@dyrected/core 2.6.3 → 2.7.0

package/dist/app.d.ts

@@ -0,0 +1,35 @@
+import { Hono } from 'hono';
+import type { Logger } from 'pino';
+import type { DyrectedConfig } from './types/index.js';
+import type { CollectionTokenPayload } from './auth/token.js';
+import { type DyrectedObservabilityRuntime, type RequestBodyCapture, type RequestTraceContext } from './observability.js';
+export interface DyrectedContext {
+    Variables: {
+        config: DyrectedConfig;
+        logger?: Logger;
+        observability?: DyrectedObservabilityRuntime;
+        siteId?: string;
+        workspaceId?: string;
+        requestBodyCapture?: RequestBodyCapture;
+        requestTrace?: RequestTraceContext;
+        /**
+         * The authenticated user set by requireAuth() or optionalAuth() middleware.
+         * Hydrated from the full user record (minus password) when a db adapter is
+         * configured, so collection fields like `roles` are available; falls back to
+         * the token's identity claims otherwise.
+         */
+        user?: {
+            sub: string;
+            email?: string;
+            collection: string;
+            [key: string]: any;
+        };
+        clientIp?: string;
+        authTokenPayload?: CollectionTokenPayload;
+    };
+}
+/**
+ * Create the main Dyrected Hono application.
+ */
+export declare function createDyrectedApp(rawConfig: DyrectedConfig): Promise<Hono<DyrectedContext, import("hono/types").BlankSchema, "/">>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAS,MAAM,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAK9D,OAAO,EAYL,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,4BAA4B,CAAC;QAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnC;;;;;WAKG;QACH,IAAI,CAAC,EAAE;YACL,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,UAAU,EAAE,MAAM,CAAC;YACnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;SACpB,CAAC;QACF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,cAAc,yEA0LhE"}

package/dist/app.js

@@ -0,0 +1,164 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { requestId } from 'hono/request-id';
+import { registerRoutes } from './router.js';
+import { normalizeConfig } from './utils/config.js';
+import { optionalAuth } from './middleware/auth.js';
+import { createRateLimitMiddleware } from './middleware/rate-limit.js';
+import { attachRequestMetrics, bindObservabilityRuntime, buildRequestLogger, captureRequestBody, createObservabilityRuntime, createRequestSpan, endRequestSpan, getRequestLogger, redactHeaders, renderPrometheusMetrics, shouldSampleRequest, } from './observability.js';
+/**
+ * Create the main Dyrected Hono application.
+ */
+export async function createDyrectedApp(rawConfig) {
+    const config = normalizeConfig(rawConfig);
+    const observability = createObservabilityRuntime(config);
+    bindObservabilityRuntime(config, observability);
+    config.logger = observability.logger;
+    const app = new Hono();
+    // 0. Sync Database Schema if adapter supports it
+    if (config.db?.sync) {
+        await config.db.sync(config.collections, config.globals);
+    }
+    // 1. Standard Middleware
+    app.use('*', requestId());
+    app.use('*', async (c, next) => {
+        c.set('config', config);
+        c.set('observability', observability);
+        // If an upstream middleware (e.g. cloud app) hasn't already set the siteId,
+        // fallback to 'default' for self-hosted/singleton mode.
+        if (!c.get('siteId')) {
+            c.set('siteId', 'default');
+        }
+        c.set('logger', buildRequestLogger(observability, c.var, c.get('requestId')));
+        await next();
+    });
+    app.use('*', async (c, next) => {
+        const start = Date.now();
+        const method = c.req.method;
+        const path = c.req.path;
+        const requestId = c.get('requestId');
+        const observabilityConfig = observability.config;
+        const traceSampled = shouldSampleRequest(requestId, 200, observabilityConfig.sampling, 'trace');
+        const requestTrace = traceSampled
+            ? createRequestSpan(observability, `${method} ${path}`, {
+                'http.method': method,
+                'http.route': path,
+                requestId,
+                siteId: c.get('siteId'),
+                workspaceId: c.get('workspaceId'),
+            })
+            : undefined;
+        if (requestTrace) {
+            c.set('requestTrace', requestTrace);
+            c.set('logger', buildRequestLogger(observability, c.var, requestId));
+        }
+        let bodyCapturePromise;
+        if (observabilityConfig.requestLogging.logBodies) {
+            const bodySampled = shouldSampleRequest(requestId, 200, observabilityConfig.sampling, 'body');
+            if (bodySampled) {
+                bodyCapturePromise = captureRequestBody(c.req.raw, observabilityConfig);
+            }
+        }
+        let caughtError;
+        try {
+            await next();
+        }
+        catch (error) {
+            caughtError = error;
+            throw error;
+        }
+        finally {
+            const durationMs = Date.now() - start;
+            const statusCode = c.res.status || (caughtError ? 500 : 200);
+            const sampled = shouldSampleRequest(requestId, statusCode, observabilityConfig.sampling, 'log');
+            const requestLogger = getRequestLogger(c, 'api');
+            const requestHeaders = redactHeaders(Object.fromEntries(c.req.raw.headers.entries()), observabilityConfig);
+            const requestBodyCapture = bodyCapturePromise
+                ? await bodyCapturePromise
+                : undefined;
+            if (requestBodyCapture) {
+                c.set('requestBodyCapture', requestBodyCapture);
+            }
+            attachRequestMetrics(observability, {
+                method,
+                route: path,
+                statusCode,
+                durationMs,
+            });
+            if (observabilityConfig.requestLogging.enabled && sampled) {
+                const level = statusCode >= 500 ? 'error' : statusCode >= 400 ? 'warn' : 'info';
+                requestLogger[level]({
+                    msg: 'HTTP request completed',
+                    method,
+                    path,
+                    statusCode,
+                    durationMs,
+                    requestId,
+                    siteId: c.get('siteId'),
+                    workspaceId: c.get('workspaceId'),
+                    contentType: c.req.header('content-type') ?? undefined,
+                    contentLength: c.req.header('content-length')
+                        ? Number(c.req.header('content-length'))
+                        : undefined,
+                    sampled,
+                    headers: Object.keys(requestHeaders).length > 0 ? requestHeaders : undefined,
+                    body: requestBodyCapture?.body,
+                    bodyCapture: requestBodyCapture && requestBodyCapture.body === undefined
+                        ? {
+                            attempted: requestBodyCapture.attempted,
+                            contentType: requestBodyCapture.contentType,
+                            contentLength: requestBodyCapture.contentLength,
+                            truncated: requestBodyCapture.truncated,
+                            parseFailed: requestBodyCapture.parseFailed,
+                        }
+                        : undefined,
+                });
+            }
+            endRequestSpan(requestTrace, statusCode, caughtError);
+        }
+    });
+    app.use('*', createRateLimitMiddleware(config));
+    // Resolve bearer token if present so the full user (incl. roles and other collection
+    // fields) is available in access functions, CRUD hooks, and audit logging.
+    app.use('*', optionalAuth(config));
+    app.use('*', cors(config.cors ? { origin: config.cors.origins } : {}));
+    // 3. Health Check & Debug
+    app.get('/health', (c) => c.json({ status: 'ok', version: '0.0.1' }));
+    if (observability.config.metrics.enabled &&
+        observability.config.metrics.exporter === 'prometheus' &&
+        observability.prometheusExporter) {
+        app.get(observability.config.metrics.path, async (c) => {
+            const metrics = await renderPrometheusMetrics(observability.prometheusExporter);
+            return new Response(metrics.body, {
+                status: metrics.statusCode,
+                headers: metrics.headers,
+            });
+        });
+    }
+    app.get('/routes', (c) => {
+        const routes = app.routes.map(r => ({ method: r.method, path: r.path }));
+        return c.json({ routes });
+    });
+    // 4. Global Error Handler
+    app.onError((err, c) => {
+        const logger = getRequestLogger(c, 'core');
+        logger.error({
+            err,
+            msg: 'Uncaught error',
+            path: c.req.path,
+            method: c.req.method,
+        });
+        observability.recordUncaughtError({
+            path: c.req.path,
+            method: c.req.method,
+        });
+        return c.json({
+            message: err.message || 'Internal Server Error',
+            stack: process.env.NODE_ENV === 'development' ? err.stack : undefined
+        }, 500);
+    });
+    // 5. Dynamic Routing
+    registerRoutes(app, config);
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AA4B5B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAyB;IAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACzD,wBAAwB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAmB,CAAC;IAExC,iDAAiD;IACjD,IAAI,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QACtC,4EAA4E;QAC5E,wDAAwD;QACxD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7B,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAAC;QACjD,MAAM,YAAY,GAAG,mBAAmB,CACtC,SAAS,EACT,GAAG,EACH,mBAAmB,CAAC,QAAQ,EAC5B,OAAO,CACR,CAAC;QACF,MAAM,YAAY,GAAG,YAAY;YAC/B,CAAC,CAAC,iBAAiB,CAAC,aAAa,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE;gBACpD,aAAa,EAAE,MAAM;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS;gBACT,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACvB,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;aAClC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,kBAAuE,CAAC;QAC5E,IAAI,mBAAmB,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,mBAAmB,CACrC,SAAS,EACT,GAAG,EACH,mBAAmB,CAAC,QAAQ,EAC5B,MAAM,CACP,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAkB,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,GAAG,KAAK,CAAC;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACtC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,mBAAmB,CACjC,SAAS,EACT,UAAU,EACV,mBAAmB,CAAC,QAAQ,EAC5B,KAAK,CACN,CAAC;YACF,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjD,MAAM,cAAc,GAAG,aAAa,CAClC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAC/C,mBAAmB,CACpB,CAAC;YACF,MAAM,kBAAkB,GAAG,kBAAkB;gBAC3C,CAAC,CAAC,MAAM,kBAAkB;gBAC1B,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,kBAAkB,EAAE,CAAC;gBACvB,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;YAED,oBAAoB,CAAC,aAAa,EAAE;gBAClC,MAAM;gBACN,KAAK,EAAE,IAAI;gBACX,UAAU;gBACV,UAAU;aACX,CAAC,CAAC;YAEH,IAAI,mBAAmB,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC1D,MAAM,KAAK,GACT,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,aAAa,CAAC,KAAK,CAAC,CAAC;oBACnB,GAAG,EAAE,wBAAwB;oBAC7B,MAAM;oBACN,IAAI;oBACJ,UAAU;oBACV,UAAU;oBACV,SAAS;oBACT,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACvB,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;oBACjC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,SAAS;oBACtD,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;wBAC3C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;wBACxC,CAAC,CAAC,SAAS;oBACb,OAAO;oBACP,OAAO,EACL,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;oBACrE,IAAI,EAAE,kBAAkB,EAAE,IAAI;oBAC9B,WAAW,EACT,kBAAkB,IAAI,kBAAkB,CAAC,IAAI,KAAK,SAAS;wBACzD,CAAC,CAAC;4BACE,SAAS,EAAE,kBAAkB,CAAC,SAAS;4BACvC,WAAW,EAAE,kBAAkB,CAAC,WAAW;4BAC3C,aAAa,EAAE,kBAAkB,CAAC,aAAa;4BAC/C,SAAS,EAAE,kBAAkB,CAAC,SAAS;4BACvC,WAAW,EAAE,kBAAkB,CAAC,WAAW;yBAC5C;wBACH,CAAC,CAAC,SAAS;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,cAAc,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,qFAAqF;IACrF,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvE,0BAA0B;IAC1B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,IACE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;QACpC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,YAAY;QACtD,aAAa,CAAC,kBAAkB,EAChC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,aAAa,CAAC,kBAAmB,CAClC,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;gBAChC,MAAM,EAAE,OAAO,CAAC,UAAU;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC;YACX,GAAG;YACH,GAAG,EAAE,gBAAgB;YACrB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,aAAa,CAAC,mBAAmB,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,uBAAuB;YAC/C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACtE,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;IAEH,qBAAqB;IACrB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/access.d.ts

@@ -0,0 +1,5 @@
+import type { AuthenticatedUser, DyrectedConfig } from "../types/index.js";
+import type { AccessFunctionArgs, AccessResult, AccessRule } from "../types/access.js";
+export declare function resolveAccess<TDoc extends object = Record<string, unknown>, TUser extends AuthenticatedUser = AuthenticatedUser>(config: DyrectedConfig<TUser>, access: AccessRule<TDoc, TUser> | undefined | null, args: AccessFunctionArgs<TDoc, TUser>): Promise<AccessResult | undefined>;
+export declare function isAccessAllowed<TDoc extends object = Record<string, unknown>, TUser extends AuthenticatedUser = AuthenticatedUser>(config: DyrectedConfig<TUser>, access: AccessRule<TDoc, TUser> | undefined | null, args: AccessFunctionArgs<TDoc, TUser>): Promise<boolean>;
+//# sourceMappingURL=access.d.ts.map

package/dist/auth/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/auth/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAwB,YAAY,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAQhI,wBAAsB,aAAa,CACjC,IAAI,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7C,KAAK,SAAS,iBAAiB,GAAG,iBAAiB,EAEnD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAC7B,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,IAAI,EAClD,IAAI,EAAE,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,GACpC,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiDnC;AAED,wBAAsB,eAAe,CACnC,IAAI,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7C,KAAK,SAAS,iBAAiB,GAAG,iBAAiB,EAEnD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAC7B,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,IAAI,EAClD,IAAI,EAAE,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,GACpC,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/auth/access.js

@@ -0,0 +1,59 @@
+import { evaluateAccess } from "./jexl.js";
+import { getConfigLogger } from "../observability.js";
+function isNamedAccessPolicy(value) {
+    return !!value && typeof value === "object" && "policy" in value && typeof value.policy === "string";
+}
+export async function resolveAccess(config, access, args) {
+    if (access === undefined || access === null)
+        return undefined;
+    if (typeof access === "boolean" || typeof access === "string") {
+        return evaluateAccess(access, { ...args, config });
+    }
+    if (typeof access === "function") {
+        try {
+            return await access(args);
+        }
+        catch (err) {
+            getConfigLogger(config, "access").error({
+                err,
+                msg: "Functional access check failed",
+            });
+            return false;
+        }
+    }
+    if (isNamedAccessPolicy(access)) {
+        const policy = config.accessPolicies?.[access.policy];
+        if (policy === undefined) {
+            getConfigLogger(config, "access").error({
+                msg: "Unknown access policy",
+                policy: access.policy,
+            });
+            return false;
+        }
+        // A policy defined as a Jexl string or boolean is evaluated the same way as
+        // an inline rule of that shape.
+        if (typeof policy === "string" || typeof policy === "boolean") {
+            return evaluateAccess(policy, { ...args, config });
+        }
+        try {
+            const resolver = policy;
+            return await resolver({ ...args, params: access.params });
+        }
+        catch (err) {
+            getConfigLogger(config, "access").error({
+                err,
+                msg: "Access policy failed",
+                policy: access.policy,
+            });
+            return false;
+        }
+    }
+    return false;
+}
+export async function isAccessAllowed(config, access, args) {
+    const result = await resolveAccess(config, access, args);
+    if (result === undefined)
+        return true;
+    return typeof result === "boolean" ? result : !!result;
+}
+//# sourceMappingURL=access.js.map

package/dist/auth/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/auth/access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAAC;AACjI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAIjC,MAA6B,EAC7B,MAAkD,EAClD,IAAqC;IAErC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAE9D,IAAI,OAAO,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC;gBACtC,GAAG;gBACH,GAAG,EAAE,gCAAgC;aACtC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC;gBACtC,GAAG,EAAE,uBAAuB;gBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4EAA4E;QAC5E,gCAAgC;QAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9D,OAAO,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAA2C,CAAC;YAC7D,OAAO,MAAM,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC;gBACtC,GAAG;gBACH,GAAG,EAAE,sBAAsB;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAInC,MAA6B,EAC7B,MAAkD,EAClD,IAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC"}

package/dist/auth/jexl.d.ts

@@ -0,0 +1,13 @@
+import type { AccessResult } from '../types/access.js';
+/**
+ * Jexl evaluator for Dyrected access control.
+ * Allows for serializable, dynamic permissions based on user state, request, and document.
+ */
+export declare function evaluateAccess(expression: string | boolean | undefined | null, context: {
+    user?: any;
+    req?: any;
+    doc?: any;
+    data?: any;
+    config?: any;
+}): Promise<AccessResult>;
+//# sourceMappingURL=jexl.d.ts.map

package/dist/auth/jexl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jexl.d.ts","sourceRoot":"","sources":["../../src/auth/jexl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,EAC/C,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,CAAA;CAAE,GACtE,OAAO,CAAC,YAAY,CAAC,CAoBvB"}

package/dist/auth/jexl.js

@@ -0,0 +1,30 @@
+import jexl from 'jexl';
+import { getConfigLogger } from '../observability.js';
+/**
+ * Jexl evaluator for Dyrected access control.
+ * Allows for serializable, dynamic permissions based on user state, request, and document.
+ */
+export async function evaluateAccess(expression, context) {
+    // If no expression is provided, default to closed (false) for security
+    // unless explicitly specified otherwise in the core router logic.
+    if (expression === undefined || expression === null)
+        return false;
+    if (typeof expression === 'boolean')
+        return expression;
+    try {
+        const result = await jexl.eval(expression, context);
+        if (result && typeof result === 'object' && !Array.isArray(result)) {
+            return result;
+        }
+        return !!result;
+    }
+    catch (err) {
+        getConfigLogger(context.config, 'access').error({
+            err,
+            msg: 'Jexl evaluation failed',
+            expression,
+        });
+        return false;
+    }
+}
+//# sourceMappingURL=jexl.js.map

package/dist/auth/jexl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jexl.js","sourceRoot":"","sources":["../../src/auth/jexl.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA+C,EAC/C,OAAuE;IAEvE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC;YAC9C,GAAG;YACH,GAAG,EAAE,wBAAwB;YAC7B,UAAU;SACX,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/auth/lockout.d.ts

@@ -0,0 +1,11 @@
+import type { CollectionConfig } from "../types/index.js";
+export declare const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+export declare const DEFAULT_LOCK_TIME_MS: number;
+export type ResolvedAuthLockoutConfig = {
+    enabled: boolean;
+    maxLoginAttempts: number;
+    lockTime: number;
+};
+export declare function resolveAuthLockoutConfig(collection: CollectionConfig): ResolvedAuthLockoutConfig;
+export declare function getLockedUntilMs(value: unknown): number | null;
+//# sourceMappingURL=lockout.d.ts.map

package/dist/auth/lockout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockout.d.ts","sourceRoot":"","sources":["../../src/auth/lockout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,eAAO,MAAM,oBAAoB,QAAiB,CAAC;AAEnD,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,GAC3B,yBAAyB,CAiC3B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI9D"}

package/dist/auth/lockout.js

@@ -0,0 +1,37 @@
+export const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+export const DEFAULT_LOCK_TIME_MS = 10 * 60 * 1000;
+export function resolveAuthLockoutConfig(collection) {
+    const auth = collection.auth;
+    if (!auth) {
+        return {
+            enabled: false,
+            maxLoginAttempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+            lockTime: DEFAULT_LOCK_TIME_MS,
+        };
+    }
+    if (auth === true) {
+        return {
+            enabled: true,
+            maxLoginAttempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+            lockTime: DEFAULT_LOCK_TIME_MS,
+        };
+    }
+    const maxLoginAttempts = typeof auth.maxLoginAttempts === "number"
+        ? auth.maxLoginAttempts
+        : DEFAULT_MAX_LOGIN_ATTEMPTS;
+    const lockTime = typeof auth.lockTime === "number" && auth.lockTime > 0
+        ? auth.lockTime
+        : DEFAULT_LOCK_TIME_MS;
+    return {
+        enabled: maxLoginAttempts > 0,
+        maxLoginAttempts,
+        lockTime,
+    };
+}
+export function getLockedUntilMs(value) {
+    if (typeof value !== "string")
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+//# sourceMappingURL=lockout.js.map

package/dist/auth/lockout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockout.js","sourceRoot":"","sources":["../../src/auth/lockout.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAQnD,MAAM,UAAU,wBAAwB,CACtC,UAA4B;IAE5B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,KAAK;YACd,gBAAgB,EAAE,0BAA0B;YAC5C,QAAQ,EAAE,oBAAoB;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,0BAA0B;YAC5C,QAAQ,EAAE,oBAAoB;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GACpB,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ;QACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,0BAA0B,CAAC;IACjC,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,oBAAoB,CAAC;IAE3B,OAAO;QACL,OAAO,EAAE,gBAAgB,GAAG,CAAC;QAC7B,gBAAgB;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC"}

package/dist/auth/password.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hash a plain-text password using scrypt.
+ * Returns a `salt:hash` string safe to store in the database.
+ */
+export declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a plain-text password against a stored `salt:hash` string.
+ */
+export declare function verifyPassword(plain: string, stored: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIjE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpF"}

package/dist/auth/password.js

@@ -0,0 +1,28 @@
+import { promisify } from 'node:util';
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
+const scryptAsync = promisify(scrypt);
+const SALT_LEN = 16;
+const KEY_LEN = 64;
+/**
+ * Hash a plain-text password using scrypt.
+ * Returns a `salt:hash` string safe to store in the database.
+ */
+export async function hashPassword(plain) {
+    const salt = randomBytes(SALT_LEN).toString('hex');
+    const derivedKey = (await scryptAsync(plain, salt, KEY_LEN));
+    return `${salt}:${derivedKey.toString('hex')}`;
+}
+/**
+ * Verify a plain-text password against a stored `salt:hash` string.
+ */
+export async function verifyPassword(plain, stored) {
+    const [salt, storedHash] = stored.split(':');
+    if (!salt || !storedHash)
+        return false;
+    const derivedKey = (await scryptAsync(plain, salt, KEY_LEN));
+    const storedBuffer = Buffer.from(storedHash, 'hex');
+    if (derivedKey.length !== storedBuffer.length)
+        return false;
+    return timingSafeEqual(derivedKey, storedBuffer);
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAEtC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAW,CAAC;IACvE,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,MAAc;IAChE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,UAAU,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAW,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAEpD,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,39 @@
+import type { DyrectedConfig } from '../types/index.js';
+export declare const AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+export interface AuthSessionRecord {
+    id: string;
+    userId: string;
+    email: string;
+    collection: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    lastIp?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    lastSeenAt?: string;
+    expiresAt?: string | null;
+    revokedAt?: string | null;
+}
+interface IssueAuthSessionArgs {
+    config: DyrectedConfig;
+    userId: string;
+    email: string;
+    collection: string;
+    expiresIn?: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    ip?: string;
+}
+export declare function issueAuthSessionToken(args: IssueAuthSessionArgs): Promise<string>;
+export declare function getAuthSession(config: DyrectedConfig, sessionId: string): Promise<AuthSessionRecord | null>;
+export declare function isAuthSessionActive(session: AuthSessionRecord | null | undefined): session is AuthSessionRecord;
+export declare function touchAuthSession(config: DyrectedConfig, sessionId: string, args: {
+    ip?: string;
+}): Promise<void>;
+export declare function revokeAuthSession(config: DyrectedConfig, sessionId: string): Promise<void>;
+export declare function revokeAllAuthSessions(config: DyrectedConfig, args: {
+    userId: string;
+    collection: string;
+}): Promise<number>;
+export {};
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,eAAO,MAAM,wBAAwB,oBAAoB,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,UAAU,oBAAoB;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,MAAM,CAAC,CAsDjB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAOnC;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC5C,OAAO,IAAI,iBAAiB,CAO9B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACpB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,MAAM,CAAC,CA6BjB"}

package/dist/auth/sessions.js

@@ -0,0 +1,126 @@
+import { decodeCollectionToken, signCollectionToken } from './token.js';
+export const AUTH_SESSIONS_COLLECTION = '__auth_sessions';
+export async function issueAuthSessionToken(args) {
+    const sessionId = createSessionId();
+    const now = new Date().toISOString();
+    const db = args.config.db;
+    if (db) {
+        await db.create({
+            collection: AUTH_SESSIONS_COLLECTION,
+            data: {
+                id: sessionId,
+                userId: args.userId,
+                email: args.email,
+                collection: args.collection,
+                authSource: args.authSource ?? 'local',
+                providerId: args.providerId,
+                lastIp: args.ip,
+                lastSeenAt: now,
+                revokedAt: null,
+                expiresAt: null,
+            },
+        });
+    }
+    const token = await signCollectionToken({
+        sub: args.userId,
+        email: args.email,
+        collection: args.collection,
+        authSource: args.authSource,
+        providerId: args.providerId,
+        sid: sessionId,
+    }, args.expiresIn);
+    const payload = decodeCollectionToken(token);
+    const expiresAt = payload?.exp != null
+        ? new Date(payload.exp * 1000).toISOString()
+        : null;
+    if (db && expiresAt) {
+        await db.update({
+            collection: AUTH_SESSIONS_COLLECTION,
+            id: sessionId,
+            data: {
+                expiresAt,
+                lastSeenAt: now,
+                lastIp: args.ip,
+            },
+        });
+    }
+    return token;
+}
+export async function getAuthSession(config, sessionId) {
+    const db = config.db;
+    if (!db)
+        return null;
+    return (await db.findOne({
+        collection: AUTH_SESSIONS_COLLECTION,
+        id: sessionId,
+    }));
+}
+export function isAuthSessionActive(session) {
+    if (!session)
+        return false;
+    if (session.revokedAt)
+        return false;
+    if (session.expiresAt && new Date(session.expiresAt).getTime() <= Date.now()) {
+        return false;
+    }
+    return true;
+}
+export async function touchAuthSession(config, sessionId, args) {
+    const db = config.db;
+    if (!db)
+        return;
+    await db.update({
+        collection: AUTH_SESSIONS_COLLECTION,
+        id: sessionId,
+        data: {
+            lastSeenAt: new Date().toISOString(),
+            ...(args.ip ? { lastIp: args.ip } : {}),
+        },
+    });
+}
+export async function revokeAuthSession(config, sessionId) {
+    const db = config.db;
+    if (!db)
+        return;
+    await db.update({
+        collection: AUTH_SESSIONS_COLLECTION,
+        id: sessionId,
+        data: {
+            revokedAt: new Date().toISOString(),
+        },
+    });
+}
+export async function revokeAllAuthSessions(config, args) {
+    const db = config.db;
+    if (!db)
+        return 0;
+    let page = 1;
+    let revoked = 0;
+    while (true) {
+        const result = await db.find({
+            collection: AUTH_SESSIONS_COLLECTION,
+            where: {
+                userId: { equals: args.userId },
+                collection: { equals: args.collection },
+            },
+            page,
+            limit: 100,
+        });
+        for (const session of result.docs) {
+            if (session.revokedAt)
+                continue;
+            await revokeAuthSession(config, session.id);
+            revoked += 1;
+        }
+        if (!result.hasNextPage)
+            break;
+        page += 1;
+    }
+    return revoked;
+}
+function createSessionId() {
+    return globalThis.crypto?.randomUUID?.()
+        ? globalThis.crypto.randomUUID()
+        : `sess_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AA4B1D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B;IAE1B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAE1B,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,EAAE,CAAC,MAAM,CAAC;YACd,UAAU,EAAE,wBAAwB;YACpC,IAAI,EAAE;gBACJ,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,OAAO;gBACtC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC;QACE,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,SAAS;KACf,EACD,IAAI,CAAC,SAAS,CACf,CAAC;IAEF,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GACb,OAAO,EAAE,GAAG,IAAI,IAAI;QAClB,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,CAAC;YACd,UAAU,EAAE,wBAAwB;YACpC,EAAE,EAAE,SAAS;YACb,IAAI,EAAE;gBACJ,SAAS;gBACT,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC;QACvB,UAAU,EAAE,wBAAwB;QACpC,EAAE,EAAE,SAAS;KACd,CAAC,CAA6B,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA6C;IAE7C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB,EACtB,SAAiB,EACjB,IAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO;IAEhB,MAAM,EAAE,CAAC,MAAM,CAAC;QACd,UAAU,EAAE,wBAAwB;QACpC,EAAE,EAAE,SAAS;QACb,IAAI,EAAE;YACJ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAsB,EACtB,SAAiB;IAEjB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO;IAEhB,MAAM,EAAE,CAAC,MAAM,CAAC;QACd,UAAU,EAAE,wBAAwB;QACpC,EAAE,EAAE,SAAS;QACb,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAsB,EACtB,IAGC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAElB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YAC3B,UAAU,EAAE,wBAAwB;YACpC,KAAK,EAAE;gBACL,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBAC/B,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;aACxC;YACD,IAAI;YACJ,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;QAEH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAA2B,EAAE,CAAC;YACzD,IAAI,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChC,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,MAAM;QAC/B,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;QACtC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;QAChC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC"}