@dyrected/core 2.6.3 → 2.7.0

package/dist/__tests__/app.test.js

@@ -0,0 +1,112 @@
+import { describe, it, expect } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { defineConfig } from "../index.js";
+import { MockDatabaseAdapter } from "./mocks.js";
+describe("App Shell", () => {
+    const config = defineConfig({
+        collections: [],
+        globals: [],
+        db: new MockDatabaseAdapter(),
+    });
+    it("should respond to health check", async () => {
+        const app = await createDyrectedApp(config);
+        const res = await app.request("/health");
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({ status: "ok", version: "0.0.1" });
+    });
+    it("should set configuration in context", async () => {
+        const app = await createDyrectedApp(config);
+        app.get("/test-ctx", (c) => {
+            const cfg = c.get("config");
+            return c.json({ hasConfig: !!cfg });
+        });
+        const res = await app.request("/test-ctx");
+        expect(await res.json()).toEqual({ hasConfig: true });
+    });
+    it("should rate limit API requests with Payload-style defaults and headers", async () => {
+        const app = await createDyrectedApp(defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            rateLimit: {
+                max: 1,
+                window: 60_000,
+            },
+        }));
+        app.get("/api/limited", (c) => c.json({ ok: true }));
+        const first = await app.request("/api/limited");
+        expect(first.status).toBe(200);
+        expect(first.headers.get("x-ratelimit-limit")).toBe("1");
+        expect(first.headers.get("x-ratelimit-remaining")).toBe("0");
+        const second = await app.request("/api/limited");
+        expect(second.status).toBe(429);
+        expect(second.headers.get("retry-after")).toBe("60");
+        expect(await second.json()).toMatchObject({
+            error: true,
+            message: "Too many requests. Try again later.",
+            retryAfterSeconds: 60,
+        });
+    });
+    it("should not rate limit routes outside the protected prefixes", async () => {
+        const app = await createDyrectedApp(defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            rateLimit: {
+                max: 1,
+                window: 60_000,
+            },
+        }));
+        app.get("/public", (c) => c.json({ ok: true }));
+        const first = await app.request("/public");
+        const second = await app.request("/public");
+        expect(first.status).toBe(200);
+        expect(second.status).toBe(200);
+        expect(second.headers.get("x-ratelimit-limit")).toBeNull();
+    });
+    it("should respect trustProxy when resolving the client IP", async () => {
+        const app = await createDyrectedApp(defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            rateLimit: {
+                enabled: false,
+                trustProxy: true,
+            },
+        }));
+        app.get("/api/ip", (c) => c.json({ ip: c.get("clientIp") ?? null }));
+        const trusted = await app.request("/api/ip", {
+            headers: {
+                "x-forwarded-for": "198.51.100.12, 10.0.0.1",
+            },
+        });
+        expect(await trusted.json()).toEqual({ ip: "198.51.100.12" });
+        const untrustedApp = await createDyrectedApp(defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            rateLimit: {
+                enabled: false,
+                trustProxy: false,
+            },
+        }));
+        untrustedApp.get("/api/ip", (c) => c.json({ ip: c.get("clientIp") ?? null }));
+        const untrusted = await untrustedApp.request("/api/ip", {
+            headers: {
+                "x-forwarded-for": "198.51.100.12, 10.0.0.1",
+            },
+        });
+        expect(await untrusted.json()).toEqual({ ip: "127.0.0.1" });
+    });
+    it("should trust provider client IP headers without enabling proxy mode", async () => {
+        const app = await createDyrectedApp(config);
+        app.get("/api/ip", (c) => c.json({ ip: c.get("clientIp") ?? null }));
+        const res = await app.request("/api/ip", {
+            headers: {
+                "cf-connecting-ip": "203.0.113.9",
+            },
+        });
+        expect(await res.json()).toEqual({ ip: "203.0.113.9" });
+    });
+});
+//# sourceMappingURL=app.test.js.map

package/dist/__tests__/app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.test.js","sourceRoot":"","sources":["../../src/__tests__/app.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;KAC9B,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE5C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,GAAG,GAAG,MAAM,iBAAiB,CACjC,YAAY,CAAC;YACX,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM;aACf;SACF,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACxC,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,qCAAqC;YAC9C,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CACjC,YAAY,CAAC;YACX,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM;aACf;SACF,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CACjC,YAAY,CAAC;YACX,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,SAAS,EAAE;gBACT,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,IAAI;aACjB;SACF,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YAC3C,OAAO,EAAE;gBACP,iBAAiB,EAAE,yBAAyB;aAC7C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QAE9D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAC1C,YAAY,CAAC;YACX,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,SAAS,EAAE;gBACT,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,KAAK;aAClB;SACF,CAAC,CACH,CAAC;QAEF,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAE9E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE;YACtD,OAAO,EAAE;gBACP,iBAAiB,EAAE,yBAAyB;aAC7C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE5C,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YACvC,OAAO,EAAE;gBACP,kBAAkB,EAAE,aAAa;aAClC;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit.test.d.ts.map

package/dist/__tests__/audit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/audit.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit.test.js

@@ -0,0 +1,125 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { signCollectionToken } from "../auth/token.js";
+import { defineCollection, defineConfig } from "../index.js";
+import { InMemoryAdapter } from "./mocks.js";
+beforeAll(() => {
+    process.env.DYRECTED_JWT_SECRET = "test-secret";
+});
+describe("audit routes", () => {
+    it("returns only readable audit entries for an audited collection", async () => {
+        const db = new InMemoryAdapter();
+        db.seed("users", [{ id: "user-1", email: "user1@example.com", roles: ["editor"] }]);
+        db.seed("posts", [
+            { id: "post-1", title: "Mine", owner: "user-1" },
+            { id: "post-2", title: "Theirs", owner: "user-2" },
+        ]);
+        db.seed("__audit", [
+            { id: "audit-1", collection: "posts", documentId: "post-1", operation: "create", user: "user-1", timestamp: "2026-01-01T00:00:00.000Z", changes: "{}" },
+            { id: "audit-2", collection: "posts", documentId: "post-2", operation: "update", user: "user-2", timestamp: "2026-01-02T00:00:00.000Z", changes: "{}" },
+        ]);
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [
+                defineCollection({
+                    slug: "users",
+                    auth: true,
+                    fields: [{ name: "email", type: "email" }],
+                }),
+                defineCollection({
+                    slug: "posts",
+                    audit: true,
+                    access: {
+                        read: ({ user }) => ({ owner: { equals: user?.sub } }),
+                    },
+                    fields: [
+                        { name: "title", type: "text" },
+                        { name: "owner", type: "text" },
+                    ],
+                }),
+                defineCollection({
+                    slug: "pages",
+                    fields: [{ name: "title", type: "text" }],
+                }),
+            ],
+            globals: [],
+        }));
+        const token = await signCollectionToken({
+            sub: "user-1",
+            email: "user1@example.com",
+            collection: "users",
+        });
+        const headers = { Authorization: `Bearer ${token}` };
+        const res = await app.request("/api/collections/posts/__audit", { headers });
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        expect(data.total).toBe(1);
+        expect(data.docs[0].documentId).toBe("post-1");
+        const rawAuditRes = await app.request("/api/collections/__audit", { headers });
+        expect(rawAuditRes.status).toBe(403);
+        const missingRes = await app.request("/api/collections/pages/__audit", { headers });
+        expect(missingRes.status).toBe(404);
+    });
+    it("aggregates only entries from audited collections the caller can read", async () => {
+        const db = new InMemoryAdapter();
+        db.seed("users", [{ id: "user-1", email: "user1@example.com", roles: ["editor"] }]);
+        db.seed("posts", [
+            { id: "post-1", title: "Mine", owner: "user-1" },
+            { id: "post-2", title: "Theirs", owner: "user-2" },
+        ]);
+        db.seed("comments", [{ id: "comment-1", body: "Visible" }]);
+        db.seed("secrets", [{ id: "secret-1", value: "Hidden" }]);
+        db.seed("__audit", [
+            { id: "audit-1", collection: "posts", documentId: "post-1", operation: "create", user: "user-1", timestamp: "2026-01-01T00:00:00.000Z", changes: "{}" },
+            { id: "audit-2", collection: "posts", documentId: "post-2", operation: "update", user: "user-2", timestamp: "2026-01-02T00:00:00.000Z", changes: "{}" },
+            { id: "audit-3", collection: "comments", documentId: "comment-1", operation: "create", user: null, timestamp: "2026-01-03T00:00:00.000Z", changes: "{}" },
+            { id: "audit-4", collection: "secrets", documentId: "secret-1", operation: "delete", user: "user-9", timestamp: "2026-01-04T00:00:00.000Z", changes: "{}" },
+        ]);
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [
+                defineCollection({
+                    slug: "users",
+                    auth: true,
+                    fields: [{ name: "email", type: "email" }],
+                }),
+                defineCollection({
+                    slug: "posts",
+                    audit: true,
+                    access: {
+                        read: ({ user }) => ({ owner: { equals: user?.sub } }),
+                    },
+                    fields: [
+                        { name: "title", type: "text" },
+                        { name: "owner", type: "text" },
+                    ],
+                }),
+                defineCollection({
+                    slug: "comments",
+                    audit: true,
+                    access: { read: true },
+                    fields: [{ name: "body", type: "text" }],
+                }),
+                defineCollection({
+                    slug: "secrets",
+                    audit: true,
+                    access: { read: false },
+                    fields: [{ name: "value", type: "text" }],
+                }),
+            ],
+            globals: [],
+        }));
+        const token = await signCollectionToken({
+            sub: "user-1",
+            email: "user1@example.com",
+            collection: "users",
+        });
+        const headers = { Authorization: `Bearer ${token}` };
+        const res = await app.request("/api/audit", { headers });
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        expect(data.total).toBe(2);
+        expect(data.docs.map((doc) => doc.id)).toEqual(["audit-1", "audit-3"]);
+    });
+});
+//# sourceMappingURL=audit.test.js.map

package/dist/__tests__/audit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.test.js","sourceRoot":"","sources":["../../src/__tests__/audit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,aAAa,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SACnD,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE;YACjB,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE;YACvJ,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE;SACxJ,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;iBAC3C,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE;wBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;qBACvD;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;qBAChC;iBACF,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBAC1C,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,mBAAmB;YAC1B,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE/C,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SACnD,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC5D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE;YACjB,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE;YACvJ,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE;YACvJ,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE;YACzJ,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE;SAC5J,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;iBAC3C,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE;wBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;qBACvD;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;qBAChC;iBACF,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;oBACtB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBACzC,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;oBACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBAC1C,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,mBAAmB;YAC1B,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAErD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/auth-hydration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-hydration.test.d.ts.map

package/dist/__tests__/auth-hydration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-hydration.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth-hydration.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth-hydration.test.js

@@ -0,0 +1,90 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { Hono } from "hono";
+import { requireAuth, optionalAuth } from "../middleware/auth.js";
+import { signCollectionToken } from "../auth/token.js";
+import { InMemoryAdapter } from "./mocks.js";
+/**
+ * The JWT only carries identity claims (sub/email/collection). These tests lock in that
+ * the auth middleware re-hydrates the full user record from the database so access
+ * functions and hooks can read collection fields like `roles`.
+ */
+describe("Auth middleware user hydration", () => {
+    process.env.DYRECTED_JWT_SECRET = "my-test-secret-that-is-at-least-32-chars-long";
+    const db = new InMemoryAdapter();
+    const config = { db };
+    // Minimal app that echoes the resolved user so we can inspect what access functions
+    // and hooks would receive.
+    function makeApp() {
+        const app = new Hono();
+        app.use("*", async (c, next) => {
+            c.set("config", config);
+            await next();
+        });
+        app.use("*", optionalAuth(config));
+        app.get("/whoami", (c) => c.json({ user: c.get("user") ?? null }));
+        app.get("/protected", requireAuth(config), (c) => c.json({ user: c.get("user") }));
+        return app;
+    }
+    const app = makeApp();
+    beforeEach(() => {
+        db.store = {};
+    });
+    async function tokenFor(id) {
+        const user = await db.create({
+            collection: "users",
+            data: { id, email: `${id}@test.com`, password: "hashed-secret", roles: ["admin"] },
+        });
+        // Note: the token is signed with identity claims ONLY — no roles.
+        return signCollectionToken({ sub: user.id, email: user.email, collection: "users" });
+    }
+    it("hydrates roles (and other fields) from the DB even though the token omits them", async () => {
+        const token = await tokenFor("u1");
+        const res = await app.request("/whoami", {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.user).toBeTruthy();
+        expect(body.user.roles).toEqual(["admin"]);
+        expect(body.user.sub).toBe("u1");
+        expect(body.user.email).toBe("u1@test.com");
+        expect(body.user.collection).toBe("users");
+    });
+    it("never exposes the password field on the resolved user", async () => {
+        const token = await tokenFor("u2");
+        const res = await app.request("/whoami", {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const body = await res.json();
+        expect(body.user.password).toBeUndefined();
+    });
+    it("treats a valid token for a deleted user as unauthenticated", async () => {
+        const token = await tokenFor("u3");
+        // Delete the underlying record; the token is still cryptographically valid.
+        db.store = {};
+        // optionalAuth: proceeds without a user.
+        const open = await app.request("/whoami", {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        expect((await open.json()).user).toBeNull();
+        // requireAuth: rejects.
+        const guarded = await app.request("/protected", {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        expect(guarded.status).toBe(401);
+    });
+    it("still requires a token on protected routes", async () => {
+        const res = await app.request("/protected");
+        expect(res.status).toBe(401);
+    });
+    it("resolves the full user on protected routes", async () => {
+        const token = await tokenFor("u4");
+        const res = await app.request("/protected", {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.user.roles).toEqual(["admin"]);
+    });
+});
+//# sourceMappingURL=auth-hydration.test.js.map

package/dist/__tests__/auth-hydration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-hydration.test.js","sourceRoot":"","sources":["../../src/__tests__/auth-hydration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,+CAA+C,CAAC;IAElF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,EAAE,EAAS,CAAC;IAE7B,oFAAoF;IACpF,2BAA2B;IAC3B,SAAS,OAAO;QACd,MAAM,GAAG,GAAG,IAAI,IAAI,EAAmB,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC7B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,UAAU,CAAC,GAAG,EAAE;QACb,EAAU,CAAC,KAAK,GAAG,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC3B,UAAU,EAAE,OAAO;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;SACnF,CAAC,CAAC;QACH,kEAAkE;QAClE,OAAO,mBAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,4EAA4E;QAC3E,EAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAEvB,yCAAyC;QACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAE5C,wBAAwB;QACxB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE;YAC9C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE;YAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/auth-invite.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-invite.test.d.ts.map

package/dist/__tests__/auth-invite.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-invite.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth-invite.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth-invite.test.js

@@ -0,0 +1,152 @@
+import { describe, expect, it, vi } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { hashPassword } from "../auth/password.js";
+import { defineCollection, defineConfig } from "../index.js";
+import { InMemoryAdapter } from "./mocks.js";
+describe("auth invite flow", () => {
+    async function createAuthApp() {
+        process.env.DYRECTED_JWT_SECRET = "dyrected-test-secret";
+        const db = new InMemoryAdapter();
+        const emailSend = vi.fn().mockResolvedValue(undefined);
+        const app = await createDyrectedApp(defineConfig({
+            collections: [
+                defineCollection({
+                    slug: "users",
+                    auth: true,
+                    fields: [{ name: "name", type: "text" }],
+                }),
+            ],
+            globals: [],
+            db,
+            email: {
+                from: "test@example.com",
+                send: emailSend,
+            },
+        }));
+        return { app, db, emailSend };
+    }
+    async function loginAsAdmin(app) {
+        const loginRes = await app.request("/api/collections/users/login", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                email: "admin@example.com",
+                password: "correct-password",
+            }),
+        });
+        const loginBody = await loginRes.json();
+        return loginBody.token;
+    }
+    it("creates a pending user record when inviting someone new", async () => {
+        const { app, db, emailSend } = await createAuthApp();
+        db.seed("users", [
+            {
+                id: "admin_1",
+                email: "admin@example.com",
+                password: await hashPassword("correct-password"),
+                roles: ["admin"],
+                status: "active",
+            },
+        ]);
+        const adminToken = await loginAsAdmin(app);
+        const res = await app.request("/api/collections/users/invite", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${adminToken}`,
+            },
+            body: JSON.stringify({
+                email: "invitee@example.com",
+                inviteUrl: "https://cms.example.com/admin",
+            }),
+        });
+        expect(res.status).toBe(200);
+        const body = await res.json();
+        expect(body.inviteUrl).toContain("inviteToken=");
+        const created = await db.find({
+            collection: "users",
+            where: { email: "invitee@example.com" },
+            limit: 1,
+        });
+        expect(created.total).toBe(1);
+        expect(created.docs[0]?.status).toBe("pending");
+        expect(typeof created.docs[0]?.password).toBe("string");
+        expect(emailSend).toHaveBeenCalledTimes(1);
+        expect(emailSend.mock.calls[0]?.[0]?.html).toContain("Accept invitation");
+    });
+    it("blocks login for pending invited users", async () => {
+        const { app, db } = await createAuthApp();
+        db.seed("users", [
+            {
+                id: "invitee_1",
+                email: "invitee@example.com",
+                password: "salt:hash",
+                status: "pending",
+            },
+        ]);
+        const res = await app.request("/api/collections/users/login", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                email: "invitee@example.com",
+                password: "anything",
+            }),
+        });
+        expect(res.status).toBe(403);
+        expect(await res.json()).toMatchObject({
+            error: true,
+            message: "This invitation has not been accepted yet.",
+        });
+    });
+    it("accepts an invite by activating the existing pending user", async () => {
+        const { app, db } = await createAuthApp();
+        db.seed("users", [
+            {
+                id: "admin_1",
+                email: "admin@example.com",
+                password: await hashPassword("correct-password"),
+                roles: ["admin"],
+                status: "active",
+            },
+            {
+                id: "invitee_1",
+                email: "invitee@example.com",
+                password: "salt:hash",
+                status: "pending",
+            },
+        ]);
+        const adminToken = await loginAsAdmin(app);
+        const inviteRes = await app.request("/api/collections/users/invite", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${adminToken}`,
+            },
+            body: JSON.stringify({
+                email: "invitee@example.com",
+                inviteUrl: "https://cms.example.com/admin",
+            }),
+        });
+        const inviteBody = await inviteRes.json();
+        const acceptRes = await app.request("/api/collections/users/accept-invite", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                token: inviteBody.token,
+                password: "StrongPass123!",
+                name: "Invited User",
+            }),
+        });
+        expect(acceptRes.status).toBe(201);
+        const users = await db.find({
+            collection: "users",
+            where: { email: "invitee@example.com" },
+            limit: 10,
+        });
+        expect(users.total).toBe(1);
+        expect(users.docs[0]?.id).toBe("invitee_1");
+        expect(users.docs[0]?.status).toBe("active");
+        expect(users.docs[0]?.name).toBe("Invited User");
+    });
+});
+//# sourceMappingURL=auth-invite.test.js.map

package/dist/__tests__/auth-invite.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-invite.test.js","sourceRoot":"","sources":["../../src/__tests__/auth-invite.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,KAAK,UAAU,aAAa;QAC1B,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,sBAAsB,CAAC;QAEzD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CACjC,YAAY,CAAC;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBACzC,CAAC;aACH;YACD,OAAO,EAAE,EAAE;YACX,EAAE;YACF,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,SAAS;aAChB;SACF,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,GAAqD;QAC/E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,8BAA8B,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,kBAAkB;aAC7B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC,KAAe,CAAC;IACnC,CAAC;IAED,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QAErD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,MAAM,YAAY,CAAC,kBAAkB,CAAC;gBAChD,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,MAAM,EAAE,QAAQ;aACjB;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,UAAU,EAAE;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,SAAS,EAAE,+BAA+B;aAC3C,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YAC5B,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE;YACvC,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QAE1C,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,qBAAqB;gBAC5B,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,SAAS;aAClB;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,8BAA8B,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,QAAQ,EAAE,UAAU;aACrB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACrC,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QAE1C,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf;gBACE,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,MAAM,YAAY,CAAC,kBAAkB,CAAC;gBAChD,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,MAAM,EAAE,QAAQ;aACjB;YACD;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,qBAAqB;gBAC5B,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,SAAS;aAClB;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,UAAU,EAAE;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,SAAS,EAAE,+BAA+B;aAC3C,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAE1C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,sCAAsC,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,QAAQ,EAAE,gBAAgB;gBAC1B,IAAI,EAAE,cAAc;aACrB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YAC1B,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE;YACvC,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/auth-lockout.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-lockout.test.d.ts.map

package/dist/__tests__/auth-lockout.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lockout.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth-lockout.test.ts"],"names":[],"mappings":""}