@edge-base/server 0.2.8 → 0.3.1

package/src/__tests__/email-provider.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
+  CloudflareEmailProvider,
   SESProvider,
   SendGridProvider,
   createEmailProvider,
@@ -78,6 +79,87 @@ describe('SendGridProvider', () => {
   });
 });
 
+describe('CloudflareEmailProvider', () => {
+  it('uses the Workers send_email binding when available', async () => {
+    const send = vi.fn().mockResolvedValue({ messageId: 'cf-binding-1' });
+
+    const provider = createEmailProvider(
+      { provider: 'cloudflare', from: 'noreply@example.com' },
+      { EMAIL: { send } },
+    );
+    expect(provider).not.toBeNull();
+
+    const result = await provider!.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: true, messageId: 'cf-binding-1' });
+    expect(send).toHaveBeenCalledWith({
+      to: 'user@example.com',
+      from: 'noreply@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+  });
+
+  it('sends through the Cloudflare Email Service REST API when no binding exists', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({
+        success: true,
+        errors: [],
+        messages: [],
+        result: { delivered: ['user@example.com'], permanent_bounces: [], queued: [] },
+      }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const provider = new CloudflareEmailProvider({
+      from: 'noreply@example.com',
+      accountId: 'acct-1',
+      apiKey: 'cf-token',
+    });
+    const result = await provider.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: true });
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://api.cloudflare.com/client/v4/accounts/acct-1/email/sending/send',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          Authorization: 'Bearer cf-token',
+          'Content-Type': 'application/json',
+        }),
+      }),
+    );
+  });
+
+  it('fails without REST credentials when no Workers binding exists', async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+
+    const provider = createEmailProvider({ provider: 'cloudflare', from: 'noreply@example.com' });
+    expect(provider).not.toBeNull();
+
+    const result = await provider!.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: false });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
 describe('SESProvider', () => {
   it('signs the outbound request with AWS SigV4 headers', async () => {
     const fetchMock = vi.fn().mockResolvedValue(

package/src/__tests__/functions-context.test.ts

@@ -10,6 +10,28 @@ describe('buildFunctionContext admin.db', () => {
     vi.unstubAllGlobals();
   });
 
+  it('exposes worker environment values to app functions', async () => {
+    const env = {
+      NOTION_IMPORT_SECRET: 'test-secret',
+      CUSTOM_BINDING: { id: 'binding' },
+    };
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/feed-summary'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        databases: {},
+      },
+      env: env as never,
+    });
+
+    expect(ctx.env?.NOTION_IMPORT_SECRET).toBe('test-secret');
+    expect(ctx.env?.CUSTOM_BINDING).toBe(env.CUSTOM_BINDING);
+  });
+
   it('routes table proxy calls through the worker when workerUrl is available', async () => {
     const fetchMock = vi.fn().mockResolvedValue(
       new Response(JSON.stringify({ items: [{ id: 'p1' }] }), {
@@ -197,6 +219,71 @@ describe('buildFunctionContext admin.db', () => {
     );
   });
 
+  it('exposes the configured email provider to app functions', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ messageId: 'msg_1' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/send-invite'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        email: {
+          provider: 'cloudflare',
+          from: 'noreply@example.com',
+        },
+      },
+      env: {
+        EDGEBASE_EMAIL_API_URL: 'http://mail.local',
+      } as never,
+    });
+
+    expect(ctx.email).toBeDefined();
+    await expect(
+      ctx.email?.send({
+        to: 'member@example.com',
+        subject: 'Workspace invite',
+        html: '<p>Join the workspace</p>',
+      }),
+    ).resolves.toEqual({ success: true, messageId: 'msg_1' });
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'http://mail.local/send',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'Content-Type': 'application/json',
+        }),
+        body: JSON.stringify({
+          from: 'noreply@example.com',
+          to: 'member@example.com',
+          subject: 'Workspace invite',
+          html: '<p>Join the workspace</p>',
+        }),
+      }),
+    );
+  });
+
+  it('omits the email sender when no provider is configured', () => {
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/no-email'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {},
+    });
+
+    expect(ctx.email).toBeUndefined();
+  });
+
   it('rejects instance ids for single-instance admin.sqlProviderAware calls before touching direct backends', async () => {
     const fetchMock = vi.fn();
     vi.stubGlobal('fetch', fetchMock);

package/src/__tests__/functions-d1-proxy.test.ts

@@ -227,6 +227,76 @@ describe('buildFunctionContext admin.db D1 routing', () => {
     expect(databaseFetch).not.toHaveBeenCalled();
   });
 
+  it('falls back to the database durable object for implicit D1 namespaces when the D1 binding is absent', async () => {
+    const handleD1Request = vi.fn().mockRejectedValue(new Error('D1 handler should not be used'));
+    vi.doMock('../lib/d1-handler.js', () => ({
+      handleD1Request,
+    }));
+
+    const workerFetch = vi.fn().mockRejectedValue(new Error('worker fetch should not be used'));
+    vi.stubGlobal('fetch', workerFetch);
+
+    const databaseFetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ items: [{ id: 'sig-do', title: 'Read via DO' }] }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    const databaseNamespace = {
+      idFromName: vi.fn(() => 'shared-id'),
+      get: vi.fn(() => ({ fetch: databaseFetch })),
+    } as unknown as DurableObjectNamespace;
+
+    const { buildFunctionContext } = await import('../lib/functions.js');
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/save-room-signal'),
+      auth: null,
+      databaseNamespace,
+      authNamespace: {
+        idFromName: vi.fn(() => 'auth-id'),
+        get: vi.fn(() => ({ fetch: vi.fn() })),
+      } as unknown as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      env: {
+        DATABASE: databaseNamespace,
+        AUTH: {} as DurableObjectNamespace,
+        AUTH_DB: {} as D1Database,
+      } as never,
+      executionCtx: { waitUntil: vi.fn() } as unknown as ExecutionContext,
+      config: {
+        databases: {
+          shared: {
+            tables: {
+              signals: {
+                schema: {
+                  title: { type: 'string', required: true },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const result = await ctx.admin.db('shared').table('signals').getList();
+
+    expect(result.items).toEqual([{ id: 'sig-do', title: 'Read via DO' }]);
+    expect(handleD1Request).not.toHaveBeenCalled();
+    expect(workerFetch).not.toHaveBeenCalled();
+    expect(databaseNamespace.idFromName).toHaveBeenCalledWith('shared');
+    expect(databaseFetch).toHaveBeenCalledWith(
+      'http://do/tables/signals',
+      expect.objectContaining({
+        method: 'GET',
+        headers: expect.objectContaining({
+          'X-DO-Name': 'shared',
+          'X-EdgeBase-Internal': 'true',
+        }),
+      }),
+    );
+  });
+
   it('rejects instance ids for single-instance namespaces before touching D1 handlers', async () => {
     const handleD1Request = vi.fn();
     vi.doMock('../lib/d1-handler.js', () => ({

package/src/__tests__/functions-route.test.ts

@@ -8,6 +8,7 @@ import {
   rebuildCompiledRoutes,
   registerFunction,
   registerMiddleware,
+  wrapMethodExport,
 } from '../lib/functions.js';
 import { functionsRoute } from '../routes/functions.js';
 import type { Env } from '../types.js';
@@ -104,6 +105,20 @@ afterEach(() => {
   setConfig({});
 });
 
+describe('function registry wrapping', () => {
+  it('preserves full default-export function definitions with non-HTTP triggers', () => {
+    const scheduleFunction: FunctionDefinition = {
+      trigger: { type: 'schedule', cron: '*/15 * * * *' },
+      handler: async () => ({ ok: true }),
+    };
+
+    const wrapped = wrapMethodExport(scheduleFunction, '*');
+
+    expect(wrapped).toBe(scheduleFunction);
+    expect(wrapped.trigger).toEqual({ type: 'schedule', cron: '*/15 * * * *' });
+  });
+});
+
 describe('functionsRoute FunctionError compatibility', () => {
   it('returns structured JSON when directory middleware throws a foreign FunctionError', async () => {
     registerMiddleware('', async () => {

package/src/__tests__/room-access-policy.test.ts

@@ -98,4 +98,30 @@ describe('Room route access policy', () => {
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toEqual({ visibility: 'public' });
   });
+
+  it('passes admin context into metadata access rules', async () => {
+    setConfig(defineConfig({
+      release: true,
+      rooms: {
+        game: {
+          access: {
+            metadata: (_auth, roomId, ctx) =>
+              roomId === 'room-1' && typeof ctx.admin.db === 'function',
+          },
+        },
+      },
+    }));
+
+    const app = createApp({
+      id: 'user-1',
+      role: 'user',
+      isAnonymous: false,
+    });
+    const response = await app.request('/api/room/metadata?namespace=game&id=room-1', {
+      method: 'GET',
+    }, createRoomEnv());
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ visibility: 'public' });
+  });
 });

package/src/__tests__/room-handler-context.test.ts

@@ -37,6 +37,7 @@ describe('RoomsDO handler context', () => {
     room.config = {
       databases: {
         shared: {
+          provider: 'do',
           tables: {
             signals: {
               schema: {
@@ -93,6 +94,7 @@ describe('RoomsDO handler context', () => {
     room.config = {
       databases: {
         shared: {
+          provider: 'do',
           tables: {
             signals: {
               schema: {

package/src/__tests__/smoke-skip-report.test.ts

@@ -38,7 +38,7 @@ describe('smoke skip report', () => {
       {
         "skippedRouteCount": 0,
         "summaryByReason": {},
-        "totalRoutes": 190,
+        "totalRoutes": 191,
       }
     `);
   });

package/src/durable-objects/room-runtime-base.ts

@@ -52,6 +52,33 @@ export interface RoomWSMeta {
   lastSeenAt?: number;
 }
 
+function normalizeAnonymousRoomAuthPayload(value: unknown): SharedAuthContext | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+
+  const typed = value as Record<string, unknown>;
+  if (typed.type !== 'anonymous' || typeof typed.subject !== 'string' || typed.subject.trim().length === 0) {
+    return null;
+  }
+
+  const subject = typed.subject.trim();
+  return {
+    id: subject,
+    role: typeof typed.role === 'string' && typed.role.trim().length > 0 ? typed.role.trim() : undefined,
+    email: typeof typed.email === 'string' && typed.email.trim().length > 0 ? typed.email.trim() : undefined,
+    isAnonymous: typed.isAnonymous !== false,
+    custom:
+      typed.custom && typeof typed.custom === 'object' && !Array.isArray(typed.custom)
+        ? (typed.custom as Record<string, unknown>)
+        : undefined,
+    meta:
+      typed.meta && typeof typed.meta === 'object' && !Array.isArray(typed.meta)
+        ? (typed.meta as Record<string, unknown>)
+        : undefined,
+  };
+}
+
 interface PersistedRoomWSAttachment {
   version: 1;
   meta: RoomWSMeta;
@@ -489,7 +516,12 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
 
     // Auth must be first
     if (type === 'auth') {
-      await this.handleAuth(ws, meta, msg.token as string);
+      await this.handleAuth(
+        ws,
+        meta,
+        typeof msg.token === 'string' ? msg.token : undefined,
+        msg.authPayload,
+      );
       return;
     }
 
@@ -765,15 +797,53 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
 
   // ─── Auth Handler ───
 
-  private async handleAuth(ws: WebSocket, meta: RoomWSMeta, token: string): Promise<void> {
+  private async handleAuth(
+    ws: WebSocket,
+    meta: RoomWSMeta,
+    token?: string,
+    authPayload?: unknown,
+  ): Promise<void> {
     const isReAuth = meta.authenticated;
 
-    if (!token) {
+    const anonymousAuth = !token ? normalizeAnonymousRoomAuthPayload(authPayload) : null;
+    if (!token && !anonymousAuth) {
       this.safeSend(ws, { type: 'error', code: 'AUTH_FAILED', message: 'Token required' });
       ws.close(4002, 'Authentication failed');
       return;
     }
 
+    if (anonymousAuth) {
+      meta.authenticated = true;
+      meta.authStateLost = false;
+      meta.lastSeenAt = Date.now();
+      meta.userId = anonymousAuth.id;
+      meta.role = anonymousAuth.role;
+      meta.auth = anonymousAuth;
+      this.setWSMeta(ws, meta);
+
+      if (this.pendingAuth.delete(meta.connectionId)) {
+        this.syncEphemeralTimersToStorage();
+        this._scheduleNextAlarm();
+      }
+
+      if (!isReAuth && meta.userId) {
+        if (this.disconnectTimers.delete(meta.userId)) {
+          this.syncEphemeralTimersToStorage();
+          this._scheduleNextAlarm();
+        }
+        this.addPlayer(meta.connectionId, meta.userId);
+      }
+
+      this.safeSend(ws, {
+        type: isReAuth ? 'auth_refreshed' : 'auth_success',
+        userId: anonymousAuth.id,
+        connectionId: meta.connectionId,
+      });
+      this.syncRoomMonitoringSnapshot();
+      await this.recoverStateIfNeeded();
+      return;
+    }
+
     const secret = this.env.JWT_USER_SECRET;
     if (!secret) {
       this.safeSend(ws, { type: 'error', code: 'SERVER_ERROR', message: 'JWT secret not configured' });
@@ -782,14 +852,15 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
     }
 
     try {
+      const accessToken = token as string;
       const headers = new Headers();
       if (meta.ip) headers.set('CF-Connecting-IP', meta.ip);
       if (meta.userAgent) headers.set('User-Agent', meta.userAgent);
-      headers.set('Authorization', `Bearer ${token}`);
+      headers.set('Authorization', `Bearer ${accessToken}`);
       const { resolveAuthContextFromToken } = await import('../middleware/auth.js');
       const auth = await resolveAuthContextFromToken(
         this.env,
-        token,
+        accessToken,
         new Request('http://internal/api/room/auth', { headers }),
       );
       meta.authenticated = true;
@@ -891,7 +962,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
     }
     if (joinAccess && this.roomId) {
       try {
-        const allowed = await Promise.resolve(joinAccess(this.buildAuthFromMeta(meta), this.roomId));
+        const accessCtx = await this.buildHandlerContext();
+        const allowed = await Promise.resolve(joinAccess(this.buildAuthFromMeta(meta), this.roomId, accessCtx));
         if (!allowed) {
           this.safeSend(ws, {
             type: 'error',
@@ -901,11 +973,19 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
           ws.close(4003, 'Join denied');
           return;
         }
-      } catch {
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        console.error('[Room] join access rule failed', {
+          room: this.namespace && this.roomId ? `${this.namespace}::${this.roomId}` : null,
+          connectionId: meta.connectionId,
+          userId: meta.userId ?? null,
+          message: detail,
+          stack: error instanceof Error ? error.stack : undefined,
+        });
         this.safeSend(ws, {
           type: 'error',
           code: 'JOIN_DENIED',
-          message: 'Denied by room join access rule',
+          message: this.config.release ? 'Denied by room join access rule' : `Denied by room join access rule: ${detail}`,
         });
         ws.close(4003, 'Join denied');
         return;
@@ -1040,11 +1120,13 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
     }
     if (actionAccess && this.roomId) {
       try {
+        const accessCtx = await this.buildHandlerContext();
         const allowed = await Promise.resolve(actionAccess(
           this.buildAuthFromMeta(meta),
           this.roomId,
           actionType,
           payload,
+          accessCtx,
         ));
         if (!allowed) {
           this.safeSend(ws, {
@@ -1329,8 +1411,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
       env: this.env as never,
       executionCtx: this.ctx as never,
       serviceKey: resolveRootServiceKey(this.config, this.env as never),
-      // Room handlers run inside a DO and should always talk to DB DOs directly.
-      preferDirectDoDb: true,
+      // Keep room handler DB access provider-aware. Static D1/Postgres apps must
+      // read the same store as function routes, while DO-backed DBs still use DOs.
     });
     return {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -1345,7 +1427,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
       userId: meta.userId!,
       connectionId: meta.connectionId,
       role: meta.role,
-    };
+      auth: this.buildAuthFromMeta(meta),
+    } as RoomSender;
   }
 
   protected buildAuthFromMeta(meta: RoomWSMeta): SharedAuthContext {

package/src/durable-objects/rooms-do.ts

@@ -801,12 +801,14 @@ export class RoomsDO extends RoomRuntimeBaseDO {
     }
 
     try {
+      const accessCtx = await this.buildHandlerContext();
       return await Promise.resolve(
         this.namespaceConfig.access.signal(
           this.buildAuthFromMeta(meta),
           this.roomId,
           event,
           payload,
+          accessCtx,
         ),
       );
     } catch {
@@ -948,8 +950,9 @@ export class RoomsDO extends RoomRuntimeBaseDO {
     }
 
     try {
+      const accessCtx = await this.buildHandlerContext();
       return await Promise.resolve(
-        adminAccess(this.buildAuthFromMeta(meta), this.roomId, operation, payload),
+        adminAccess(this.buildAuthFromMeta(meta), this.roomId, operation, payload, accessCtx),
       );
     } catch {
       return false;

package/src/lib/auth-d1-service.ts

@@ -14,6 +14,7 @@
  */
 
 import type { AuthDb } from './auth-db-adapter.js';
+import { authSecretLookupKeys, hashAuthSecret } from './auth-token.js';
 
 // ─── Types ───
 
@@ -660,11 +661,12 @@ export async function createEmailToken(
   input: CreateEmailTokenInput,
 ): Promise<void> {
   const now = new Date().toISOString();
+  const tokenHash = await hashAuthSecret(input.token);
 
   await db.run(
     `INSERT INTO _email_tokens (token, userId, type, expiresAt, createdAt)
      VALUES (?, ?, ?, ?, ?)`,
-    [input.token, input.userId, input.type, input.expiresAt, now],
+    [tokenHash, input.userId, input.type, input.expiresAt, now],
   );
 }
 
@@ -676,9 +678,10 @@ export async function getEmailToken(
   db: AuthDb,
   token: string,
 ): Promise<Record<string, unknown> | null> {
+  const lookupKeys = await authSecretLookupKeys(token);
   const row = await db.first(
-    `SELECT * FROM _email_tokens WHERE token = ?`,
-    [token],
+    `SELECT * FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+    lookupKeys,
   );
 
   if (!row) return null;
@@ -686,7 +689,10 @@ export async function getEmailToken(
   // Check expiration
   if (new Date(row.expiresAt as string) < new Date()) {
     // Clean up expired token
-    await db.run(`DELETE FROM _email_tokens WHERE token = ?`, [token]);
+    await db.run(
+      `DELETE FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+      lookupKeys,
+    );
     return null;
   }
 
@@ -702,9 +708,10 @@ export async function getEmailTokenByType(
   token: string,
   type: string,
 ): Promise<Record<string, unknown> | null> {
+  const lookupKeys = await authSecretLookupKeys(token);
   return await db.first(
-    `SELECT * FROM _email_tokens WHERE token = ? AND type = ?`,
-    [token, type],
+    `SELECT * FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')}) AND type = ?`,
+    [...lookupKeys, type],
   );
 }
 
@@ -715,7 +722,11 @@ export async function deleteEmailToken(
   db: AuthDb,
   token: string,
 ): Promise<void> {
-  await db.run(`DELETE FROM _email_tokens WHERE token = ?`, [token]);
+  const lookupKeys = await authSecretLookupKeys(token);
+  await db.run(
+    `DELETE FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+    lookupKeys,
+  );
 }
 
 /**
@@ -923,6 +934,25 @@ export async function createRecoveryCodes(
   );
 }
 
+/**
+ * Replace all recovery codes for a user with a freshly generated batch.
+ */
+export async function replaceRecoveryCodes(
+  db: AuthDb,
+  userId: string,
+  codes: Array<{ id: string; codeHash: string }>,
+): Promise<void> {
+  const now = new Date().toISOString();
+  await db.batch([
+    { sql: `DELETE FROM _mfa_recovery_codes WHERE userId = ?`, params: [userId] },
+    ...codes.map((code) => ({
+      sql: `INSERT INTO _mfa_recovery_codes (id, userId, codeHash, used, createdAt)
+         VALUES (?, ?, ?, 0, ?)`,
+      params: [code.id, userId, code.codeHash, now],
+    })),
+  ]);
+}
+
 /**
  * List unused recovery codes for a user.
  */