminUsername") return resolvedAdminUser;
-        if (path === "auth.adminPassword") return resolvedAdminPass;
-        return void 0;
-      },
-      update: (_section, data) => {
-        if (typeof data["jwtSecret"] === "string") {
-          void this.ctx.settings?.setSection("auth", { jwtSecret: data["jwtSecret"] });
-        }
-      }
-    };
-    this.authManager = new AuthManager(reader, this.ctx.logger);
-    const store = this.ctx.api?.settingsStore;
-    if (store) {
-      await declareAuthSchema(store);
-      const storageAccess = {
-        getStore() {
-          return store;
-        }
-      };
-      this.userManager = new UserManager(storageAccess, this.authManager, reader);
-      this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
-      this.scopedTokenManager = new ScopedTokenManager(store);
-      try {
-        await this.userManager.ensureAdminExists();
-      } catch (err) {
-        const detail = err instanceof Error ? err.message : String(err);
-        throw new Error(
-          `local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`,
-          { cause: err }
-        );
-      }
-    } else {
-      throw new Error(
-        "local-auth: settings-store API not available \u2014 refusing to register `user-management` cap. Check that `sqlite-storage` addon initialized before `local-auth`."
-      );
-    }
-    const authProvider = {
-      validateCredentials: async (input) => {
-        if (!this.userManager) return null;
-        const user = await this.userManager.validateCredentials(input.username, input.password);
-        return user ? toAuthResult(user) : null;
-      },
-      getLoginUrl: async () => {
-        throw new Error("local-auth: URL-based login not supported");
-      },
-      handleCallback: async () => {
-        throw new Error("local-auth: URL-based login not supported");
-      },
-      validateToken: async (input) => {
-        if (!this.authManager || !this.userManager) return null;
-        try {
-          const payload = this.authManager.verifyToken(input.token);
-          const userId = payload.userId;
-          if (!userId) return null;
-          const user = await this.userManager.findById(userId);
-          return user ? toAuthResult(user) : null;
-        } catch {
-          return null;
-        }
-      }
-    };
-    const userMgmt = {
-      listUsers: async () => {
-        if (!this.userManager) return [];
-        return this.userManager.listAll();
-      },
-      createUser: async (input) => {
-        if (!this.userManager) throw new Error("User management not available");
-        const record = await this.userManager.create(input);
-        const { passwordHash: _, ...summary } = record;
-        return summary;
-      },
-      updateUser: async (input) => {
-        if (!this.userManager) throw new Error("User management not available");
-        const { id, ...data } = input;
-        await this.userManager.update(id, data);
-        return { success: true };
-      },
-      deleteUser: async (input) => {
-        if (!this.userManager) throw new Error("User management not available");
-        await this.userManager.delete(input.id);
-        return { success: true };
-      },
-      resetPassword: async (input) => {
-        if (!this.userManager) throw new Error("User management not available");
-        await this.userManager.resetPassword(input.id, input.newPassword);
-        return { success: true };
-      },
-      validateCredentials: async (input) => {
-        if (!this.userManager) return null;
-        const user = await this.userManager.validateCredentials(input.username, input.password);
-        return user ?? null;
-      },
-      listApiKeys: async () => {
-        if (!this.apiKeyManager) return [];
-        return this.apiKeyManager.listAll();
-      },
-      createApiKey: async (input) => {
-        if (!this.apiKeyManager) throw new Error("API key management not available");
-        const { record, token } = await this.apiKeyManager.create(input);
-        const { tokenHash: _, ...summary } = record;
-        return { token, record: summary };
-      },
-      revokeApiKey: async (input) => {
-        if (!this.apiKeyManager) throw new Error("API key management not available");
-        await this.apiKeyManager.revoke(input.id);
-        return { success: true };
-      },
-      validateApiKey: async (input) => {
-        if (!this.apiKeyManager) return null;
-        const record = await this.apiKeyManager.validateToken(input.token);
-        if (!record) return null;
-        const { tokenHash: _, ...summary } = record;
-        return summary;
-      },
-      createScopedToken: async (input) => {
-        if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-        const { token, record } = await this.scopedTokenManager.create("system", input.name, input.scopes, input.expiresAt);
-        return { token, record };
-      },
-      revokeScopedToken: async (input) => {
-        if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
-        await this.scopedTokenManager.revoke(input.id);
-        return { success: true };
-      },
-      validateScopedToken: async (input) => {
-        if (!this.scopedTokenManager) return null;
-        return this.scopedTokenManager.validate(input.token);
-      },
-      listScopedTokens: async (input) => {
-        if (!this.scopedTokenManager) return [];
-        return this.scopedTokenManager.listForUser(input.userId);
-      }
-    };
-    this.ctx.logger.info("registered auth-provider + user-management capabilities");
-    return [
-      { capability: authProviderCapability, provider: authProvider },
-      { capability: userManagementCapability, provider: userMgmt }
-    ];
-  }
-  async onShutdown() {
-    this.authManager = null;
-    this.userManager = null;
-    this.apiKeyManager = null;
-    this.scopedTokenManager = null;
-  }
-};
-var local_auth_addon_default = LocalAuthAddon;
-
-export {
-  AuthManager,
-  UserManager,
-  ApiKeyManager,
-  ScopedTokenManager,
-  LocalAuthAddon,
-  local_auth_addon_default
-};
-//# sourceMappingURL=chunk-3BK2Y7GY.mjs.map