@edge-base/server 0.2.9 → 0.3.1

package/src/__tests__/email-provider.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
+  CloudflareEmailProvider,
   SESProvider,
   SendGridProvider,
   createEmailProvider,
@@ -78,6 +79,87 @@ describe('SendGridProvider', () => {
   });
 });
 
+describe('CloudflareEmailProvider', () => {
+  it('uses the Workers send_email binding when available', async () => {
+    const send = vi.fn().mockResolvedValue({ messageId: 'cf-binding-1' });
+
+    const provider = createEmailProvider(
+      { provider: 'cloudflare', from: 'noreply@example.com' },
+      { EMAIL: { send } },
+    );
+    expect(provider).not.toBeNull();
+
+    const result = await provider!.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: true, messageId: 'cf-binding-1' });
+    expect(send).toHaveBeenCalledWith({
+      to: 'user@example.com',
+      from: 'noreply@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+  });
+
+  it('sends through the Cloudflare Email Service REST API when no binding exists', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({
+        success: true,
+        errors: [],
+        messages: [],
+        result: { delivered: ['user@example.com'], permanent_bounces: [], queued: [] },
+      }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const provider = new CloudflareEmailProvider({
+      from: 'noreply@example.com',
+      accountId: 'acct-1',
+      apiKey: 'cf-token',
+    });
+    const result = await provider.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: true });
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://api.cloudflare.com/client/v4/accounts/acct-1/email/sending/send',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          Authorization: 'Bearer cf-token',
+          'Content-Type': 'application/json',
+        }),
+      }),
+    );
+  });
+
+  it('fails without REST credentials when no Workers binding exists', async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+
+    const provider = createEmailProvider({ provider: 'cloudflare', from: 'noreply@example.com' });
+    expect(provider).not.toBeNull();
+
+    const result = await provider!.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: false });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
 describe('SESProvider', () => {
   it('signs the outbound request with AWS SigV4 headers', async () => {
     const fetchMock = vi.fn().mockResolvedValue(

package/src/__tests__/functions-context.test.ts

@@ -10,6 +10,28 @@ describe('buildFunctionContext admin.db', () => {
     vi.unstubAllGlobals();
   });
 
+  it('exposes worker environment values to app functions', async () => {
+    const env = {
+      NOTION_IMPORT_SECRET: 'test-secret',
+      CUSTOM_BINDING: { id: 'binding' },
+    };
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/feed-summary'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        databases: {},
+      },
+      env: env as never,
+    });
+
+    expect(ctx.env?.NOTION_IMPORT_SECRET).toBe('test-secret');
+    expect(ctx.env?.CUSTOM_BINDING).toBe(env.CUSTOM_BINDING);
+  });
+
   it('routes table proxy calls through the worker when workerUrl is available', async () => {
     const fetchMock = vi.fn().mockResolvedValue(
       new Response(JSON.stringify({ items: [{ id: 'p1' }] }), {
@@ -197,6 +219,71 @@ describe('buildFunctionContext admin.db', () => {
     );
   });
 
+  it('exposes the configured email provider to app functions', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ messageId: 'msg_1' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/send-invite'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        email: {
+          provider: 'cloudflare',
+          from: 'noreply@example.com',
+        },
+      },
+      env: {
+        EDGEBASE_EMAIL_API_URL: 'http://mail.local',
+      } as never,
+    });
+
+    expect(ctx.email).toBeDefined();
+    await expect(
+      ctx.email?.send({
+        to: 'member@example.com',
+        subject: 'Workspace invite',
+        html: '<p>Join the workspace</p>',
+      }),
+    ).resolves.toEqual({ success: true, messageId: 'msg_1' });
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'http://mail.local/send',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'Content-Type': 'application/json',
+        }),
+        body: JSON.stringify({
+          from: 'noreply@example.com',
+          to: 'member@example.com',
+          subject: 'Workspace invite',
+          html: '<p>Join the workspace</p>',
+        }),
+      }),
+    );
+  });
+
+  it('omits the email sender when no provider is configured', () => {
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/no-email'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {},
+    });
+
+    expect(ctx.email).toBeUndefined();
+  });
+
   it('rejects instance ids for single-instance admin.sqlProviderAware calls before touching direct backends', async () => {
     const fetchMock = vi.fn();
     vi.stubGlobal('fetch', fetchMock);

package/src/__tests__/functions-d1-proxy.test.ts

@@ -227,6 +227,76 @@ describe('buildFunctionContext admin.db D1 routing', () => {
     expect(databaseFetch).not.toHaveBeenCalled();
   });
 
+  it('falls back to the database durable object for implicit D1 namespaces when the D1 binding is absent', async () => {
+    const handleD1Request = vi.fn().mockRejectedValue(new Error('D1 handler should not be used'));
+    vi.doMock('../lib/d1-handler.js', () => ({
+      handleD1Request,
+    }));
+
+    const workerFetch = vi.fn().mockRejectedValue(new Error('worker fetch should not be used'));
+    vi.stubGlobal('fetch', workerFetch);
+
+    const databaseFetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ items: [{ id: 'sig-do', title: 'Read via DO' }] }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    const databaseNamespace = {
+      idFromName: vi.fn(() => 'shared-id'),
+      get: vi.fn(() => ({ fetch: databaseFetch })),
+    } as unknown as DurableObjectNamespace;
+
+    const { buildFunctionContext } = await import('../lib/functions.js');
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/save-room-signal'),
+      auth: null,
+      databaseNamespace,
+      authNamespace: {
+        idFromName: vi.fn(() => 'auth-id'),
+        get: vi.fn(() => ({ fetch: vi.fn() })),
+      } as unknown as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      env: {
+        DATABASE: databaseNamespace,
+        AUTH: {} as DurableObjectNamespace,
+        AUTH_DB: {} as D1Database,
+      } as never,
+      executionCtx: { waitUntil: vi.fn() } as unknown as ExecutionContext,
+      config: {
+        databases: {
+          shared: {
+            tables: {
+              signals: {
+                schema: {
+                  title: { type: 'string', required: true },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const result = await ctx.admin.db('shared').table('signals').getList();
+
+    expect(result.items).toEqual([{ id: 'sig-do', title: 'Read via DO' }]);
+    expect(handleD1Request).not.toHaveBeenCalled();
+    expect(workerFetch).not.toHaveBeenCalled();
+    expect(databaseNamespace.idFromName).toHaveBeenCalledWith('shared');
+    expect(databaseFetch).toHaveBeenCalledWith(
+      'http://do/tables/signals',
+      expect.objectContaining({
+        method: 'GET',
+        headers: expect.objectContaining({
+          'X-DO-Name': 'shared',
+          'X-EdgeBase-Internal': 'true',
+        }),
+      }),
+    );
+  });
+
   it('rejects instance ids for single-instance namespaces before touching D1 handlers', async () => {
     const handleD1Request = vi.fn();
     vi.doMock('../lib/d1-handler.js', () => ({

package/src/__tests__/functions-route.test.ts

@@ -8,6 +8,7 @@ import {
   rebuildCompiledRoutes,
   registerFunction,
   registerMiddleware,
+  wrapMethodExport,
 } from '../lib/functions.js';
 import { functionsRoute } from '../routes/functions.js';
 import type { Env } from '../types.js';
@@ -104,6 +105,20 @@ afterEach(() => {
   setConfig({});
 });
 
+describe('function registry wrapping', () => {
+  it('preserves full default-export function definitions with non-HTTP triggers', () => {
+    const scheduleFunction: FunctionDefinition = {
+      trigger: { type: 'schedule', cron: '*/15 * * * *' },
+      handler: async () => ({ ok: true }),
+    };
+
+    const wrapped = wrapMethodExport(scheduleFunction, '*');
+
+    expect(wrapped).toBe(scheduleFunction);
+    expect(wrapped.trigger).toEqual({ type: 'schedule', cron: '*/15 * * * *' });
+  });
+});
+
 describe('functionsRoute FunctionError compatibility', () => {
   it('returns structured JSON when directory middleware throws a foreign FunctionError', async () => {
     registerMiddleware('', async () => {

package/src/__tests__/room-access-policy.test.ts

@@ -98,4 +98,30 @@ describe('Room route access policy', () => {
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toEqual({ visibility: 'public' });
   });
+
+  it('passes admin context into metadata access rules', async () => {
+    setConfig(defineConfig({
+      release: true,
+      rooms: {
+        game: {
+          access: {
+            metadata: (_auth, roomId, ctx) =>
+              roomId === 'room-1' && typeof ctx.admin.db === 'function',
+          },
+        },
+      },
+    }));
+
+    const app = createApp({
+      id: 'user-1',
+      role: 'user',
+      isAnonymous: false,
+    });
+    const response = await app.request('/api/room/metadata?namespace=game&id=room-1', {
+      method: 'GET',
+    }, createRoomEnv());
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ visibility: 'public' });
+  });
 });

package/src/__tests__/room-handler-context.test.ts

@@ -37,6 +37,7 @@ describe('RoomsDO handler context', () => {
     room.config = {
       databases: {
         shared: {
+          provider: 'do',
           tables: {
             signals: {
               schema: {
@@ -93,6 +94,7 @@ describe('RoomsDO handler context', () => {
     room.config = {
       databases: {
         shared: {
+          provider: 'do',
           tables: {
             signals: {
               schema: {

package/src/__tests__/smoke-skip-report.test.ts

@@ -38,7 +38,7 @@ describe('smoke skip report', () => {
       {
         "skippedRouteCount": 0,
         "summaryByReason": {},
-        "totalRoutes": 190,
+        "totalRoutes": 191,
       }
     `);
   });

package/src/durable-objects/room-runtime-base.ts

@@ -962,7 +962,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
     }
     if (joinAccess && this.roomId) {
       try {
-        const allowed = await Promise.resolve(joinAccess(this.buildAuthFromMeta(meta), this.roomId));
+        const accessCtx = await this.buildHandlerContext();
+        const allowed = await Promise.resolve(joinAccess(this.buildAuthFromMeta(meta), this.roomId, accessCtx));
         if (!allowed) {
           this.safeSend(ws, {
             type: 'error',
@@ -972,11 +973,19 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
           ws.close(4003, 'Join denied');
           return;
         }
-      } catch {
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        console.error('[Room] join access rule failed', {
+          room: this.namespace && this.roomId ? `${this.namespace}::${this.roomId}` : null,
+          connectionId: meta.connectionId,
+          userId: meta.userId ?? null,
+          message: detail,
+          stack: error instanceof Error ? error.stack : undefined,
+        });
         this.safeSend(ws, {
           type: 'error',
           code: 'JOIN_DENIED',
-          message: 'Denied by room join access rule',
+          message: this.config.release ? 'Denied by room join access rule' : `Denied by room join access rule: ${detail}`,
         });
         ws.close(4003, 'Join denied');
         return;
@@ -1111,11 +1120,13 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
     }
     if (actionAccess && this.roomId) {
       try {
+        const accessCtx = await this.buildHandlerContext();
         const allowed = await Promise.resolve(actionAccess(
           this.buildAuthFromMeta(meta),
           this.roomId,
           actionType,
           payload,
+          accessCtx,
         ));
         if (!allowed) {
           this.safeSend(ws, {
@@ -1400,8 +1411,8 @@ export class RoomRuntimeBaseDO extends DurableObject<RoomDOEnv> {
       env: this.env as never,
       executionCtx: this.ctx as never,
       serviceKey: resolveRootServiceKey(this.config, this.env as never),
-      // Room handlers run inside a DO and should always talk to DB DOs directly.
-      preferDirectDoDb: true,
+      // Keep room handler DB access provider-aware. Static D1/Postgres apps must
+      // read the same store as function routes, while DO-backed DBs still use DOs.
     });
     return {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/src/durable-objects/rooms-do.ts

@@ -801,12 +801,14 @@ export class RoomsDO extends RoomRuntimeBaseDO {
     }
 
     try {
+      const accessCtx = await this.buildHandlerContext();
       return await Promise.resolve(
         this.namespaceConfig.access.signal(
           this.buildAuthFromMeta(meta),
           this.roomId,
           event,
           payload,
+          accessCtx,
         ),
       );
     } catch {
@@ -948,8 +950,9 @@ export class RoomsDO extends RoomRuntimeBaseDO {
     }
 
     try {
+      const accessCtx = await this.buildHandlerContext();
       return await Promise.resolve(
-        adminAccess(this.buildAuthFromMeta(meta), this.roomId, operation, payload),
+        adminAccess(this.buildAuthFromMeta(meta), this.roomId, operation, payload, accessCtx),
       );
     } catch {
       return false;

package/src/lib/auth-d1-service.ts

@@ -14,6 +14,7 @@
  */
 
 import type { AuthDb } from './auth-db-adapter.js';
+import { authSecretLookupKeys, hashAuthSecret } from './auth-token.js';
 
 // ─── Types ───
 
@@ -660,11 +661,12 @@ export async function createEmailToken(
   input: CreateEmailTokenInput,
 ): Promise<void> {
   const now = new Date().toISOString();
+  const tokenHash = await hashAuthSecret(input.token);
 
   await db.run(
     `INSERT INTO _email_tokens (token, userId, type, expiresAt, createdAt)
      VALUES (?, ?, ?, ?, ?)`,
-    [input.token, input.userId, input.type, input.expiresAt, now],
+    [tokenHash, input.userId, input.type, input.expiresAt, now],
   );
 }
 
@@ -676,9 +678,10 @@ export async function getEmailToken(
   db: AuthDb,
   token: string,
 ): Promise<Record<string, unknown> | null> {
+  const lookupKeys = await authSecretLookupKeys(token);
   const row = await db.first(
-    `SELECT * FROM _email_tokens WHERE token = ?`,
-    [token],
+    `SELECT * FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+    lookupKeys,
   );
 
   if (!row) return null;
@@ -686,7 +689,10 @@ export async function getEmailToken(
   // Check expiration
   if (new Date(row.expiresAt as string) < new Date()) {
     // Clean up expired token
-    await db.run(`DELETE FROM _email_tokens WHERE token = ?`, [token]);
+    await db.run(
+      `DELETE FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+      lookupKeys,
+    );
     return null;
   }
 
@@ -702,9 +708,10 @@ export async function getEmailTokenByType(
   token: string,
   type: string,
 ): Promise<Record<string, unknown> | null> {
+  const lookupKeys = await authSecretLookupKeys(token);
   return await db.first(
-    `SELECT * FROM _email_tokens WHERE token = ? AND type = ?`,
-    [token, type],
+    `SELECT * FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')}) AND type = ?`,
+    [...lookupKeys, type],
   );
 }
 
@@ -715,7 +722,11 @@ export async function deleteEmailToken(
   db: AuthDb,
   token: string,
 ): Promise<void> {
-  await db.run(`DELETE FROM _email_tokens WHERE token = ?`, [token]);
+  const lookupKeys = await authSecretLookupKeys(token);
+  await db.run(
+    `DELETE FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+    lookupKeys,
+  );
 }
 
 /**
@@ -923,6 +934,25 @@ export async function createRecoveryCodes(
   );
 }
 
+/**
+ * Replace all recovery codes for a user with a freshly generated batch.
+ */
+export async function replaceRecoveryCodes(
+  db: AuthDb,
+  userId: string,
+  codes: Array<{ id: string; codeHash: string }>,
+): Promise<void> {
+  const now = new Date().toISOString();
+  await db.batch([
+    { sql: `DELETE FROM _mfa_recovery_codes WHERE userId = ?`, params: [userId] },
+    ...codes.map((code) => ({
+      sql: `INSERT INTO _mfa_recovery_codes (id, userId, codeHash, used, createdAt)
+         VALUES (?, ?, ?, 0, ?)`,
+      params: [code.id, userId, code.codeHash, now],
+    })),
+  ]);
+}
+
 /**
  * List unused recovery codes for a user.
  */

package/src/lib/auth-token.ts

@@ -0,0 +1,66 @@
+const encoder = new TextEncoder();
+
+function toHex(value: ArrayBuffer): string {
+  return Array.from(new Uint8Array(value))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('');
+}
+
+function timingSafeStringEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+
+async function hmacSha256Hex(key: string, value: string): Promise<string> {
+  const cryptoKey = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(key),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  const signature = await crypto.subtle.sign('HMAC', cryptoKey, encoder.encode(value));
+  return toHex(signature);
+}
+
+export async function hashAuthSecret(secret: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(secret));
+  return `sha256:${toHex(digest)}`;
+}
+
+export async function authSecretLookupKeys(secret: string): Promise<string[]> {
+  const hashed = await hashAuthSecret(secret);
+  return secret.startsWith('sha256:') ? [secret] : [hashed, secret];
+}
+
+export async function verifyAuthSecret(secret: string, storedHash: string): Promise<boolean> {
+  const candidate = await hashAuthSecret(secret);
+  return timingSafeStringEqual(candidate, storedHash);
+}
+
+export async function hashOtpSecret(otp: string, serverSecret: string): Promise<string> {
+  const digest = await hmacSha256Hex(serverSecret, `edgebase:auth:otp:${otp}`);
+  return `hmac-sha256:${digest}`;
+}
+
+export async function verifyOtpSecret(
+  otp: string,
+  storedHash: string,
+  serverSecret: string,
+): Promise<boolean> {
+  if (storedHash.startsWith('hmac-sha256:')) {
+    const candidate = await hashOtpSecret(otp, serverSecret);
+    return timingSafeStringEqual(candidate, storedHash);
+  }
+
+  // Backward compatibility for short-lived OTPs stored before HMAC hashing.
+  if (storedHash.startsWith('sha256:')) {
+    return verifyAuthSecret(otp, storedHash);
+  }
+
+  return false;
+}