@getstrata/bootstrap 0.2.49 → 0.2.51

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# @getstrata/bootstrap changelog
+
+## 0.2.51
+
+- `createCookieSessionAuthManager` returns `CookieSessionAuthManager` (`signIn`, `signOut`, `signInRedirect`, `signOutRedirect`). Controllers no longer need a local cookie helper.
+- Pass `loadSessionUser` to replace the default `users.learn_subscriber` / `users.is_admin` session query. Keep `mapUser` in the app.
+
+## 0.2.50
+
+- `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; WorkHub abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.
+- `checkDatabase()` / `createHealthRoutes()` ping the bound database client, not WorkHub’s private connection holder. `/health` stays `{ status: "ok" }` unless `{ pingOnHealth: true }`. Extra JSON fields are optional.
+- `assertProductionSecrets()` is feature-gated. A production HTMX app with `SESSION_SECRET` (32+), `AUTH_DEV_HEADERS=false`, and feature flags off does not need WorkHub API tokens. WorkHub’s current production env (rotated tokens, CORS, pepper, expiry) still passes.
+- Re-exports `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN`.

package/README.md

@@ -28,7 +28,9 @@ import {
 import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
 ```
 
-`createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling apps should call it only if they want those WorkHub production gates (API tokens, Stripe, SCIM, CORS).
+`createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling HTMX apps can call it in production without WorkHub API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
+
+Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema.
 
 `wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again.
 

package/dist/bootstrap/config.d.ts

@@ -4,7 +4,7 @@ declare const CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
 declare const CACHE_DRIVER_CONFIG_KEY = "cache.driver";
 declare const REDIS_URL_CONFIG_KEY = "cache.redisUrl";
 declare const DATABASE_URL_CONFIG_KEY = "database.url";
-export { CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
 declare const AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
 declare const DEFAULT_APP_PORT = 3000;
 declare const DEFAULT_CACHE_TTL_MS = 3600000;

package/dist/bootstrap/health.d.ts

@@ -1,8 +1,14 @@
 import type { AppDependencies } from "./contracts";
+interface CreateHealthRoutesOptions {
+    pingOnHealth?: boolean;
+    extra?: Record<string, unknown> | (() => Record<string, unknown> | Promise<Record<string, unknown>>);
+}
 declare function checkDatabase(): Promise<boolean>;
+declare function pingDatabase(): Promise<boolean>;
 declare function checkRedis(redisUrl: string): Promise<boolean>;
-declare function createHealthRoutes(dependencies: AppDependencies): {
+declare function createHealthRoutes(dependencies: AppDependencies, options?: CreateHealthRoutesOptions): {
     "/health": () => Promise<Response>;
     "/ready": () => Promise<Response>;
 };
-export { checkDatabase, checkRedis, createHealthRoutes };
+export type { CreateHealthRoutesOptions };
+export { checkDatabase, checkRedis, createHealthRoutes, pingDatabase };

package/dist/bootstrap/public-api.d.ts

@@ -9,7 +9,7 @@ export { buildModuleRoutes } from "./buildModuleRoutes.ts";
 export type { BuildWebModuleRoutesOptions } from "./buildWebModuleRoutes.ts";
 export { buildWebModuleRoutes } from "./buildWebModuleRoutes.ts";
 export { cacheTagsForModelWrite, discoverModelTableNames } from "./cache/modelCacheTags.ts";
-export { APP_PORT_CONFIG_KEY, CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, DATABASE_URL_CONFIG_KEY, DEFAULT_APP_PORT, REDIS_URL_CONFIG_KEY, } from "./config.ts";
+export { APP_PORT_CONFIG_KEY, CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, DATABASE_URL_CONFIG_KEY, DEFAULT_APP_PORT, REDIS_URL_CONFIG_KEY, } from "./config.ts";
 export { collectProviders, createAppContext, runProviderPhase } from "./context.ts";
 export type { AppContext, AppDependencies, AppModule, AppRouteMap, CachedJson, ConfigStore, ModuleRouteContext, MutableAppDependencies, ProviderContext, ServiceFactory, ServiceProvider, } from "./contracts.ts";
 export { assertAppDependenciesComplete, getRequiredDependency, resolveService, ServiceContainer, } from "./contracts.ts";
@@ -17,6 +17,8 @@ export { createWebRoutes, mergeWebRoutes } from "./createWebRoutes.ts";
 export { createAppDependencies } from "./dependencies.ts";
 export type { DiscoverModulesOptions } from "./discoverModules.ts";
 export { configureModulesDirectory, discoverModules, ensureModulesLoaded, } from "./discoverModules.ts";
+export type { CreateHealthRoutesOptions } from "./health.ts";
+export { checkDatabase, checkRedis, createHealthRoutes, pingDatabase } from "./health.ts";
 export { type RouteModelAuthorization, securedBindRouteModel, securedBindRouteModelByKey, } from "./http/securedRouteModelBinding.ts";
 export { createHttpKernel, type HttpKernel, type MiddlewareGroupName } from "./httpKernel.ts";
 export { resolveMembershipService } from "./membershipService.ts";
@@ -25,4 +27,4 @@ export { coreProviders } from "./providers/index.ts";
 export { registerDefaultJobs } from "./queue/defaultJobs.ts";
 export { RouteRegistry, routeRegistry } from "./routeRegistry.ts";
 export { assertProductionSecrets } from "./secretsGuard.ts";
-export { CookieSessionStore, createCsrfProtection, createRouteKernel, createWebServer, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";
+export { CookieSessionAuthManager, CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, createCsrfProtection, createRouteKernel, createWebServer, type LoadSessionUser, type MapSessionUser, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";

package/dist/bootstrap/web/index.d.ts

@@ -4,5 +4,5 @@
 export { createCsrfProtection, type ParsedForm, parseFormBody } from "./forms.ts";
 export { createRouteKernel, routeParams, toRouteRequest, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./routing.ts";
 export { convertAppRoutesToBunRoutes, createWebServer, type WebServerOptions } from "./server.ts";
-export { CookieSessionStore, type SessionUser } from "./session.ts";
+export { CookieSessionAuthManager, CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, type LoadSessionUser, type MapSessionUser, type SessionUser, } from "./session.ts";
 export { slugify } from "./slug.ts";

package/dist/bootstrap/web/session.d.ts

@@ -1,3 +1,5 @@
+import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { type AuthGuard, AuthManager } from "@getstrata/core/auth/guard";
 export interface SessionUser {
     id: number;
     name: string;
@@ -8,18 +10,55 @@ export interface SessionUser {
 type SqlClient = {
     unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
 };
+type SqlSource = SqlClient | (() => SqlClient);
+export type LoadSessionUser = (sql: SqlClient, sessionId: string) => Promise<SessionUser | null>;
+declare function defaultSessionSql(): SqlClient;
+export type MapSessionUser = (user: SessionUser) => AuthUser;
+declare function defaultMapSessionUser(user: SessionUser): AuthUser;
 export declare class CookieSessionStore {
-    private readonly sql;
+    private readonly sqlSource;
     private readonly secret;
     private readonly cookieName;
     private readonly maxAgeSeconds;
-    constructor(sql: SqlClient, secret: string, cookieName?: string, maxAgeSeconds?: number);
+    private readonly loadSessionUser;
+    constructor(sqlSource: SqlSource, secret: string, cookieName?: string, maxAgeSeconds?: number, loadSessionUser?: LoadSessionUser);
     cookieHeader(_user: SessionUser, sessionId: string): string;
     clearCookieHeader(): string;
+    sessionIdFromRequest(request: Request): string | null;
     private withSecureFlag;
+    private sql;
     create(user: SessionUser): Promise<string>;
     destroy(sessionId: string): Promise<void>;
     read(request: Request): Promise<SessionUser | null>;
     private sign;
 }
-export {};
+export declare class CookieSessionGuard implements AuthGuard {
+    private readonly store;
+    private readonly mapUser;
+    constructor(store: CookieSessionStore, mapUser?: MapSessionUser);
+    resolve(request: Request): Promise<AuthUser | null>;
+}
+export declare class CookieSessionAuthManager extends AuthManager {
+    readonly store: CookieSessionStore;
+    constructor(store: CookieSessionStore, mapUser?: MapSessionUser);
+    signIn(user: SessionUser): Promise<{
+        sessionId: string;
+        setCookie: string;
+    }>;
+    signOut(request: Request): Promise<{
+        setCookie: string;
+    }>;
+    signInRedirect(user: SessionUser, location: string, status?: number): Promise<Response>;
+    signOutRedirect(request: Request, location: string, status?: number): Promise<Response>;
+}
+export interface CreateCookieSessionAuthManagerOptions {
+    store?: CookieSessionStore;
+    sql?: SqlSource;
+    secret?: string;
+    cookieName?: string;
+    maxAgeSeconds?: number;
+    mapUser?: MapSessionUser;
+    loadSessionUser?: LoadSessionUser;
+}
+declare function createCookieSessionAuthManager(options?: CreateCookieSessionAuthManagerOptions): CookieSessionAuthManager;
+export { createCookieSessionAuthManager, defaultMapSessionUser, defaultSessionSql };

package/dist/entries/buildModuleRoutes.js

@@ -7,6 +7,7 @@ import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -67,24 +68,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -188,7 +203,7 @@ class HttpKernel {
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
     return this.wrapWeb(withMiddleware(...middleware)(handler));
@@ -212,7 +227,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);

package/dist/entries/buildWebModuleRoutes.js

@@ -10,6 +10,7 @@ import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -70,24 +71,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -191,7 +206,7 @@ class HttpKernel {
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
     return this.wrapWeb(withMiddleware(...middleware)(handler));
@@ -215,7 +230,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);

package/dist/entries/config.js

@@ -3,7 +3,9 @@ var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -30,7 +32,9 @@ export {
   CACHE_DRIVER_CONFIG_KEY,
   CACHE_MAX_ENTRIES_CONFIG_KEY,
   CACHE_TTL_MS_CONFIG_KEY,
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/context.js

@@ -107,7 +107,9 @@ var authConfig = {
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,