@getstrata/bootstrap 1.0.8 → 1.1.0

package/dist/index.js

@@ -17,6 +17,7 @@ import {
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http/conditionalResponse";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
+import { createJsonErrorMiddleware } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/httpKernel.ts
 import {
@@ -152,8 +153,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -163,7 +165,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -172,7 +175,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -182,13 +186,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -297,41 +302,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
+      }))(handler);
     }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {
@@ -470,7 +462,11 @@ function buildModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const middleware = [
+    ...kernel.globalMiddleware(),
+    createJsonErrorMiddleware(),
+    ...kernel.group("api")
+  ];
   const cachedJson = createCachedJson(dependencies);
   const moduleRoutes = {};
   for (const module of modules) {
@@ -541,7 +537,7 @@ import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
   allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
-  tokenDefaultAbilities: ["*"]
+  tokenDefaultAbilities: []
 };
 
 // ../../src/bootstrap/providers/auth.ts
@@ -551,7 +547,7 @@ var authProvider = {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
     const apiGuard = new DatabaseTokenGuard(container);
     const sessionGuard = new SessionGuard(container);
-    const jwtGuard = new JwtGuard;
+    const jwtGuard = new JwtGuard(container);
     const basicGuard = new BasicAuthGuard(container);
     const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
@@ -596,7 +592,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 var appConfig = {
   name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  debug: (process.env.APP_DEBUG ?? "false") === "true",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
@@ -1001,6 +997,7 @@ function createAppContext() {
 // ../../src/bootstrap/createWebRoutes.ts
 import { join as join3 } from "path";
 import { isViewsEnabled as isViewsEnabled3 } from "@getstrata/core/runtime/frontendMode";
+import { assertUrlPathUnderRoot } from "@getstrata/core/security/safePath";
 import { notFoundHtmlResponse } from "@getstrata/core/view";
 function registerRoute(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
@@ -1014,12 +1011,16 @@ function createWebRoutes(dependencies, options = {}) {
   wrappedRoutes["/assets/*"] = async (request) => {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
-    const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join3(process.cwd(), "public", relativePath));
-    if (!await file.exists()) {
+    try {
+      const filePath = assertUrlPathUnderRoot(join3(process.cwd(), "public"), pathname);
+      const file = Bun.file(filePath);
+      if (!await file.exists()) {
+        return notFoundHtmlResponse();
+      }
+      return new Response(file);
+    } catch {
       return notFoundHtmlResponse();
     }
-    return new Response(file);
   };
   registerRoute("GET", "/assets/*", ["global", "web"]);
   return wrappedRoutes;
@@ -1041,6 +1042,7 @@ function createAppDependencies() {
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
 import { jsonResponse } from "@getstrata/core/http/response";
+import { envFlagEnabled as envFlagEnabled2 } from "@getstrata/core/runtime/appEnv";
 var {RedisClient } = globalThis.Bun;
 function resolveRedisUrl(dependencies) {
   if (!dependencies.container.has(CORE_CONFIG_TOKEN)) {
@@ -1124,10 +1126,10 @@ function createHealthRoutes(dependencies, options = {}) {
     "/ready": async () => {
       const extra = await resolveExtraFields(options.extra);
       const { checks, ready } = await collectDependencyChecks(dependencies);
+      const debug = envFlagEnabled2(process.env.APP_DEBUG);
       return jsonResponse({
         status: ready ? "ready" : "not_ready",
-        checks,
-        ...extra
+        ...debug ? { checks, ...extra } : {}
       }, { status: ready ? 200 : 503 });
     }
   };
@@ -1140,8 +1142,16 @@ import {
 // ../../src/bootstrap/membershipService.ts
 import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
 // ../../src/bootstrap/secretsGuard.ts
-import { envFlagEnabled as envFlagEnabled2, isProductionEnv } from "@getstrata/core/runtime/appEnv";
+import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { envFlagEnabled as envFlagEnabled3, isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { isViewsMode, parseFrontendMode } from "@getstrata/core/runtime/frontendMode";
+import {
+  assertPostgresRoleCannotBypassRls,
+  inspectCurrentPostgresRole,
+  isPostgresUrl,
+  postgresUrlUsername
+} from "@getstrata/core/tenant/enableTenantRls";
+import { isRlsTenancy } from "@getstrata/core/tenant/tenancyConfig";
 var PUBLISHED_TEST_ADMIN_API_TOKEN = "strata-admin-test-token";
 var PUBLISHED_TEST_MEMBER_API_TOKEN = "strata-member-test-token";
 var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "strata-scim-test-token";
@@ -1162,8 +1172,11 @@ var SECRETS_TO_ROTATE = [
   "KMS_ENCRYPTION_KEY",
   "STRIPE_WEBHOOK_SECRET",
   "ADMIN_API_TOKEN",
-  "MEMBER_API_TOKEN"
+  "MEMBER_API_TOKEN",
+  "DATABASE_URL",
+  "APP_DATABASE_URL"
 ];
+var RLS_BYPASS_DATABASE_USERS = new Set(["postgres", "root"]);
 function assertNoPlaceholderSecrets(env) {
   const unrotated = SECRETS_TO_ROTATE.filter((name) => PLACEHOLDER_SECRET_PATTERN.test(env[name]?.trim() ?? ""));
   if (unrotated.length > 0) {
@@ -1171,10 +1184,14 @@ function assertNoPlaceholderSecrets(env) {
   }
 }
 function isTokenAuthEnabled(env) {
-  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || envFlagEnabled2(env.FEATURE_API_TOKENS);
+  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || envFlagEnabled3(env.FEATURE_API_TOKENS);
 }
 function isOAuthEnabled(env) {
-  return envFlagEnabled2(env.FEATURE_OAUTH) || envFlagEnabled2(env.FEATURE_SAML) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+  return envFlagEnabled3(env.FEATURE_OAUTH) || envFlagEnabled3(env.FEATURE_SAML) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_IDP_SSO_URL?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+}
+function isHeaderOnlyAuth(env) {
+  const frontend = env.FRONTEND_MODE?.trim() ?? "";
+  return env.AUTH_MODE === "headers" || frontend === "api" && env.AUTH_DEV_HEADERS === "true";
 }
 function isCorsConfigured(env) {
   return env.CORS_ALLOWED_ORIGINS !== undefined;
@@ -1211,16 +1228,35 @@ function assertTokenAuthProductionSecrets(env) {
   }
 }
 function assertFeatureProductionSecrets(env) {
-  if (envFlagEnabled2(env.FEATURE_SCIM)) {
+  if (envFlagEnabled3(env.FEATURE_SCIM)) {
     const scimToken = env.SCIM_BEARER_TOKEN ?? PUBLISHED_TEST_SCIM_BEARER_TOKEN;
     if (PUBLISHED_TEST_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
       throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
-  if (envFlagEnabled2(env.FEATURE_FIELD_ENCRYPTION) && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  if ((envFlagEnabled3(env.FEATURE_FIELD_ENCRYPTION) || envFlagEnabled3(env.FEATURE_MFA)) && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption or MFA is enabled.");
   }
-  if (envFlagEnabled2(env.FEATURE_BILLING) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (envFlagEnabled3(env.FEATURE_SAML)) {
+    const required = [
+      "SAML_IDP_CERT",
+      "SAML_IDP_SSO_URL",
+      "SAML_SP_ENTITY_ID",
+      "SAML_ACS_URL",
+      "SAML_IDP_ISSUER"
+    ];
+    const missing = required.filter((name) => !env[name]?.trim());
+    if (missing.length > 0) {
+      throw new Error(`Production startup blocked: set ${missing.join(", ")} when FEATURE_SAML=true.`);
+    }
+    if (env.SAML_WANT_RESPONSE_SIGNED === "false") {
+      throw new Error("Production startup blocked: signed SAML responses are required (do not set SAML_WANT_RESPONSE_SIGNED=false).");
+    }
+  }
+  if (envFlagEnabled3(env.UPLOAD_ALLOW_UNKNOWN_MIME)) {
+    throw new Error("Production startup blocked: set UPLOAD_ALLOW_UNKNOWN_MIME=false (unknown MIME types are not allowed).");
+  }
+  if (envFlagEnabled3(env.FEATURE_BILLING) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   if (isOAuthEnabled(env) && !env.OAUTH_STATE_SECRET?.trim()) {
@@ -1232,14 +1268,44 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
     }
   }
-  if (envFlagEnabled2(env.FEATURE_PUBLIC_READS)) {
+  if (envFlagEnabled3(env.FEATURE_PUBLIC_READS)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled2(env.FEATURE_SIEM_EXPORT)) {
+  if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled3(env.FEATURE_SIEM_EXPORT)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
 }
 var LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "[::1]"]);
+function rlsRuntimeDatabaseUrl(env) {
+  const app = env.APP_DATABASE_URL?.trim();
+  if (app) {
+    return { name: "APP_DATABASE_URL", raw: app };
+  }
+  const database = env.DATABASE_URL?.trim();
+  if (database) {
+    return { name: "DATABASE_URL", raw: database };
+  }
+  return null;
+}
+function assertRlsUsesAppDatabaseRole(env) {
+  if (!isRlsTenancy(env)) {
+    return;
+  }
+  const runtime = rlsRuntimeDatabaseUrl(env);
+  if (!runtime) {
+    return;
+  }
+  const user = postgresUrlUsername(runtime.raw);
+  if (user === null) {
+    return;
+  }
+  if (user === "") {
+    throw new Error(`TENANCY_DRIVER=rls startup blocked: ${runtime.name} must include a NOBYPASSRLS role username.`);
+  }
+  if (RLS_BYPASS_DATABASE_USERS.has(user.toLowerCase())) {
+    throw new Error(`TENANCY_DRIVER=rls startup blocked: ${runtime.name} for TENANCY_DRIVER=rls must use a NOBYPASSRLS role, not ${user}. FORCE RLS does not apply to PostgreSQL superusers.`);
+  }
+}
 function assertPublicAppUrl(env) {
   const raw = env.APP_URL?.trim() ?? "";
   let url = null;
@@ -1262,6 +1328,9 @@ function assertProductionSecrets(env = process.env) {
   assertNoPlaceholderSecrets(env);
   assertAuthDevHeadersDisabled(env);
   assertPublicAppUrl(env);
+  if (isHeaderOnlyAuth(env)) {
+    throw new Error("Production startup blocked: header-only authentication is not allowed. Configure cookie, token, or JWT auth.");
+  }
   if (isTokenAuthEnabled(env)) {
     assertTokenAuthProductionSecrets(env);
   }
@@ -1269,6 +1338,7 @@ function assertProductionSecrets(env = process.env) {
   if (isViewsMode(parseFrontendMode(env.FRONTEND_MODE))) {
     assertSessionSecret(env);
   }
+  assertRlsUsesAppDatabaseRole(env);
 }
 // ../../src/bootstrap/web/forms.ts
 import {
@@ -1350,6 +1420,7 @@ function createRouteKernel(dependencies) {
 }
 // ../../src/bootstrap/web/server.ts
 import { currentRequestMeta as currentRequestMeta2, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { assertUrlPathUnderRoot as assertUrlPathUnderRoot2 } from "@getstrata/core/security/safePath";
 import { notFoundHtmlResponse as notFoundHtmlResponse2 } from "@getstrata/core/view";
 function socketAddress(server, request) {
   const address = server?.requestIP(request)?.address;
@@ -1409,9 +1480,14 @@ function createWebServer(options) {
         await options.onRequest?.(request);
         const url = new URL(request.url);
         if (url.pathname.startsWith("/assets/")) {
-          const file = Bun.file(`${publicDir}${url.pathname}`);
-          if (await file.exists()) {
-            return new Response(file);
+          try {
+            const filePath = assertUrlPathUnderRoot2(publicDir, url.pathname);
+            const file = Bun.file(filePath);
+            if (await file.exists()) {
+              return new Response(file);
+            }
+          } catch {
+            return await missingHtmlResponse();
           }
         }
         if (options.handle) {
@@ -1426,13 +1502,22 @@ function createWebServer(options) {
 // ../../src/bootstrap/web/session.ts
 import { createHmac, randomBytes } from "crypto";
 import { AuthManager as AuthManager2 } from "@getstrata/core/auth/guard";
+import { isSessionInvalidated } from "@getstrata/core/auth/sessionCookie";
 import { getBoundDatabaseConnection as getBoundDatabaseConnection2 } from "@getstrata/core/database/boundConnection";
-import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import {
+  getActiveDatabaseConnection,
+  hasActiveDatabaseConnection
+} from "@getstrata/core/database/connectionContext";
+import {
+  getDefaultDatabasePool as getDefaultDatabasePool3,
+  getDefaultDatabaseQuery
+} from "@getstrata/core/database/defaultConnection";
 import { currentSqlDialect, sqlTimestamp } from "@getstrata/core/database/dialect";
 import { readRequestCookie } from "@getstrata/core/http/cookies";
 import { currentRequestMeta as currentRequestMeta3 } from "@getstrata/core/http/requestMetaContext";
 import { isProductionEnv as isProductionEnv2 } from "@getstrata/core/runtime/appEnv";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
+import { runWithMigrationBypassForIdentifier } from "@getstrata/core/tenant/databaseTenantContext";
 function sqlPlaceholder(index) {
   return currentSqlDialect().placeholder(index);
 }
@@ -1443,17 +1528,25 @@ function isSqlClient(value) {
   return typeof value.unsafe === "function";
 }
 function resolveSql(source) {
-  if (isSqlClient(source)) {
-    return source;
+  const client = isSqlClient(source) ? source : source();
+  if (!hasActiveDatabaseConnection()) {
+    return client;
+  }
+  try {
+    if (client === getDefaultDatabasePool3() || client === getDefaultDatabaseQuery()) {
+      return getActiveDatabaseConnection(client);
+    }
+  } catch {
+    return client;
   }
-  return source();
+  return client;
 }
 function defaultSessionSql() {
   const bound = getBoundDatabaseConnection2();
   if (bound) {
     return bound;
   }
-  return getDefaultDatabasePool2();
+  return getDefaultDatabasePool3();
 }
 function defaultMapSessionUser(user) {
   return {
@@ -1483,14 +1576,32 @@ function mapSessionUserRow(row) {
   };
 }
 async function defaultLoadSessionUser(sql, sessionId) {
-  const rows = await sql.unsafe(`SELECT s.user_id, s.expires_at, u.*
-     FROM sessions s
-     INNER JOIN users u ON u.id = s.user_id
-     WHERE s.id = ${sqlPlaceholder(1)} AND s.expires_at > ${sqlNow()}`, [sessionId]);
-  const row = rows[0];
-  if (!row)
+  const sessionRows = await runWithMigrationBypassForIdentifier(sessionId, async () => {
+    return await sql.unsafe(`SELECT user_id, expires_at, created_at AS session_created_at
+     FROM sessions
+     WHERE id = ${sqlPlaceholder(1)} AND expires_at > ${sqlNow()}`, [sessionId]);
+  });
+  const session = sessionRows[0];
+  if (!session)
+    return null;
+  const userId = Number(session.user_id);
+  if (!Number.isInteger(userId) || userId <= 0) {
     return null;
-  return mapSessionUserRow(row);
+  }
+  return await runWithMigrationBypassForIdentifier(userId, async () => {
+    const rows = await sql.unsafe(`SELECT * FROM users WHERE id = ${sqlPlaceholder(1)}`, [
+      userId
+    ]);
+    const row = rows[0];
+    if (!row)
+      return null;
+    const createdSource = session.session_created_at;
+    const createdAt = createdSource instanceof Date ? createdSource.getTime() : createdSource ? Date.parse(String(createdSource)) : Number.NaN;
+    if (!Number.isFinite(createdAt) || isSessionInvalidated(createdAt, row.session_valid_after)) {
+      return null;
+    }
+    return mapSessionUserRow({ ...row, user_id: userId, session_created_at: createdSource });
+  });
 }
 function redirectWithCookie(location, setCookie, status) {
   return new Response(null, {
@@ -1545,25 +1656,40 @@ class CookieSessionStore {
   async create(user, meta = {}) {
     const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
-    await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at, user_agent, ip_address, last_active_at)
-       VALUES (${sqlPlaceholder(1)}, ${sqlPlaceholder(2)}, ${sqlPlaceholder(3)}, ${sqlPlaceholder(4)}, ${sqlPlaceholder(5)}, ${sqlNow()})`, [id, user.id, sqlTimestamp(expires), meta.userAgent ?? null, meta.ipAddress ?? null]);
+    await runWithMigrationBypassForIdentifier(user.id, async () => {
+      await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at, user_agent, ip_address, last_active_at, created_at)
+       VALUES (${sqlPlaceholder(1)}, ${sqlPlaceholder(2)}, ${sqlPlaceholder(3)}, ${sqlPlaceholder(4)}, ${sqlPlaceholder(5)}, ${sqlNow()}, ${sqlNow()})`, [id, user.id, sqlTimestamp(expires), meta.userAgent ?? null, meta.ipAddress ?? null]);
+    });
     return id;
   }
   async destroy(sessionId) {
-    await this.sql().unsafe(`DELETE FROM sessions WHERE id = ${sqlPlaceholder(1)}`, [sessionId]);
+    await runWithMigrationBypassForIdentifier(sessionId, async () => {
+      await this.sql().unsafe(`DELETE FROM sessions WHERE id = ${sqlPlaceholder(1)}`, [sessionId]);
+    });
+  }
+  async destroyAllSessions(userId) {
+    await runWithMigrationBypassForIdentifier(userId, async () => {
+      await this.sql().unsafe(`DELETE FROM sessions WHERE user_id = ${sqlPlaceholder(1)}`, [
+        userId
+      ]);
+    });
   }
   async destroyOtherSessions(userId, keepSessionId) {
-    await this.sql().unsafe(`DELETE FROM sessions WHERE user_id = ${sqlPlaceholder(1)} AND id <> ${sqlPlaceholder(2)}`, [userId, keepSessionId]);
+    await runWithMigrationBypassForIdentifier(userId, async () => {
+      await this.sql().unsafe(`DELETE FROM sessions WHERE user_id = ${sqlPlaceholder(1)} AND id <> ${sqlPlaceholder(2)}`, [userId, keepSessionId]);
+    });
   }
   async listForUser(userId) {
     const dialect = currentSqlDialect();
-    return this.sql().unsafe(`SELECT id, user_id, user_agent, ip_address, last_active_at, expires_at
+    return await runWithMigrationBypassForIdentifier(userId, () => this.sql().unsafe(`SELECT id, user_id, user_agent, ip_address, last_active_at, expires_at
        FROM sessions
        WHERE user_id = ${dialect.placeholder(1)} AND expires_at > ${dialect.nowExpression()}
-       ORDER BY last_active_at DESC${dialect.nullsLastSuffix()}, expires_at DESC`, [userId]);
+       ORDER BY last_active_at DESC${dialect.nullsLastSuffix()}, expires_at DESC`, [userId]));
   }
   async touch(sessionId) {
-    await this.sql().unsafe(`UPDATE sessions SET last_active_at = ${sqlNow()} WHERE id = ${sqlPlaceholder(1)}`, [sessionId]);
+    await runWithMigrationBypassForIdentifier(sessionId, async () => {
+      await this.sql().unsafe(`UPDATE sessions SET last_active_at = ${sqlNow()} WHERE id = ${sqlPlaceholder(1)}`, [sessionId]);
+    });
   }
   async read(request) {
     const sessionId = this.sessionIdFromRequest(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "description": "Strata application bootstrap: HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -168,14 +168,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external mysql2 --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json && bun ../../scripts/prune-bootstrap-dist-types.ts",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external mysql2 --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external mysql2 --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^1.0.8",
+    "@getstrata/core": "^1.1.0",
     "typescript": "^5.9.0"
   },
   "engines": {