@devopsplaybook.io/common-utils 1.10.1-beta.23.b1906d7 → 1.11.0-beta.24.d8f9aef

package/dist/src/users/UsersRoutes.js

@@ -2,13 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UsersRoutes = void 0;
 const crypto_1 = require("crypto");
-const uuid_1 = require("uuid");
 const Auth_1 = require("./Auth");
+const DbUtils_1 = require("../DbUtils");
 const User_1 = require("./User");
 const UserApiToken_1 = require("./UserApiToken");
 const UserPassword_1 = require("./UserPassword");
 const UsersData_1 = require("./UsersData");
 const UsersApiTokensData_1 = require("./UsersApiTokensData");
+/** Maximum accepted API token name length. */
+const API_TOKEN_NAME_MAX_LENGTH = 255;
 /**
  * Retrieves the OTel span attached to the request by the
  * `@devopsplaybook.io/otel-utils-fastify` hooks.
@@ -16,6 +18,17 @@ const UsersApiTokensData_1 = require("./UsersApiTokensData");
 function requestSpan(req) {
     return req === null || req === void 0 ? void 0 : req.tracerSpanApi;
 }
+/** Parse an optional non-negative integer query parameter. */
+function parseNonNegativeInt(value) {
+    if (value === undefined || value === null || value === "") {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        return undefined;
+    }
+    return parsed;
+}
 /**
  * Standard user management routes shared across applications:
  * initialization status, login (session), user CRUD and password changes.
@@ -30,14 +43,12 @@ class UsersRoutes {
     async getRoutes(fastify) {
         //
         fastify.get("/status/initialization", async (req, res) => {
-            if ((await (0, UsersData_1.UsersDataList)(requestSpan(req))).length === 0) {
-                res.status(201).send({ initialized: false });
-            }
-            else {
-                res.status(201).send({ initialized: true });
-            }
+            const count = await (0, UsersData_1.UsersDataCount)(requestSpan(req));
+            return res.status(200).send({ initialized: count > 0 });
         });
         fastify.post("/session", async (req, res) => {
+            var _a;
+            const body = (_a = req.body) !== null && _a !== void 0 ? _a : {};
             let user;
             // From token
             const userSession = await (0, Auth_1.AuthGetUserSession)(req);
@@ -54,17 +65,17 @@ class UsersRoutes {
                 });
             }
             // From User/Pass
-            if (!req.body.name) {
+            if (!body.name) {
                 return res.status(400).send({ error: "Missing: Name" });
             }
-            if (!req.body.password) {
+            if (!body.password) {
                 return res.status(400).send({ error: "Missing: Password" });
             }
-            user = await (0, UsersData_1.UsersDataGetByName)(requestSpan(req), req.body.name);
+            user = await (0, UsersData_1.UsersDataGetByName)(requestSpan(req), body.name);
             if (!user) {
                 return res.status(403).send({ error: "Authentication Failed" });
             }
-            else if (await (0, UserPassword_1.UserPasswordCheckPassword)(requestSpan(req), user, req.body.password)) {
+            else if (await (0, UserPassword_1.UserPasswordCheckPassword)(requestSpan(req), user, body.password)) {
                 return res.status(201).send({
                     success: true,
                     token: await (0, Auth_1.AuthGenerateJWT)(user),
@@ -77,58 +88,96 @@ class UsersRoutes {
         });
         // ==================== LIST USERS (Admin only) ====================
         fastify.get("/", async (req, res) => {
+            var _a;
             try {
                 await (0, Auth_1.AuthMustBeAdmin)(req, res);
             }
             catch {
                 return;
             }
-            const users = await (0, UsersData_1.UsersDataList)(requestSpan(req));
+            const query = ((_a = req.query) !== null && _a !== void 0 ? _a : {});
+            const limit = parseNonNegativeInt(query.limit);
+            const offset = parseNonNegativeInt(query.offset);
+            if (query.limit !== undefined && limit === undefined) {
+                return res.status(400).send({ error: "Invalid: limit" });
+            }
+            if (query.offset !== undefined && offset === undefined) {
+                return res.status(400).send({ error: "Invalid: offset" });
+            }
+            const users = await (0, UsersData_1.UsersDataList)(requestSpan(req), limit, offset);
             return res.status(200).send(users.map((u) => u.toTransportJson()));
         });
         fastify.post("/", async (req, res) => {
+            var _a;
             const context = requestSpan(req);
-            let isInitialized = true;
-            if ((await (0, UsersData_1.UsersDataList)(context)).length === 0) {
-                isInitialized = false;
-            }
-            // If initialized, only admin can create users
-            if (isInitialized) {
+            const body = (_a = req.body) !== null && _a !== void 0 ? _a : {};
+            const createUser = async (isFirstUser) => {
+                if (!body.name) {
+                    return res.status(400).send({ error: "Missing: Name" });
+                }
+                if (!body.password) {
+                    return res.status(400).send({ error: "Missing: Password" });
+                }
+                if (await (0, UsersData_1.UsersDataGetByName)(context, body.name)) {
+                    return res.status(400).send({ error: "Username Already Exists" });
+                }
+                const newUser = new User_1.User();
+                newUser.name = body.name;
+                // First user is always admin
+                if (isFirstUser) {
+                    newUser.role = "admin";
+                    newUser.scopes = [...User_1.User.ALL_SCOPES];
+                }
+                else {
+                    newUser.role = body.role === "admin" ? "admin" : "user";
+                    if (body.scopes && Array.isArray(body.scopes)) {
+                        newUser.scopes = body.scopes.filter((s) => User_1.User.ALL_SCOPES.includes(s));
+                    }
+                }
+                await (0, UserPassword_1.UserPasswordSetPassword)(context, newUser, body.password);
+                try {
+                    await (0, UsersData_1.UsersDataAdd)(context, newUser);
+                }
+                catch (error) {
+                    // Uniqueness also holds when the pre-check races another request
+                    // (unique index on LOWER("name") – see README migration).
+                    if ((0, UsersData_1.isUniqueViolationError)(error)) {
+                        return res.status(400).send({ error: "Username Already Exists" });
+                    }
+                    throw error;
+                }
+                return res.status(201).send({ user: newUser.toTransportJson() });
+            };
+            if ((await (0, UsersData_1.UsersDataCount)(context)) > 0) {
+                // If initialized, only admin can create users
                 try {
                     await (0, Auth_1.AuthMustBeAdmin)(req, res);
                 }
                 catch {
                     return;
                 }
+                return createUser(false);
             }
-            if (!req.body.name) {
-                return res.status(400).send({ error: "Missing: Name" });
-            }
-            if (!req.body.password) {
-                return res.status(400).send({ error: "Missing: Password" });
-            }
-            if (await (0, UsersData_1.UsersDataGetByName)(context, req.body.name)) {
-                return res.status(400).send({ error: "Username Already Exists" });
-            }
-            const newUser = new User_1.User();
-            newUser.name = req.body.name;
-            // First user is always admin
-            if (isInitialized) {
-                newUser.role = req.body.role === "admin" ? "admin" : "user";
-                if (req.body.scopes && Array.isArray(req.body.scopes)) {
-                    newUser.scopes = req.body.scopes.filter((s) => User_1.User.ALL_SCOPES.includes(s));
+            // Bootstrap: serialise the "no user yet → first admin" sequence across
+            // replicas (advisory lock on Postgres; single writer on SQLite).
+            return (0, DbUtils_1.DbUtilsWithLock)("users_bootstrap", async () => {
+                if ((await (0, UsersData_1.UsersDataCount)(context)) === 0) {
+                    return createUser(true);
                 }
-            }
-            else {
-                newUser.role = "admin";
-                newUser.scopes = [...User_1.User.ALL_SCOPES];
-            }
-            await (0, UserPassword_1.UserPasswordSetPassword)(context, newUser, req.body.password);
-            await (0, UsersData_1.UsersDataAdd)(context, newUser);
-            res.status(201).send({ user: newUser.toTransportJson() });
+                // Another replica bootstrapped first: require admin credentials.
+                try {
+                    await (0, Auth_1.AuthMustBeAdmin)(req, res);
+                }
+                catch {
+                    return;
+                }
+                return createUser(false);
+            });
         });
         fastify.put("/password", async (req, res) => {
+            var _a;
             const context = requestSpan(req);
+            const body = (_a = req.body) !== null && _a !== void 0 ? _a : {};
             const userSession = await (0, Auth_1.AuthGetUserSession)(req);
             if (!userSession.isAuthenticated) {
                 return res.status(403).send({ error: "Access Denied" });
@@ -138,41 +187,75 @@ class UsersRoutes {
             if (!user) {
                 return res.status(403).send({ error: "Access Denied" });
             }
-            if (!req.body.password) {
+            if (!body.password) {
                 return res.status(400).send({ error: "Missing: Password" });
             }
-            if (!(await (0, UserPassword_1.UserPasswordCheckPassword)(context, user, req.body.passwordOld))) {
+            if (!(await (0, UserPassword_1.UserPasswordCheckPassword)(context, user, body.passwordOld))) {
                 return res.status(403).send({ error: "Old Password Wrong" });
             }
-            await (0, UserPassword_1.UserPasswordSetPassword)(context, user, req.body.password);
+            await (0, UserPassword_1.UserPasswordSetPassword)(context, user, body.password);
             await (0, UsersData_1.UsersDataUpdatePassword)(context, user);
-            res.status(201).send({});
+            if ((0, Auth_1.AuthJwtRevocationEnabled)()) {
+                await (0, UsersData_1.UsersDataBumpTokenVersion)(context, user.id);
+            }
+            return res.status(201).send({});
         });
         fastify.put("/:id", async (req, res) => {
+            var _a;
             const context = requestSpan(req);
+            const body = (_a = req.body) !== null && _a !== void 0 ? _a : {};
             try {
                 await (0, Auth_1.AuthMustBeAdmin)(req, res);
             }
             catch {
                 return;
             }
+            // A body expecting nothing to change is malformed: answer 400, not 404/201
+            if (body.role === undefined &&
+                body.scopes === undefined &&
+                body.password === undefined) {
+                return res.status(400).send({ error: "Missing: Body" });
+            }
             const user = await (0, UsersData_1.UsersDataGet)(context, req.params.id);
             if (!user) {
                 return res.status(404).send({ error: "User Not Found" });
             }
-            if (req.body.role) {
-                user.role = req.body.role === "admin" ? "admin" : "user";
+            let changed = false;
+            if (body.role) {
+                const newRole = body.role === "admin" ? "admin" : "user";
+                if (newRole !== user.role) {
+                    // At least 1 admin must remain (mirrors the delete guard)
+                    if (user.role === "admin" &&
+                        newRole === "user" &&
+                        (await (0, UsersData_1.UsersDataCountAdmins)(context)) <= 1) {
+                        return res
+                            .status(400)
+                            .send({ error: "At least 1 admin must be defined" });
+                    }
+                    user.role = newRole;
+                    changed = true;
+                }
+            }
+            if (body.scopes && Array.isArray(body.scopes)) {
+                const newScopes = body.scopes.filter((s) => User_1.User.ALL_SCOPES.includes(s));
+                if (JSON.stringify(newScopes) !== JSON.stringify(user.scopes)) {
+                    user.scopes = newScopes;
+                    changed = true;
+                }
             }
-            if (req.body.scopes && Array.isArray(req.body.scopes)) {
-                user.scopes = req.body.scopes.filter((s) => User_1.User.ALL_SCOPES.includes(s));
+            if (changed) {
+                await (0, UsersData_1.UsersDataUpdateUser)(context, user);
             }
-            await (0, UsersData_1.UsersDataUpdateUser)(context, user);
             // If password change requested
-            if (req.body.password) {
-                await (0, UserPassword_1.UserPasswordSetPassword)(context, user, req.body.password);
+            if (body.password) {
+                await (0, UserPassword_1.UserPasswordSetPassword)(context, user, body.password);
                 await (0, UsersData_1.UsersDataUpdatePassword)(context, user);
+                changed = true;
+            }
+            if (changed && (0, Auth_1.AuthJwtRevocationEnabled)()) {
+                await (0, UsersData_1.UsersDataBumpTokenVersion)(context, user.id);
             }
-            res.status(201).send({ user: user.toTransportJson() });
+            return res.status(201).send({ user: user.toTransportJson() });
         });
         fastify.delete("/:id", async (req, res) => {
             const context = requestSpan(req);
@@ -193,8 +276,8 @@ class UsersRoutes {
             }
             // Check that at least 1 admin remains
             if (user.role === "admin") {
-                const admins = (await (0, UsersData_1.UsersDataList)(context)).filter((u) => u.role === "admin");
-                if (admins.length <= 1) {
+                const admins = await (0, UsersData_1.UsersDataCountAdmins)(context);
+                if (admins <= 1) {
                     return res
                         .status(400)
                         .send({ error: "At least 1 admin must be defined" });
@@ -202,23 +285,57 @@ class UsersRoutes {
             }
             await (0, UsersData_1.UsersDataDelete)(context, req.params.id);
             await (0, UsersApiTokensData_1.UsersApiTokensDataDeleteByUser)(context, req.params.id);
-            res.status(201).send({});
+            return res.status(200).send({});
         });
         fastify.post("/tokens", async (req, res) => {
+            var _a;
             const context = requestSpan(req);
+            const body = (_a = req.body) !== null && _a !== void 0 ? _a : {};
             const userSession = await (0, Auth_1.AuthGetUserSession)(req);
             if (!userSession.isAuthenticated) {
                 return res.status(403).send({ error: "Access Denied" });
             }
-            if (!req.body || !req.body.name) {
+            if (!body.name || typeof body.name !== "string") {
                 return res.status(400).send({ error: "Missing: Name" });
             }
+            if (body.name.length > API_TOKEN_NAME_MAX_LENGTH) {
+                return res.status(400).send({
+                    error: `Name Too Long (max ${API_TOKEN_NAME_MAX_LENGTH} characters)`,
+                });
+            }
+            let expiresAt = null;
+            if (body.expiresAt !== undefined && body.expiresAt !== null) {
+                const parsed = Date.parse(body.expiresAt);
+                if (!Number.isFinite(parsed)) {
+                    return res
+                        .status(400)
+                        .send({ error: "Invalid: expiresAt (ISO 8601 date expected)" });
+                }
+                if (parsed <= Date.now()) {
+                    return res
+                        .status(400)
+                        .send({ error: "Invalid: expiresAt must be in the future" });
+                }
+                if (!(await (0, UsersApiTokensData_1.UsersApiTokensDataSupportsOptionalColumns)(context))) {
+                    return res.status(400).send({
+                        error: "API token expiry requires the documented users_api_tokens migration",
+                    });
+                }
+                expiresAt = new Date(parsed).toISOString();
+            }
+            const maxTokens = (0, Auth_1.AuthGetApiTokensMaxPerUser)();
+            if ((await (0, UsersApiTokensData_1.UsersApiTokensDataCountByUser)(context, userSession.userId)) >= maxTokens) {
+                return res
+                    .status(400)
+                    .send({ error: `Too many API tokens (max ${maxTokens})` });
+            }
             const apiToken = new UserApiToken_1.UserApiToken();
-            apiToken.name = req.body.name;
+            apiToken.name = body.name;
             // isAuthenticated implies userId is set
             apiToken.userId = userSession.userId;
             apiToken.dateCreated = new Date().toISOString();
-            const token = (0, uuid_1.v4)();
+            apiToken.expiresAt = expiresAt;
+            const token = (0, crypto_1.randomBytes)(32).toString("base64url");
             apiToken.tokenHash = (0, crypto_1.createHash)("sha256").update(token).digest("hex");
             await (0, UsersApiTokensData_1.UsersApiTokensDataAdd)(context, apiToken);
             // The plaintext token is returned once; only its hash is stored.
@@ -254,7 +371,7 @@ class UsersRoutes {
                 return res.status(403).send({ error: "Access Denied" });
             }
             await (0, UsersApiTokensData_1.UsersApiTokensDataDelete)(context, apiToken.id);
-            return res.status(201).send({});
+            return res.status(200).send({});
         });
     }
 }

package/dist/src/users/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./User";
+export * from "./UserSession";
+export * from "./UserApiToken";
+export * from "./Auth";
+export * from "./UserPassword";
+export * from "./UsersData";
+export * from "./UsersApiTokensData";
+export * from "./UsersRoutes";

package/dist/src/users/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./User"), exports);
+__exportStar(require("./UserSession"), exports);
+__exportStar(require("./UserApiToken"), exports);
+__exportStar(require("./Auth"), exports);
+__exportStar(require("./UserPassword"), exports);
+__exportStar(require("./UsersData"), exports);
+__exportStar(require("./UsersApiTokensData"), exports);
+__exportStar(require("./UsersRoutes"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devopsplaybook.io/common-utils",
-  "version": "1.10.1-beta.23.b1906d7",
+  "version": "1.11.0-beta.24.d8f9aef",
   "description": "Shared utility modules for devopsplaybook.io projects (DB, Config, OTel context, auth/users, notifications, LLM, system helpers)",
   "keywords": [
     "Open Telemetry",
@@ -20,6 +20,63 @@
   "type": "commonjs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json",
+    "./otel": {
+      "types": "./dist/src/OTelContext.d.ts",
+      "default": "./dist/src/OTelContext.js"
+    },
+    "./config": {
+      "types": "./dist/src/ConfigBase.d.ts",
+      "default": "./dist/src/ConfigBase.js"
+    },
+    "./db": {
+      "types": "./dist/src/DbUtils.d.ts",
+      "default": "./dist/src/DbUtils.js"
+    },
+    "./db/sqlite": {
+      "types": "./dist/src/SqlDbUtils.d.ts",
+      "default": "./dist/src/SqlDbUtils.js"
+    },
+    "./db/postgres": {
+      "types": "./dist/src/PostgresDbUtils.d.ts",
+      "default": "./dist/src/PostgresDbUtils.js"
+    },
+    "./db/no-telemetry": {
+      "types": "./dist/src/DbUtilsNoTelemetry.d.ts",
+      "default": "./dist/src/DbUtilsNoTelemetry.js"
+    },
+    "./users": {
+      "types": "./dist/src/users/index.d.ts",
+      "default": "./dist/src/users/index.js"
+    },
+    "./notifications": {
+      "types": "./dist/src/Notifications.d.ts",
+      "default": "./dist/src/Notifications.js"
+    },
+    "./llm": {
+      "types": "./dist/src/LLM.d.ts",
+      "default": "./dist/src/LLM.js"
+    },
+    "./system": {
+      "types": "./dist/src/SystemCommand.d.ts",
+      "default": "./dist/src/SystemCommand.js"
+    },
+    "./timeout": {
+      "types": "./dist/src/Timeout.d.ts",
+      "default": "./dist/src/Timeout.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "build": "tsc && tsc -p tsconfig.spec.json --noEmit",
     "lint": "oxlint src",

package/.github/workflows/main-build.yml

@@ -1,18 +0,0 @@
-name: Main Build
-
-on:
-  push:
-    branches: ["main"]
-
-  workflow_dispatch:
-
-jobs:
-  npm-merge:
-    uses: devopsplaybook-io/common-utils/.github/workflows/reusable-npm-merge.yml@main
-    with:
-      npm_package_name: "@devopsplaybook.io/common-utils"
-      node_version: "22"
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      QUALITY_DASHBOARD_URL: ${{ secrets.QUALITY_DASHBOARD_URL }}
-      QUALITY_DASHBOARD_TOKEN: ${{ secrets.QUALITY_DASHBOARD_TOKEN }}

package/.github/workflows/pr-check.yml

@@ -1,27 +0,0 @@
-name: PR Check
-
-on:
-  pull_request:
-    branches: ["main"]
-
-  workflow_dispatch:
-
-concurrency:
-  group: pr-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
-jobs:
-  npm-pr:
-    uses: devopsplaybook-io/common-utils/.github/workflows/reusable-npm-pr.yml@main
-    with:
-      npm_package_name: "@devopsplaybook.io/common-utils"
-      node_version: "22"
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      QUALITY_DASHBOARD_URL: ${{ secrets.QUALITY_DASHBOARD_URL }}
-      QUALITY_DASHBOARD_TOKEN: ${{ secrets.QUALITY_DASHBOARD_TOKEN }}