@formancy/server 0.1.0 → 0.2.0

package/dist/postgres-storage-UMh8A-4C.mjs

@@ -1,599 +0,0 @@
-import { randomBytes, randomUUID } from "node:crypto";
-import Fastify from "fastify";
-import { authenticateApiKey, authenticateLocal, can, createApiKey, createLocalUser, createSubmission, exportCsv, listForms, listSubmissions, listVersions, publishForm, resolveForm, resumeDraft, saveDraft } from "@formancy/server-core";
-import { hash, verify } from "@node-rs/argon2";
-import { SignJWT, jwtVerify } from "jose";
-import { and, desc, eq, max } from "drizzle-orm";
-import { drizzle } from "drizzle-orm/postgres-js";
-import { integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
-//#region src/auth-runtime.ts
-/**
-* The real cryptography, confined to the composition root: argon2id for
-* secrets at rest, an HMAC-signed short-lived access token for sessions, and
-* a CSPRNG for API keys. server-core never sees any of this — it is handed
-* hash/verify/random functions and stays deterministic under test.
-*
-* HS256 rather than EdDSA for the session token, deliberately for this phase:
-* one secret in one env var is the self-hosting story a single-container
-* deployment can operate, and the signing scheme is an implementation detail
-* of a token that lives fifteen minutes. Revisit with key rotation.
-*/
-function realSecretHashing() {
-	return {
-		hashSecret: (secret) => hash(secret),
-		verifySecret: async (secret, digest) => {
-			try {
-				return await verify(digest, secret);
-			} catch {
-				return false;
-			}
-		}
-	};
-}
-function realRandomToken() {
-	return randomBytes(30).toString("base64url");
-}
-const TOKEN_LIFETIME = "15m";
-function createSessionTokens(secret) {
-	if (secret.length < 32) throw new Error("FORMANCY_AUTH_SECRET must be at least 32 characters. Generate one: openssl rand -base64 33");
-	const key = new TextEncoder().encode(secret);
-	return {
-		async issue(actor) {
-			return new SignJWT({
-				role: actor.role,
-				kind: actor.kind
-			}).setProtectedHeader({ alg: "HS256" }).setSubject(actor.id).setIssuedAt().setExpirationTime(TOKEN_LIFETIME).sign(key);
-		},
-		async verify(token) {
-			try {
-				const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
-				const role = payload["role"];
-				const kind = payload["kind"];
-				if (typeof payload.sub !== "string" || role !== "admin" && role !== "editor" && role !== "viewer" || kind !== "user" && kind !== "apiKey") return;
-				return {
-					id: payload.sub,
-					role,
-					kind
-				};
-			} catch {
-				return;
-			}
-		}
-	};
-}
-//#endregion
-//#region src/app.ts
-const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
-const API_KEY_HEADER = "x-formancy-api-key";
-/**
-* The HTTP surface, split into two planes.
-*
-* PUBLIC — what a person filling a form needs: resolve, submit, drafts. These
-* stay unauthenticated by design; anonymous-submission hardening is its own
-* upcoming step and is opt-in per form.
-*
-* MANAGEMENT — everything an operator does: publish, catalog, submissions,
-* export, users, keys. Authenticated via a session token (login) or an API
-* key header, authorized through server-core's one-table can().
-*
-* This file is the composition root, so THIS is where ambient reality enters:
-* randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays
-* injected and replayable.
-*/
-async function createApp(storage, options) {
-	const app = Fastify({ logger: false });
-	const deps = {
-		storage,
-		newId: () => randomUUID(),
-		nowIso: () => (/* @__PURE__ */ new Date()).toISOString(),
-		capabilities: {
-			now: () => Date.now(),
-			today: () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
-			random: () => Math.random()
-		}
-	};
-	const authDeps = {
-		storage,
-		newId: deps.newId,
-		nowIso: deps.nowIso,
-		randomToken: realRandomToken,
-		...realSecretHashing()
-	};
-	const sessions = createSessionTokens(options.authSecret);
-	if (options.bootstrapAdmin !== void 0) {
-		if (await storage.getUserByEmail(options.bootstrapAdmin.email) === void 0) {
-			const outcome = await createLocalUser(authDeps, {
-				...options.bootstrapAdmin,
-				role: "admin"
-			});
-			if (!outcome.ok) throw new Error(`Bootstrap admin rejected: ${outcome.message}`);
-		}
-	}
-	async function actorOf(request) {
-		const bearer = request.headers.authorization;
-		if (typeof bearer === "string" && bearer.startsWith("Bearer ")) return sessions.verify(bearer.slice(7));
-		const apiKey = request.headers[API_KEY_HEADER];
-		if (typeof apiKey === "string" && apiKey !== "") {
-			const outcome = await authenticateApiKey(authDeps, apiKey);
-			return outcome.ok ? outcome.actor : void 0;
-		}
-	}
-	/** 401 without an identity, 403 with one that lacks the permission — the
-	*  difference tells a client whether to log in or to give up. */
-	function requires(action) {
-		return async (request, reply) => {
-			const actor = await actorOf(request);
-			if (actor === void 0) return reply.code(401).send({ error: "unauthenticated" });
-			if (!can(actor, action)) return reply.code(403).send({
-				error: "forbidden",
-				action
-			});
-			request.actor = actor;
-		};
-	}
-	app.post("/auth/login", async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.email !== "string" || typeof body.password !== "string") return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { email, password }."
-		});
-		const outcome = await authenticateLocal(authDeps, {
-			email: body.email,
-			password: body.password
-		});
-		if (!outcome.ok) return reply.code(401).send({ error: "invalid_credentials" });
-		return reply.send({
-			token: await sessions.issue(outcome.actor),
-			role: outcome.actor.role
-		});
-	});
-	app.post("/users", { preHandler: requires("user.create") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.email !== "string" || typeof body.password !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { email, password, role }."
-		});
-		const outcome = await createLocalUser(authDeps, {
-			email: body.email,
-			password: body.password,
-			role: body.role
-		});
-		if (!outcome.ok) return reply.code(422).send({
-			error: "rejected",
-			message: outcome.message
-		});
-		return reply.code(201).send({ id: outcome.id });
-	});
-	app.post("/api-keys", { preHandler: requires("apiKey.create") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.name !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { name, role }."
-		});
-		const outcome = await createApiKey(authDeps, {
-			name: body.name,
-			role: body.role
-		});
-		if (!outcome.ok) return reply.code(422).send({
-			error: "rejected",
-			message: outcome.message
-		});
-		return reply.code(201).send({
-			id: outcome.id,
-			secret: outcome.secret
-		});
-	});
-	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.path !== "string" || body.path === "" || body.schema === void 0) return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { path, schema }."
-		});
-		const outcome = await publishForm(deps, {
-			path: body.path,
-			schema: body.schema
-		});
-		if (!outcome.ok) return reply.code(422).send({
-			error: outcome.kind,
-			...outcome.kind === "invalid_schema" ? { errors: outcome.errors } : { message: outcome.message }
-		});
-		return reply.code(201).send({
-			version: outcome.version,
-			schemaHash: outcome.schemaHash
-		});
-	});
-	app.get("/forms", { preHandler: requires("form.read") }, async (_request, reply) => {
-		return reply.send({ forms: await listForms(deps) });
-	});
-	app.get("/f/:path/versions", { preHandler: requires("form.read") }, async (request, reply) => {
-		const { path } = request.params;
-		const versions = await listVersions(deps, path);
-		if (versions === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send({ versions });
-	});
-	app.get("/f/:path/submissions", { preHandler: requires("submission.read") }, async (request, reply) => {
-		const { path } = request.params;
-		const listed = await listSubmissions(deps, path);
-		if (listed === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send({ submissions: listed });
-	});
-	app.get("/f/:path/submissions/export.csv", { preHandler: requires("submission.export") }, async (request, reply) => {
-		const { path } = request.params;
-		const csv = await exportCsv(deps, path);
-		if (csv === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.header("content-type", "text/csv; charset=utf-8").header("content-disposition", `attachment; filename="${path}-submissions.csv"`).send(csv);
-	});
-	app.get("/f/:path", async (request, reply) => {
-		const { path } = request.params;
-		const resolved = await resolveForm(deps, path);
-		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send({
-			version: resolved.version,
-			schemaHash: resolved.schemaHash,
-			schema: resolved.schema
-		});
-	});
-	app.put("/f/:path/drafts/:draftId", async (request, reply) => {
-		const { path, draftId } = request.params;
-		const saved = await saveDraft(deps, {
-			path,
-			draftId,
-			data: request.body ?? {}
-		});
-		if (saved === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send(saved);
-	});
-	app.get("/f/:path/drafts/:draftId", async (request, reply) => {
-		const { path, draftId } = request.params;
-		const resumed = await resumeDraft(deps, {
-			path,
-			draftId
-		});
-		if (resumed === void 0) return reply.code(404).send({ error: "unknown_draft" });
-		return reply.send(resumed);
-	});
-	app.post("/f/:path/submissions", async (request, reply) => {
-		const { path } = request.params;
-		const declaredSchemaHash = request.headers[SCHEMA_HASH_HEADER];
-		if (typeof declaredSchemaHash !== "string" || declaredSchemaHash === "") return reply.code(400).send({
-			error: "missing_schema_hash",
-			message: `Send the schema hash you rendered in the ${SCHEMA_HASH_HEADER} header.`
-		});
-		const outcome = await createSubmission(deps, {
-			path,
-			declaredSchemaHash,
-			data: request.body ?? {}
-		});
-		if (outcome.ok) return reply.code(201).send({
-			id: outcome.id,
-			data: outcome.canonicalData
-		});
-		switch (outcome.kind) {
-			case "unknown_form": return reply.code(404).send({ error: "unknown_form" });
-			case "version_changed": return reply.code(409).send({
-				error: "FORM_VERSION_CHANGED",
-				current: outcome.current === void 0 ? void 0 : {
-					version: outcome.current.version,
-					schemaHash: outcome.current.schemaHash,
-					schema: outcome.current.schema
-				}
-			});
-			case "invalid": return reply.code(422).send({
-				error: "invalid",
-				errors: outcome.errors
-			});
-		}
-	});
-	return app;
-}
-//#endregion
-//#region src/db.ts
-/**
-* The thin slice's tables. Three rules from the design spec are enforced HERE,
-* in the database, because application code can be bypassed and these must not
-* be:
-*
-*  - published versions are immutable (a trigger refuses UPDATE),
-*  - a submission binds to its exact version by real foreign key,
-*  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema
-*    that produced it is structurally impossible.
-*/
-const forms = pgTable("forms", {
-	id: uuid("id").primaryKey(),
-	path: text("path").notNull().unique(),
-	currentVersionId: uuid("current_version_id"),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-});
-const formVersions = pgTable("form_versions", {
-	id: uuid("id").primaryKey(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	version: integer("version").notNull(),
-	schema: jsonb("schema").notNull(),
-	schemaHash: text("schema_hash").notNull(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-});
-const users = pgTable("users", {
-	id: uuid("id").primaryKey(),
-	email: text("email").notNull().unique(),
-	passwordHash: text("password_hash").notNull(),
-	role: text("role").notNull(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull()
-});
-const apiKeys = pgTable("api_keys", {
-	id: uuid("id").primaryKey(),
-	name: text("name").notNull(),
-	prefix: text("prefix").notNull(),
-	secretHash: text("secret_hash").notNull(),
-	role: text("role").notNull(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
-	revokedAt: timestamp("revoked_at", { withTimezone: true })
-});
-const drafts = pgTable("drafts", {
-	id: text("id").notNull(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id),
-	data: jsonb("data").notNull(),
-	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
-});
-const submissions = pgTable("submissions", {
-	id: uuid("id").primaryKey(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id, { onDelete: "restrict" }),
-	data: jsonb("data").notNull(),
-	submittedAt: timestamp("submitted_at", { withTimezone: true }).notNull()
-});
-/**
-* Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the
-* lifecycle work; a self-hosted skeleton that creates its own tables on first
-* start is worth more right now than a migration pipeline.
-*/
-async function bootstrapSchema(sql) {
-	await sql`
-    CREATE TABLE IF NOT EXISTS forms (
-      id uuid PRIMARY KEY,
-      path text NOT NULL UNIQUE,
-      current_version_id uuid,
-      created_at timestamptz NOT NULL DEFAULT now()
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS form_versions (
-      id uuid PRIMARY KEY,
-      form_id uuid NOT NULL REFERENCES forms(id),
-      version integer NOT NULL,
-      schema jsonb NOT NULL,
-      schema_hash text NOT NULL,
-      created_at timestamptz NOT NULL DEFAULT now(),
-      UNIQUE (form_id, version),
-      UNIQUE (form_id, schema_hash)
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS submissions (
-      id uuid PRIMARY KEY,
-      form_id uuid NOT NULL REFERENCES forms(id),
-      form_version_id uuid NOT NULL REFERENCES form_versions(id) ON DELETE RESTRICT,
-      data jsonb NOT NULL,
-      submitted_at timestamptz NOT NULL
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS users (
-      id uuid PRIMARY KEY,
-      email text NOT NULL UNIQUE,
-      password_hash text NOT NULL,
-      role text NOT NULL,
-      created_at timestamptz NOT NULL
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS api_keys (
-      id uuid PRIMARY KEY,
-      name text NOT NULL,
-      prefix text NOT NULL,
-      secret_hash text NOT NULL,
-      role text NOT NULL,
-      created_at timestamptz NOT NULL,
-      revoked_at timestamptz
-    )`;
-	await sql`CREATE INDEX IF NOT EXISTS api_keys_prefix ON api_keys (prefix)`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS drafts (
-      id text NOT NULL,
-      form_id uuid NOT NULL REFERENCES forms(id),
-      form_version_id uuid NOT NULL REFERENCES form_versions(id),
-      data jsonb NOT NULL,
-      updated_at timestamptz NOT NULL,
-      PRIMARY KEY (form_id, id)
-    )`;
-	await sql`
-    CREATE OR REPLACE FUNCTION refuse_version_update() RETURNS trigger AS $$
-    BEGIN
-      RAISE EXCEPTION 'form_versions rows are immutable; publish a new version instead';
-    END
-    $$ LANGUAGE plpgsql`;
-	await sql`DROP TRIGGER IF EXISTS form_versions_immutable ON form_versions`;
-	await sql`
-    CREATE TRIGGER form_versions_immutable
-    BEFORE UPDATE ON form_versions
-    FOR EACH ROW EXECUTE FUNCTION refuse_version_update()`;
-}
-//#endregion
-//#region src/postgres-storage.ts
-/** The Storage port over Postgres — the mirror of server-core's in-memory one. */
-function createPostgresStorage(sql) {
-	const db = drizzle(sql);
-	return {
-		async getFormByPath(path) {
-			const row = (await db.select().from(forms).where(eq(forms.path, path)).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				path: row.path,
-				currentVersionId: row.currentVersionId
-			};
-		},
-		async listForms() {
-			return (await db.select().from(forms)).map((row) => ({
-				id: row.id,
-				path: row.path,
-				currentVersionId: row.currentVersionId
-			}));
-		},
-		async createForm(record) {
-			await db.insert(forms).values({
-				id: record.id,
-				path: record.path,
-				currentVersionId: record.currentVersionId
-			});
-		},
-		async setCurrentVersion(formId, versionId) {
-			await db.update(forms).set({ currentVersionId: versionId }).where(eq(forms.id, formId));
-		},
-		async insertVersion(record) {
-			await db.insert(formVersions).values({
-				id: record.id,
-				formId: record.formId,
-				version: record.version,
-				schema: record.schema,
-				schemaHash: record.schemaHash
-			});
-		},
-		async getVersionById(id) {
-			const row = (await db.select().from(formVersions).where(eq(formVersions.id, id)).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				formId: row.formId,
-				version: row.version,
-				schema: row.schema,
-				schemaHash: row.schemaHash
-			};
-		},
-		async findVersionByHash(formId, schemaHash) {
-			const row = (await db.select().from(formVersions).where(eq(formVersions.formId, formId))).find((candidate) => candidate.schemaHash === schemaHash);
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				formId: row.formId,
-				version: row.version,
-				schema: row.schema,
-				schemaHash: row.schemaHash
-			};
-		},
-		async latestVersionNumber(formId) {
-			return (await db.select({ latest: max(formVersions.version) }).from(formVersions).where(eq(formVersions.formId, formId)))[0]?.latest ?? 0;
-		},
-		async insertSubmission(record) {
-			await db.insert(submissions).values({
-				id: record.id,
-				formId: record.formId,
-				formVersionId: record.formVersionId,
-				data: record.data,
-				submittedAt: new Date(record.submittedAt)
-			});
-		},
-		async listSubmissions() {
-			return (await db.select().from(submissions)).map(toSubmissionRecord);
-		},
-		async listSubmissionsByForm(formId) {
-			return (await db.select().from(submissions).where(eq(submissions.formId, formId)).orderBy(desc(submissions.submittedAt), desc(submissions.id))).map(toSubmissionRecord);
-		},
-		async listVersionsByForm(formId) {
-			return (await db.select().from(formVersions).where(eq(formVersions.formId, formId)).orderBy(desc(formVersions.version))).map((row) => ({
-				id: row.id,
-				formId: row.formId,
-				version: row.version,
-				schema: row.schema,
-				schemaHash: row.schemaHash
-			}));
-		},
-		async upsertDraft(record) {
-			await db.insert(drafts).values({
-				id: record.id,
-				formId: record.formId,
-				formVersionId: record.formVersionId,
-				data: record.data,
-				updatedAt: new Date(record.updatedAt)
-			}).onConflictDoUpdate({
-				target: [drafts.formId, drafts.id],
-				set: {
-					formVersionId: record.formVersionId,
-					data: record.data,
-					updatedAt: new Date(record.updatedAt)
-				}
-			});
-		},
-		async getDraft(formId, draftId) {
-			const row = (await db.select().from(drafts).where(and(eq(drafts.formId, formId), eq(drafts.id, draftId))).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				formId: row.formId,
-				formVersionId: row.formVersionId,
-				data: row.data,
-				updatedAt: row.updatedAt.toISOString()
-			};
-		},
-		async insertUser(record) {
-			await db.insert(users).values({
-				id: record.id,
-				email: record.email,
-				passwordHash: record.passwordHash,
-				role: record.role,
-				createdAt: new Date(record.createdAt)
-			});
-		},
-		async getUserByEmail(email) {
-			const row = (await db.select().from(users).where(eq(users.email, email)).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				email: row.email,
-				passwordHash: row.passwordHash,
-				role: row.role,
-				createdAt: row.createdAt.toISOString()
-			};
-		},
-		async insertApiKey(record) {
-			await db.insert(apiKeys).values({
-				id: record.id,
-				name: record.name,
-				prefix: record.prefix,
-				secretHash: record.secretHash,
-				role: record.role,
-				createdAt: new Date(record.createdAt),
-				revokedAt: record.revokedAt === null ? null : new Date(record.revokedAt)
-			});
-		},
-		async listApiKeys() {
-			return (await db.select().from(apiKeys)).map(toApiKeyRecord);
-		},
-		async findApiKeysByPrefix(prefix) {
-			return (await db.select().from(apiKeys).where(eq(apiKeys.prefix, prefix))).map(toApiKeyRecord);
-		},
-		async revokeApiKey(id, atIso) {
-			await db.update(apiKeys).set({ revokedAt: new Date(atIso) }).where(eq(apiKeys.id, id));
-		}
-	};
-}
-function toApiKeyRecord(row) {
-	return {
-		id: row.id,
-		name: row.name,
-		prefix: row.prefix,
-		secretHash: row.secretHash,
-		role: row.role,
-		createdAt: row.createdAt.toISOString(),
-		revokedAt: row.revokedAt === null ? null : row.revokedAt.toISOString()
-	};
-}
-function toSubmissionRecord(row) {
-	return {
-		id: row.id,
-		formId: row.formId,
-		formVersionId: row.formVersionId,
-		data: row.data,
-		submittedAt: row.submittedAt.toISOString()
-	};
-}
-//#endregion
-export { createApp as i, bootstrapSchema as n, SCHEMA_HASH_HEADER as r, createPostgresStorage as t };
-
-//# sourceMappingURL=postgres-storage-UMh8A-4C.mjs.map