@explita/tunnel-server-plugin 0.0.0-stage → 0.1.0

package/dist/lib/prisma.js

@@ -0,0 +1,20 @@
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "../generated/prisma/client.js";
+let prismaInstance = null;
+export function getPrisma() {
+    if (prismaInstance)
+        return prismaInstance;
+    const connectionString = process.env.DATABASE_URL;
+    if (!connectionString)
+        return null;
+    try {
+        const adapter = new PrismaPg({ connectionString });
+        prismaInstance = new PrismaClient({ adapter });
+        return prismaInstance;
+    }
+    catch (err) {
+        console.warn("[tunnel-auth] Warning: failed to initialize Prisma database client:", err);
+        return null;
+    }
+}
+//# sourceMappingURL=prisma.js.map

package/dist/lib/prisma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.js","sourceRoot":"","sources":["../../src/lib/prisma.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,IAAI,cAAc,GAAwB,IAAI,CAAC;AAE/C,MAAM,UAAU,SAAS;IACvB,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAClD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnD,cAAc,GAAG,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,qEAAqE,EACrE,GAAG,CACJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/utils.d.ts

@@ -0,0 +1,2 @@
+export declare function generateToken(): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/lib/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/lib/utils.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/lib/utils.js

@@ -0,0 +1,5 @@
+import { randomUUID } from "node:crypto";
+export function generateToken() {
+    return `exp_live_${randomUUID().replace(/-/g, "")}`;
+}
+//# sourceMappingURL=utils.js.map

package/dist/lib/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/lib/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC"}

package/dist/request.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { type SendOtpOptions } from "./lib/mailer.js";
+export declare function requestOtp(request: FastifyRequest, reply: FastifyReply, options?: SendOtpOptions): Promise<never>;
+//# sourceMappingURL=request.d.ts.map

package/dist/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5D,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE/D,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,cAAc,kBA8BzB"}

package/dist/request.js

@@ -0,0 +1,29 @@
+import { parseRequestBody } from "@explita/infra-protocol";
+import { cache } from "./lib/cache.js";
+import { sendOTP } from "./lib/mailer.js";
+export async function requestOtp(request, reply, options) {
+    const parsed = parseRequestBody(request.body);
+    const email = parsed.email?.trim().toLowerCase();
+    if (!email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return reply.code(400).send({
+            success: false,
+            error: "A valid email address is required",
+        });
+    }
+    // Generate 6-digit OTP and store in cache with 10-minute TTL
+    const otp = String(Math.floor(100000 + Math.random() * 900000));
+    await cache.set(`otp:${email}`, otp, { ttl: "10m" });
+    const sent = await sendOTP(email, otp, options);
+    if (!sent) {
+        return reply.code(500).send({
+            success: false,
+            error: "Failed to send OTP",
+        });
+    }
+    return reply.code(200).send({
+        success: true,
+        email,
+        message: "Verification code sent to your email",
+    });
+}
+//# sourceMappingURL=request.js.map

package/dist/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,OAAO,EAAuB,MAAM,iBAAiB,CAAC;AAE/D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAuB,EACvB,KAAmB,EACnB,OAAwB;IAExB,MAAM,MAAM,GAAG,gBAAgB,CAAqB,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,CAAC,KAAK,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mCAAmC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK;QACL,OAAO,EAAE,sCAAsC;KAChD,CAAC,CAAC;AACL,CAAC"}

package/dist/validate.d.ts

@@ -0,0 +1,2 @@
+export declare function validateToken(token: string): Promise<boolean>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAGA,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnE"}

package/dist/validate.js

@@ -0,0 +1,48 @@
+import { cache } from "./lib/cache.js";
+import { getPrisma } from "./lib/prisma.js";
+export async function validateToken(token) {
+    if (!token || !process.env.DATABASE_URL)
+        return false;
+    // 1. Fast path: check Redis / in-memory cache
+    try {
+        const tokenExists = await cache.get(`token:verified:${token}`);
+        if (tokenExists) {
+            await cache.expire(`token:verified:${token}`, "7d").catch(() => { });
+            return true;
+        }
+    }
+    catch {
+        // Ignore cache error and proceed to database fallback
+    }
+    // 2. Resilient fallback: check PostgreSQL in case Redis flushed or restarted
+    const prisma = getPrisma();
+    if (prisma) {
+        try {
+            const dbToken = await prisma.token.findFirst({
+                where: {
+                    token,
+                    revokedAt: null,
+                },
+            });
+            if (dbToken) {
+                // Re-warm cache for subsequent requests
+                await cache
+                    .set(`token:verified:${token}`, token, { ttl: "7d" })
+                    .catch(() => { });
+                // Asynchronously update last active timestamp without blocking handshake
+                prisma.token
+                    .update({
+                    where: { id: dbToken.id },
+                    data: { lastUsedAt: new Date() },
+                })
+                    .catch(() => { });
+                return true;
+            }
+        }
+        catch (error) {
+            console.error("[tunnel-auth] Error validating token against database:", error);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEtD,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC,MAAM,CAAC,kBAAkB,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;gBAC3C,KAAK,EAAE;oBACL,KAAK;oBACL,SAAS,EAAE,IAAI;iBAChB;aACF,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,CAAC;gBACZ,wCAAwC;gBACxC,MAAM,KAAK;qBACR,GAAG,CAAC,kBAAkB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;qBACpD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEnB,yEAAyE;gBACzE,MAAM,CAAC,KAAK;qBACT,MAAM,CAAC;oBACN,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;oBACzB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;iBACjC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAEnB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+export declare function verifyOtp(request: FastifyRequest, reply: FastifyReply): Promise<never>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM5D,wBAAsB,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,kBA2D3E"}

package/dist/verify.js

@@ -0,0 +1,53 @@
+import { parseRequestBody } from "@explita/infra-protocol";
+import { cache } from "./lib/cache.js";
+import { getPrisma } from "./lib/prisma.js";
+import { generateToken } from "./lib/utils.js";
+export async function verifyOtp(request, reply) {
+    const parsed = parseRequestBody(request.body);
+    const email = parsed.email?.trim().toLowerCase();
+    const otp = String(parsed.otp || "").trim();
+    if (!email || !otp) {
+        return reply.code(400).send({
+            success: false,
+            error: "Email and OTP code are both required",
+        });
+    }
+    const storedOtp = await cache.get(`otp:${email}`);
+    if (!storedOtp || String(storedOtp).trim() !== otp) {
+        return reply.code(400).send({
+            success: false,
+            error: "Invalid or expired verification code",
+        });
+    }
+    // Clear consumed OTP
+    await cache.del(`otp:${email}`);
+    const token = generateToken();
+    const prisma = getPrisma();
+    if (prisma) {
+        try {
+            const developer = await prisma.developer.upsert({
+                where: { email },
+                create: { email },
+                update: {},
+            });
+            await prisma.token.create({
+                data: {
+                    token,
+                    developerId: developer.id,
+                },
+            });
+        }
+        catch (error) {
+            console.error("[tunnel-auth] Failed to persist developer/token in database:", error);
+            // Continue: cache still grants access even if DB write momentarily fails
+        }
+    }
+    await cache.set(`token:verified:${token}`, token, { ttl: "7d" });
+    return reply.code(200).send({
+        success: true,
+        email,
+        token,
+        message: "Verification successful",
+    });
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAC7B,OAAO,CAAC,IAAI,CACb,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sCAAsC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,CAAS,OAAO,KAAK,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sCAAsC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAEhC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC9C,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,MAAM,EAAE,EAAE,KAAK,EAAE;gBACjB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBACxB,IAAI,EAAE;oBACJ,KAAK;oBACL,WAAW,EAAE,SAAS,CAAC,EAAE;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,8DAA8D,EAC9D,KAAK,CACN,CAAC;YACF,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK;QACL,KAAK;QACL,OAAO,EAAE,yBAAyB;KACnC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@explita/tunnel-server-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Explita Tunnel all-in-one database, auth, and metrics telemetry plugin",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "tunnel-plugin": "./bin/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "clean": "rimraf dist",
+    "db:gen": "npx prisma generate",
+    "db:push": "pnpm db:gen && npx prisma db push",
+    "build": "pnpm clean && pnpm db:gen && tsc -p tsconfig.json",
+    "prepack": "pnpm build",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@explita/cache": "^0.2.0",
+    "@explita/env-loader": "^0.2.0",
+    "@prisma/adapter-pg": "^7.10.0",
+    "@prisma/client": "^7.10.0",
+    "nodemailer": "^6.10.0",
+    "prisma": "^7.10.0"
+  },
+  "devDependencies": {
+    "@explita/infra-protocol": "^0.1.0",
+    "@types/node": "^26.6.3",
+    "@types/nodemailer": "^6.4.17",
+    "fastify": "^5",
+    "rimraf": "^6.1.3",
+    "typescript": "^7"
+  },
+  "peerDependencies": {
+    "@explita/infra-protocol": "^0.1.0",
+    "fastify": "^5"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "prisma",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ]
+}

package/prisma/schema.prisma

@@ -0,0 +1,62 @@
+generator client {
+    provider = "prisma-client"
+    output   = "../src/generated/prisma"
+}
+
+datasource db {
+    provider = "postgresql"
+}
+
+// Developer Account (identified by verified email)
+model Developer {
+    id        String   @id @default(nanoid(10))
+    email     String   @unique
+    createdAt DateTime @default(now()) @map("created_at")
+    updatedAt DateTime @updatedAt @map("updated_at")
+    tokens    Token[]
+
+    @@index([email])
+    @@map("developers")
+}
+
+// Multi-device developer tokens
+model Token {
+    id          String    @id @default(nanoid(10))
+    developerId String    @map("developer_id")
+    token       String    @unique
+    createdAt   DateTime  @default(now()) @map("created_at")
+    lastUsedAt  DateTime? @map("last_used_at")
+    revokedAt   DateTime? @map("revoked_at")
+
+    developer Developer @relation(fields: [developerId], references: [id], onDelete: Cascade)
+
+    @@index([token])
+    @@index([developerId])
+    @@map("tokens")
+}
+
+// Anonymous daily usage aggregates (Zero-Logging compliant)
+model DailyMetric {
+    id               String   @id @default(nanoid(10))
+    date             String   @unique
+    tunnelsOpened    Int      @default(0) @map("tunnels_opened")
+    requestsRouted   BigInt   @default(0) @map("requests_routed")
+    bytesTransferred BigInt   @default(0) @map("bytes_transferred")
+    activeDevelopers Int      @default(0) @map("active_developers")
+    createdAt        DateTime @default(now()) @map("created_at")
+    updatedAt        DateTime @updatedAt @map("updated_at")
+
+    @@index([date])
+    @@map("daily_metrics")
+}
+
+// Global lifetime totals
+model SystemMetric {
+    id            String   @id @default(nanoid(10))
+    totalTunnels  BigInt   @default(0) @map("total_tunnels")
+    totalRequests BigInt   @default(0) @map("total_requests")
+    totalBytes    BigInt   @default(0) @map("total_bytes")
+    updatedAt     DateTime @updatedAt @map("updated_at")
+
+    @@map("system_metrics")
+}