@edge-base/server 0.3.1 → 0.3.2

package/src/routes/auth.ts

@@ -999,15 +999,8 @@ authRoute.openapi(signup, async (c) => {
 
   const userId = generateId();
   const db = getAuthDb(c);
-
-  // Register pending in D1 email index
-  try {
-    await registerEmailPending(db, body.email, userId);
-  } catch (err) {
-    if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
-      throw new EdgeBaseError(409, 'Email already registered.', undefined, 'email-already-exists');
-    }
-    throw new EdgeBaseError(500, 'Signup failed. Please try again.', undefined, 'internal-error');
+  if (await lookupEmail(db, body.email)) {
+    throw new EdgeBaseError(409, 'Email already registered.', undefined, 'email-already-exists');
   }
 
   // Create user directly in D1
@@ -1015,10 +1008,27 @@ authRoute.openapi(signup, async (c) => {
     // Password policy validation
     const policyResult = await validatePassword(body.password, getPasswordPolicyConfig(c.env));
     if (!policyResult.valid) {
-      await deleteEmailPending(db, body.email).catch(() => {});
       throw new EdgeBaseError(400, policyResult.errors[0], { password: { code: 'password_policy', message: policyResult.errors.join('; ') } }, 'password-policy');
     }
 
+    // beforeSignUp hook — blocking, can cancel signup
+    await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+      id: userId,
+      email: body.email,
+      displayName,
+      avatarUrl,
+    }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+    // Register pending in D1 email index
+    try {
+      await registerEmailPending(db, body.email, userId);
+    } catch (err) {
+      if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
+        throw new EdgeBaseError(409, 'Email already registered.', undefined, 'email-already-exists');
+      }
+      throw new EdgeBaseError(500, 'Signup failed. Please try again.', undefined, 'internal-error');
+    }
+
     const passwordHash = await hashPassword(body.password);
 
     await authService.createUser(db, {
@@ -1033,14 +1043,6 @@ authRoute.openapi(signup, async (c) => {
       locale,
     });
 
-    // beforeSignUp hook — blocking, can cancel signup
-    await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
-      id: userId,
-      email: body.email,
-      displayName,
-      avatarUrl,
-    }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
-
     // Create session + tokens
     const session = await createSessionAndTokens(c.env, userId, ip, c.req.header('user-agent') || '');
 
@@ -1382,19 +1384,24 @@ authRoute.openapi(signinMagicLink, async (c) => {
   } else if (autoCreate) {
     // Auto-create user + send magic link
     const userId = generateId();
+    const reqLocale = parseAcceptLanguage(c.req.header('accept-language'));
 
     try {
-      await registerEmailPending(db, body.email, userId);
-    } catch (err) {
-      if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
-        return c.json({ ok: true });
+      // beforeSignUp hook
+      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+        id: userId, email: body.email, displayName: null, avatarUrl: null,
+      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+      try {
+        await registerEmailPending(db, body.email, userId);
+      } catch (err) {
+        if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
+          return c.json({ ok: true });
+        }
+        throw new EdgeBaseError(500, 'Magic link request failed.', undefined, 'internal-error');
       }
-      throw new EdgeBaseError(500, 'Magic link request failed.', undefined, 'internal-error');
-    }
 
-    try {
       // Create user with no password, verified = 1
-      const reqLocale = parseAcceptLanguage(c.req.header('accept-language'));
       await authService.createUser(db, {
         userId,
         email: body.email,
@@ -1405,11 +1412,6 @@ authRoute.openapi(signinMagicLink, async (c) => {
         locale: reqLocale ?? 'en',
       });
 
-      // beforeSignUp hook
-      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
-        id: userId, email: body.email, displayName: null, avatarUrl: null,
-      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
-
       // Sync to _users_public
       const user = await authService.getUserById(db, userId);
       if (user) {
@@ -1671,15 +1673,20 @@ authRoute.openapi(signinPhone, async (c) => {
     const userId = generateId();
 
     try {
-      await registerPhonePending(db, phone, userId);
-    } catch (err) {
-      if ((err as Error).message === 'PHONE_ALREADY_REGISTERED') {
-        return c.json({ ok: true });
+      // beforeSignUp hook
+      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+        id: userId, email: null, phone, displayName: null, avatarUrl: null,
+      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+      try {
+        await registerPhonePending(db, phone, userId);
+      } catch (err) {
+        if ((err as Error).message === 'PHONE_ALREADY_REGISTERED') {
+          return c.json({ ok: true });
+        }
+        throw new EdgeBaseError(500, 'Phone OTP request failed.', undefined, 'internal-error');
       }
-      throw new EdgeBaseError(500, 'Phone OTP request failed.', undefined, 'internal-error');
-    }
 
-    try {
       // Create user with phone in D1
       await authService.createUser(db, {
         userId,
@@ -2143,19 +2150,24 @@ authRoute.openapi(signinEmailOtp, async (c) => {
     }
 
     const userId = generateId();
+    const otpReqLocale = parseAcceptLanguage(c.req.header('accept-language'));
 
     try {
-      await registerEmailPending(db, email, userId);
-    } catch (err) {
-      if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
-        return c.json({ ok: true });
+      // beforeSignUp hook
+      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+        id: userId, email, displayName: null, avatarUrl: null,
+      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+      try {
+        await registerEmailPending(db, email, userId);
+      } catch (err) {
+        if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
+          return c.json({ ok: true });
+        }
+        throw new EdgeBaseError(500, 'Email OTP request failed.', undefined, 'internal-error');
       }
-      throw new EdgeBaseError(500, 'Email OTP request failed.', undefined, 'internal-error');
-    }
 
-    try {
       // Create user with email, verified = 1
-      const otpReqLocale = parseAcceptLanguage(c.req.header('accept-language'));
       await authService.createUser(db, {
         userId,
         email,

package/src/routes/tables.ts

@@ -35,8 +35,16 @@ import {
   jsonResponseSchema, errorResponseSchema, zodDefaultHook,
 } from '../lib/schemas.js';
 import type { AuthContext } from '@edge-base/shared';
+import { EdgeBaseError } from '@edge-base/shared';
 import { handlePgRequest } from '../lib/postgres-handler.js';
 import { handleD1Request } from '../lib/d1-handler.js';
+import {
+  buildKeymap,
+  resolveServiceKeyCandidate,
+  validateKey,
+  type ConstraintContext,
+} from '../lib/service-key.js';
+import { getTrustedClientIp } from '../lib/client-ip.js';
 
 
 export const tablesRoute = new OpenAPIHono<HonoEnv>({ defaultHook: zodDefaultHook });
@@ -559,6 +567,138 @@ tablesRoute.openapi(dbDeleteRecord, async (c) => {
   return routeToDO(c as unknown as Context<HonoEnv>, namespace, instanceId, table, `/tables/${table}/${id}`);
 });
 
+// ─── POST /{namespace}/transact and /{namespace}/{instanceId}/transact ─
+// Multi-table atomic writes. The rules middleware skips non-/tables/ paths,
+// so Service Keys are validated here (per write-op table scope) and access
+// rules are enforced per operation inside the DO. DO/SQLite provider only.
+
+const transactBodySchema = z.object({
+  operations: z.array(z.record(z.string(), z.unknown())).openapi({
+    description: 'Ordered insert | update | delete | expect operations applied atomically.',
+  }),
+});
+
+const dbSingleTransact = createRoute({
+  operationId: 'dbSingleTransact',
+  method: 'post',
+  path: '/{namespace}/transact',
+  tags: ['client'],
+  summary: 'Apply multi-table write operations atomically in a single-instance database',
+  request: {
+    params: z.object({
+      namespace: z.string().openapi({ description: 'Database namespace', example: 'app' }),
+    }),
+    body: { content: { 'application/json': { schema: transactBodySchema } }, required: true },
+  },
+  responses: {
+    200: { description: 'Ordered per-operation results', content: { 'application/json': { schema: jsonResponseSchema } } },
+    400: { description: 'Bad request', content: { 'application/json': { schema: errorResponseSchema } } },
+    403: { description: 'Forbidden', content: { 'application/json': { schema: errorResponseSchema } } },
+    409: { description: 'Expectation failed', content: { 'application/json': { schema: errorResponseSchema } } },
+    501: { description: 'Provider unsupported', content: { 'application/json': { schema: errorResponseSchema } } },
+  },
+});
+
+const dbTransact = createRoute({
+  operationId: 'dbTransact',
+  method: 'post',
+  path: '/{namespace}/{instanceId}/transact',
+  tags: ['client'],
+  summary: 'Apply multi-table write operations atomically in a dynamic database instance',
+  request: {
+    params: z.object({
+      namespace: z.string().openapi({ description: 'Database namespace', example: 'workspace' }),
+      instanceId: z.string().openapi({ description: 'Instance ID', example: 'ws-456' }),
+    }),
+    body: { content: { 'application/json': { schema: transactBodySchema } }, required: true },
+  },
+  responses: {
+    200: { description: 'Ordered per-operation results', content: { 'application/json': { schema: jsonResponseSchema } } },
+    400: { description: 'Bad request', content: { 'application/json': { schema: errorResponseSchema } } },
+    403: { description: 'Forbidden', content: { 'application/json': { schema: errorResponseSchema } } },
+    409: { description: 'Expectation failed', content: { 'application/json': { schema: errorResponseSchema } } },
+    501: { description: 'Provider unsupported', content: { 'application/json': { schema: errorResponseSchema } } },
+  },
+});
+
+async function handleTransactRoute(
+  c: Context<HonoEnv>,
+  namespace: string,
+  instanceId: string | undefined,
+): Promise<Response> {
+  const config = parseConfig(c.env);
+  const target = resolveDbTarget(config, namespace, instanceId);
+  if (!target.ok) {
+    return c.json({
+      code: target.status,
+      message: formatDbTargetValidationIssue(target.issue, namespace),
+    }, target.status);
+  }
+  // All providers accept /transact: DO via transactionSync, D1 via a single
+  // db.batch() transaction, PostgreSQL via BEGIN/COMMIT on a session-scoped
+  // connection (the PG handler itself rejects the local dev sidecar).
+
+  // Service Key validation per write-op table (rules middleware skipped this path).
+  const provided = resolveServiceKeyCandidate(
+    c.req,
+    c.get('serviceKeyToken') as string | null | undefined,
+  );
+  if (provided) {
+    let body: { operations?: Array<Record<string, unknown>> } = {};
+    try {
+      body = await c.req.json();
+    } catch {
+      body = {};
+    }
+    const writeTables = new Set<string>();
+    for (const op of body.operations ?? []) {
+      if (typeof op.table === 'string' && op.table) writeTables.add(op.table);
+    }
+    const constraintCtx: ConstraintContext = {
+      env: c.env.ENVIRONMENT,
+      ip: getTrustedClientIp(c.env, c.req),
+    };
+    if (target.value.instanceId) constraintCtx.tenantId = target.value.instanceId;
+    const keymap = buildKeymap(config, c.env);
+    let validCount = 0;
+    for (const tableName of writeTables) {
+      const { result } = validateKey(
+        provided,
+        `db:table:${tableName}:write`,
+        config,
+        c.env,
+        keymap,
+        constraintCtx,
+      );
+      if (result === 'invalid') {
+        throw new EdgeBaseError(
+          401,
+          `Invalid X-EdgeBase-Service-Key for scope 'db:table:${tableName}:write'.`,
+        );
+      }
+      if (result === 'missing') break; // not a recognized key — fall through to user auth
+      validCount += 1;
+    }
+    // Every named table's write scope validated → trusted bypass, like rules middleware.
+    if (writeTables.size > 0 && validCount === writeTables.size) {
+      c.set('isServiceKey' as never, true);
+    }
+  }
+
+  return routeToDO(c, namespace, instanceId, '', '/transact');
+}
+
+tablesRoute.openapi(dbSingleTransact, async (c) => {
+  const namespace = c.req.param('namespace')!;
+  return handleTransactRoute(c as unknown as Context<HonoEnv>, namespace, undefined);
+});
+
+tablesRoute.openapi(dbTransact, async (c) => {
+  const namespace = c.req.param('namespace')!;
+  const instanceId = c.req.param('instanceId')!;
+  return handleTransactRoute(c as unknown as Context<HonoEnv>, namespace, instanceId);
+});
+
 // ======================================================================
 //  Shared DO proxy logic
 // ======================================================================

package/admin-build/_app/immutable/entry/start.BgMeGq-q.js

@@ -1 +0,0 @@
-import{a as r}from"../chunks/DdjFeYwG.js";import{w as t}from"../chunks/D3hdqsfp.js";export{t as load_css,r as start};

package/admin-build/_app/immutable/nodes/21.DZ7G8rMF.js

@@ -1 +0,0 @@
-import{_ as m}from"../chunks/Cek51lkE.js";export{m as component};