@getstrata/bootstrap 0.2.8 → 0.2.9

package/dist/index.js

@@ -1,7 +1,4 @@
 // @bun
-// ../../src/bootstrap/public-api.ts
-import { resolveApplicationQueue as resolveApplicationQueue2, setActiveApplicationContext as setActiveApplicationContext2 } from "@getstrata/core";
-
 // ../../src/core/scheduler/schedule.ts
 class Schedule {
   tasks = [];
@@ -512,8 +509,6 @@ var DEFAULT_CACHE_MAX_ENTRIES = 100;
 var DEFAULT_CACHE_DRIVER = "array";
 var DEFAULT_API_TOKEN = "";
 var DEFAULT_QUEUE_DRIVER = "sync";
-// ../../src/bootstrap/context.ts
-import { setActiveApplicationContext } from "@getstrata/core";
 
 // ../../src/bootstrap/contracts.ts
 class ServiceContainer {
@@ -600,6 +595,41 @@ function resolveService(dependencies, token) {
   return dependencies.container.resolve(token);
 }
 
+// ../../src/bootstrap/applicationRegistry.ts
+var activeContext;
+function setActiveApplicationContext(context) {
+  activeContext = context;
+}
+function requireActiveApplicationContext() {
+  if (!activeContext) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return activeContext;
+}
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
+}
+function resolveApplicationLogger() {
+  return appLogger;
+}
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
+}
+// ../../src/bootstrap/context.ts
+import { setActiveApplicationContext as setActiveApplicationContext2 } from "@getstrata/core";
+
 // ../../src/bootstrap/discoverModules.ts
 import { readdirSync } from "fs";
 import { join } from "path";
@@ -728,6 +758,7 @@ var db = new Proxy(function database() {}, {
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
+var connection_default = db;
 
 // ../../src/modules/user/apiTokenTable.ts
 import { defineTable } from "@getstrata/core/database";
@@ -1809,116 +1840,6 @@ class InvalidateCacheTagsJob extends Job {
 }
 var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
 
-// ../../src/bootstrap/applicationRegistry.ts
-var activeContext;
-function requireActiveApplicationContext() {
-  if (!activeContext) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return activeContext;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-function resolveApplicationQueue() {
-  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
-}
-function resolveApplicationAuth() {
-  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
-}
-function resolveApplicationPolicyGate() {
-  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac as createHmac2 } from "crypto";
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac2("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  constructor() {}
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
-}
-var jobRegistry = new JobRegistry;
-
 // ../../src/core/pagination/index.ts
 function buildPaginationMeta(input) {
   const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
@@ -3646,6 +3567,34 @@ class FailedJobService {
 }
 var failedJobService_default = FailedJobService;
 
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  constructor() {}
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var jobRegistry = new JobRegistry;
+
 // ../../src/core/queue/jobRunner.ts
 async function runQueueJob(envelope, failedJobs) {
   const job = jobRegistry.create(envelope.name);
@@ -3760,19 +3709,82 @@ function createProductionQueue(driver, options = {}) {
   return new ResilientQueue(failedJobs, driver === "async");
 }
 
-// ../../src/core/queue/createAppQueue.ts
-var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac as createHmac2 } from "crypto";
+class DispatchWebhookJob extends Job {
+  maxAttempts = 3;
+  backoffMs = 2000;
+  async handle(payload) {
+    const rows = await repositoryConnection`
+      SELECT id, url, secret
+      FROM webhook
+      WHERE id = ${payload.webhookId} AND active = TRUE
+      LIMIT 1
+    `;
+    const webhook = rows[0];
+    if (!webhook) {
+      return;
+    }
+    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
+    const signature = createHmac2("sha256", webhook.secret).update(body).digest("hex");
+    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
+    let responseStatus = null;
+    let errorMessage = null;
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-workhub-signature": signature
+        },
+        body
+      }, { allowHttp: appConfig.env !== "production" });
+      responseStatus = response.status;
+      if (!response.ok) {
+        throw new Error(`Webhook delivery failed with status ${response.status}.`);
+      }
+    } catch (error) {
+      errorMessage = error instanceof Error ? error.message : String(error);
+      await repositoryConnection`
+        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
+        VALUES (
+          ${webhook.id},
+          ${payload.event},
+          ${JSON.stringify(payload.payload)}::jsonb,
+          ${responseStatus},
+          ${errorMessage}
+        )
+      `;
+      throw error instanceof Error ? error : new Error(errorMessage);
+    }
+    await repositoryConnection`
+      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
+      VALUES (
+        ${webhook.id},
+        ${payload.event},
+        ${JSON.stringify(payload.payload)}::jsonb,
+        ${responseStatus}
+      )
+    `;
+  }
+}
+var dispatchWebhookJob_default = DispatchWebhookJob;
+
+// ../../src/bootstrap/queue/defaultJobs.ts
 function registerDefaultJobs() {
   jobRegistry.register("cache.invalidate-tags", () => {
     return new invalidateCacheTagsJob_default(resolveApplicationCache());
   });
   jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
 }
-function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService()) {
+
+// ../../src/core/queue/createAppQueue.ts
+var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
+function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {
   return createProductionQueue(driver, {
     redisUrl,
     failedJobs,
-    registerJobs: registerDefaultJobs
+    registerJobs
   });
 }
 
@@ -3880,7 +3892,7 @@ var queueProvider = {
     config.set("queue.driver", driver);
     const failedJobs = createFailedJobService();
     container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
-    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs));
+    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs, registerDefaultJobs));
   }
 };
 var queue_default = queueProvider;
@@ -4357,7 +4369,7 @@ function createAppContext() {
     config,
     dependencies
   };
-  setActiveApplicationContext(appContext);
+  setActiveApplicationContext2(appContext);
   return appContext;
 }
 // ../../src/bootstrap/createWebRoutes.ts
@@ -4864,6 +4876,151 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     return response;
   };
 }
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = new AsyncLocalStorage5;
+var membershipRepository = new memberRepository_default;
+
+// ../../src/core/auth/membershipService.ts
+class MembershipService {
+  members;
+  constructor(members = membershipRepository) {
+    this.members = members;
+  }
+  async listOrganizationIdsForUser(userId) {
+    const memberships = await this.members.listForUser(userId);
+    return memberships.map((membership) => membership.organization_id);
+  }
+  async getOrgRole(userId, organizationId) {
+    const membership = await this.members.findMembership(userId, organizationId);
+    return membership?.role ?? null;
+  }
+  async requireOrgAccess(organizationId, minimumRole = "member", user = currentAuthUser()) {
+    if (!user) {
+      throw new ForbiddenError("Authentication required.");
+    }
+    if (isGlobalAdmin(user)) {
+      return "owner";
+    }
+    const role = await this.getOrgRole(resolveUserId(user), organizationId);
+    if (!role || !hasMinimumOrgRole(role, minimumRole)) {
+      throw new ForbiddenError("Organization membership required.");
+    }
+    return role;
+  }
+  async filterAccessibleOrganizationIds(organizationIds, user = currentAuthUser()) {
+    if (!user) {
+      return [];
+    }
+    if (isGlobalAdmin(user)) {
+      return organizationIds;
+    }
+    const allowed = new Set(await this.listOrganizationIdsForUser(resolveUserId(user)));
+    return organizationIds.filter((organizationId) => allowed.has(organizationId));
+  }
+  async addOwnerOnOrganizationCreate(organizationId, userId) {
+    await this.members.addMember({
+      organizationId,
+      userId,
+      role: "owner"
+    });
+  }
+  listMembersForOrganization(organizationId) {
+    return this.members.listForOrganization(organizationId);
+  }
+  addMember(input) {
+    return this.members.addMember(input);
+  }
+  removeMember(organizationId, userId) {
+    return this.members.removeMember(organizationId, userId);
+  }
+}
+var membershipService_default = MembershipService;
+
+// ../../src/bootstrap/membershipService.ts
+function resolveMembershipService() {
+  const dependencies = resolveApplicationDependencies();
+  if (dependencies.container.has("core.membership")) {
+    return dependencies.container.resolve("core.membership");
+  }
+  return new membershipService_default;
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -5097,7 +5254,7 @@ export {
   wrapSecuredRouteModelByKey,
   toRouteRequest,
   slugify,
-  setActiveApplicationContext2 as setActiveApplicationContext,
+  setActiveApplicationContext,
   securedBindRouteModelByKey,
   securedBindRouteModel,
   scheduleRunCommand,
@@ -5105,7 +5262,15 @@ export {
   runDueScheduledTasks,
   routeParams,
   resolveService,
-  resolveApplicationQueue2 as resolveApplicationQueue,
+  resolveMembershipService,
+  resolveApplicationQueue,
+  resolveApplicationPolicyGate,
+  resolveApplicationLogger,
+  resolveApplicationDependencies,
+  resolveApplicationConfig,
+  resolveApplicationCache,
+  resolveApplicationAuth,
+  registerDefaultJobs,
   prefixRouteMap,
   parseFormBody,
   mergeWebRoutes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -50,6 +50,16 @@
       "import": "./dist/entries/httpKernel.js",
       "default": "./dist/entries/httpKernel.js"
     },
+    "./membershipService": {
+      "types": "./dist/bootstrap/membershipService.d.ts",
+      "import": "./dist/entries/membershipService.js",
+      "default": "./dist/entries/membershipService.js"
+    },
+    "./queue/defaultJobs": {
+      "types": "./dist/bootstrap/queue/defaultJobs.d.ts",
+      "import": "./dist/entries/queue/defaultJobs.js",
+      "default": "./dist/entries/queue/defaultJobs.js"
+    },
     "./providers": {
       "types": "./dist/bootstrap/providers/index.d.ts",
       "import": "./dist/entries/providers.js",
@@ -72,14 +82,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/providers.ts entries/providers/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/membershipService.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.16",
+    "@getstrata/core": "^0.5.17",
     "typescript": "^5.9.0"
   }
 }