@getstrata/bootstrap 0.2.6 → 0.2.7

package/dist/entries/providers/view.js

@@ -0,0 +1,635 @@
+// @bun
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage;
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/view/etaViewEngine.ts
+import { join } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
+  }
+}
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+// ../../src/bootstrap/config.ts
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/modules/user/provider.ts
+import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
+import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
+import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/modules/user/apiTokenRepository.ts
+import { BaseRepository } from "@getstrata/core/database";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/modules/user/apiTokenTable.ts
+import { defineTable } from "@getstrata/core/database";
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/authService.ts
+import { verifyPassword } from "@getstrata/core/auth/password";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { UnauthorizedError } from "@getstrata/core/errors/http";
+import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
+import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
+import { verifyTotp } from "@getstrata/core/security/totp";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationRepository.ts
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database";
+
+// ../../src/modules/user/notificationTable.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database";
+var notificationTable = defineTable2({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/notificationService.ts
+import { NotFoundError } from "@getstrata/core/errors/http";
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+import { BaseRepository as BaseRepository3, defineTable as defineTable3 } from "@getstrata/core/database";
+var oauthIdentityTable = defineTable3({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository4 } from "@getstrata/core/database";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable4 } from "@getstrata/core/database";
+var userTable = defineTable4({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/tokenService.ts
+import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var authContext = new AsyncLocalStorage3;
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
+}
+function createCsrfTokenCookie() {
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
+  }
+  return createCsrfTokenCookie();
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
+  }
+  return resolveCsrfToken(request).token;
+}
+
+// ../../src/core/http/flashSession.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
+  }
+}
+// ../../src/bootstrap/providers/view.ts
+var CORE_VIEW_TOKEN = "core.view";
+var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
+var viewProvider = {
+  name: "view",
+  register({ container, config }) {
+    if (!isViewsEnabled()) {
+      return;
+    }
+    const viewsDirectory = process.env.VIEW_DIRECTORY?.trim() || DEFAULT_VIEWS_DIRECTORY;
+    config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
+    container.set(CORE_VIEW_TOKEN, new EtaViewEngine(viewsDirectory, () => resolveWebLayoutData(container, currentRequestMeta().request)));
+  }
+};
+export {
+  viewProvider,
+  VIEW_DIRECTORY_CONFIG_KEY,
+  CORE_VIEW_TOKEN
+};