@getstrata/bootstrap 0.2.65 → 0.2.68

package/dist/entries/providers.js

@@ -81,7 +81,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -306,7 +306,12 @@ function readDiscoverModulesState() {
   return state;
 }
 function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+  const state = readDiscoverModulesState();
+  if (state.configuredModulesDir !== modulesDir) {
+    state.appModules.length = 0;
+    state.modulesReady = undefined;
+  }
+  state.configuredModulesDir = modulesDir;
 }
 function resolveModulesDirectory(options) {
   const state = readDiscoverModulesState();
@@ -316,7 +321,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -470,7 +475,6 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
-import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
@@ -482,148 +486,6 @@ import {
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
-
-// ../../src/modules/organization/repository.ts
-import { BaseRepository } from "@getstrata/core/database/baseRepository";
-import { NotFoundError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/organization/table.ts
-import { defineTable } from "@getstrata/core/database/table";
-
-// ../../src/domain/workhub.ts
-var ORGANIZATION_TABLE = "organization";
-
-// ../../src/modules/organization/table.ts
-var organizationTable = defineTable({
-  name: ORGANIZATION_TABLE,
-  primaryKey: "id",
-  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
-  softDeletes: true,
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/organization/repository.ts
-class OrganizationRepository extends BaseRepository {
-  constructor() {
-    super(organizationTable);
-  }
-  async findBySlug(slug) {
-    return await this.firstOrNull({ slug });
-  }
-  async listForTenant(options) {
-    return await this.findAll({
-      limit: options.limit,
-      offset: options.offset,
-      where: { tenant_id: options.tenantId ?? currentTenantId() }
-    });
-  }
-  async countForTenant(tenantId = currentTenantId()) {
-    return await this.countWhere({ tenant_id: tenantId });
-  }
-  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
-    const organization = await this.findById(id);
-    if (!organization || organization.tenant_id !== tenantId) {
-      throw new NotFoundError(`SCIM group ${id} not found.`);
-    }
-    return organization;
-  }
-}
-var repository_default = OrganizationRepository;
-
-// ../../src/modules/user/repository.ts
-import {
-  emailLookupForQuery,
-  protectEmail,
-  revealEmail
-} from "@getstrata/core/crypto/fieldEncryption";
-import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
-import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/user/table.ts
-import { defineTable as defineTable2 } from "@getstrata/core/database/table";
-var userTable = defineTable2({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "mfa_recovery_codes",
-    "profile_photo_path",
-    "session_valid_after",
-    "current_organization_id",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/repository.ts
-class UserRepository extends BaseRepository2 {
-  constructor() {
-    super(userTable);
-  }
-  decode(record) {
-    return {
-      ...record,
-      email: revealEmail(record.email),
-      mfa_secret: revealMfaSecret(record.mfa_secret)
-    };
-  }
-  async findById(id) {
-    const record = await super.findById(id);
-    return record ? this.decode(record) : null;
-  }
-  async findAll(options = {}) {
-    const records = await super.findAll(options);
-    return records.map((record) => this.decode(record));
-  }
-  async create(values) {
-    const email = values.email;
-    if (!email) {
-      throw new Error("Email is required.");
-    }
-    const protectedEmail = protectEmail(email);
-    const record = await super.create({
-      ...values,
-      tenant_id: values.tenant_id ?? currentTenantId2(),
-      email: protectedEmail.storedEmail,
-      email_lookup: protectedEmail.emailLookup,
-      password_hash: values.password_hash ?? ""
-    });
-    return this.decode(record);
-  }
-  async updateByIdOrThrow(id, values, errorFactory) {
-    const changes = { ...values };
-    if (values.email !== undefined) {
-      const protectedEmail = protectEmail(values.email);
-      changes.email = protectedEmail.storedEmail;
-      changes.email_lookup = protectedEmail.emailLookup;
-    }
-    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
-    return this.decode(record);
-  }
-  async findByEmail(email) {
-    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
-    const record = records[0];
-    return record ? this.decode(record) : null;
-  }
-  async countForTenant(tenantId = currentTenantId2()) {
-    return await this.countWhere({ tenant_id: tenantId });
-  }
-}
-var repository_default2 = UserRepository;
-
-// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -637,23 +499,11 @@ var viewProvider = {
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
     configureWebLayoutData({
-      extra: async (user) => {
-        const appName = appDisplayName();
-        if (!user || typeof user.id !== "number") {
-          return { appName, currentOrganization: null, organizations: [] };
-        }
-        try {
-          const record = await new repository_default2().findByIdOrThrow(user.id);
-          const memberships = await resolveMembershipLookup().listForUser(record.id);
-          const organizationsRepo = new repository_default;
-          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
-          const currentId = record.current_organization_id ?? null;
-          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
-          return { appName, currentOrganization, organizations };
-        } catch {
-          return { appName, currentOrganization: null, organizations: [] };
-        }
-      }
+      extra: async () => ({
+        appName: appDisplayName(),
+        currentOrganization: null,
+        organizations: []
+      })
     });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {

package/dist/entries/secretsGuard.js

@@ -2,12 +2,15 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var PUBLISHED_TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var PUBLISHED_TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
 var MIN_SESSION_SECRET_LENGTH = 32;
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+var PUBLISHED_TEST_TOKENS = new Set([
+  PUBLISHED_TEST_ADMIN_API_TOKEN,
+  PUBLISHED_TEST_MEMBER_API_TOKEN
+]);
+var PUBLISHED_TEST_SCIM_TOKENS = new Set([PUBLISHED_TEST_SCIM_BEARER_TOKEN]);
 function isEnabled(value, defaultEnabled) {
   if (value === undefined) {
     return defaultEnabled;
@@ -34,36 +37,19 @@ function assertSessionSecret(env) {
     throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx (32+ characters).");
   }
 }
-function assertWorkHubProductionSecrets(env) {
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+function assertPublishedTestTokensRotated(env) {
+  const adminToken = env.ADMIN_API_TOKEN ?? "";
+  const memberToken = env.MEMBER_API_TOKEN ?? "";
+  const scimToken = env.SCIM_BEARER_TOKEN ?? "";
+  if (PUBLISHED_TEST_TOKENS.has(adminToken) || PUBLISHED_TEST_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from published test defaults.");
   }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  if (scimToken && PUBLISHED_TEST_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
   }
+}
+function assertTokenAuthProductionSecrets(env) {
+  assertPublishedTestTokensRotated(env);
   if (!env.TOKEN_HASH_PEPPER?.trim()) {
     throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
   }
@@ -71,11 +57,11 @@ function assertWorkHubProductionSecrets(env) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
 }
-function assertSiblingProductionSecrets(env) {
+function assertFeatureProductionSecrets(env) {
   if (isEnabled(env.FEATURE_SCIM, false)) {
-    const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-    if (DEFAULT_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
-      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+    const scimToken = env.SCIM_BEARER_TOKEN ?? PUBLISHED_TEST_SCIM_BEARER_TOKEN;
+    if (PUBLISHED_TEST_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
+      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
   if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
@@ -107,10 +93,9 @@ function assertProductionSecrets(env = process.env) {
   }
   assertAuthDevHeadersDisabled(env);
   if (isTokenAuthEnabled(env)) {
-    assertWorkHubProductionSecrets(env);
-  } else {
-    assertSiblingProductionSecrets(env);
+    assertTokenAuthProductionSecrets(env);
   }
+  assertFeatureProductionSecrets(env);
   const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
   if (frontendMode === "server-htmx") {
     assertSessionSecret(env);

package/dist/entries/web/routing.js

@@ -44,7 +44,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -90,32 +116,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -186,7 +186,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);

package/dist/entries/web/session.js

@@ -96,19 +96,33 @@ class CookieSessionStore {
   sql() {
     return resolveSql(this.sqlSource);
   }
-  async create(user) {
+  async create(user, meta = {}) {
     const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
-    await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
-      id,
-      user.id,
-      expires
-    ]);
+    await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at, user_agent, ip_address, last_active_at)
+       VALUES ($1, $2, $3, $4, $5, NOW())`, [id, user.id, expires, meta.userAgent ?? null, meta.ipAddress ?? null]);
     return id;
   }
   async destroy(sessionId) {
     await this.sql().unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
+  async destroyOtherSessions(userId, keepSessionId) {
+    await this.sql().unsafe(`DELETE FROM sessions WHERE user_id = $1 AND id <> $2`, [
+      userId,
+      keepSessionId
+    ]);
+  }
+  async listForUser(userId) {
+    return this.sql().unsafe(`SELECT id, user_id, user_agent, ip_address, last_active_at, expires_at
+       FROM sessions
+       WHERE user_id = $1 AND expires_at > NOW()
+       ORDER BY last_active_at DESC NULLS LAST, expires_at DESC`, [userId]);
+  }
+  async touch(sessionId) {
+    await this.sql().unsafe(`UPDATE sessions SET last_active_at = NOW() WHERE id = $1`, [
+      sessionId
+    ]);
+  }
   async read(request) {
     const sessionId = this.sessionIdFromRequest(request);
     if (!sessionId)
@@ -142,8 +156,8 @@ class CookieSessionAuthManager extends AuthManager {
     super(new CookieSessionGuard(store, mapUser));
     this.store = store;
   }
-  async signIn(user) {
-    const sessionId = await this.store.create(user);
+  async signIn(user, meta = {}) {
+    const sessionId = await this.store.create(user, meta);
     return { sessionId, setCookie: this.store.cookieHeader(user, sessionId) };
   }
   async signOut(request) {
@@ -153,8 +167,8 @@ class CookieSessionAuthManager extends AuthManager {
     }
     return { setCookie: this.store.clearCookieHeader() };
   }
-  async signInRedirect(user, location, status = 302) {
-    const { setCookie } = await this.signIn(user);
+  async signInRedirect(user, location, status = 302, meta = {}) {
+    const { setCookie } = await this.signIn(user, meta);
     return redirectWithCookie(location, setCookie, status);
   }
   async signOutRedirect(request, location, status = 302) {