@getstrata/core 0.4.0 → 0.5.0

package/dist/entries/tenant/tenantMiddleware.js

@@ -0,0 +1,312 @@
+// @bun
+// ../../src/core/tenant/tenantMiddleware.ts
+import { createHash } from "crypto";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var activeConnection = new AsyncLocalStorage;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var authContext = new AsyncLocalStorage2;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await connection_default`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage3;
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  return await getDatabase().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
+var DEFAULT_TENANT = {
+  id: 1,
+  slug: "default",
+  plan: "enterprise",
+  region: "eu"
+};
+async function resolveUserTenantId(userId) {
+  return await runWithMigrationBypass(async () => {
+    const rows = await connection_default`
+      SELECT tenant_id
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `;
+    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
+  });
+}
+function auditChecksum(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+async function resolveTenantForRequest(request) {
+  const user = currentAuthUser();
+  const headerValue = request.headers.get("x-tenant-id")?.trim();
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  if (user) {
+    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
+    if (Number.isInteger(userId) && userId > 0) {
+      const userTenantId = await resolveUserTenantId(userId);
+      if (!isGlobalAdmin(user)) {
+        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+          throw new ForbiddenError("Tenant header does not match your account.");
+        }
+        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+      }
+      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
+        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
+      }
+      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+    }
+  }
+  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
+  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
+}
+function createTenantMiddleware() {
+  return async (request, next) => {
+    try {
+      const tenant = await resolveTenantForRequest(request);
+      return await runWithTenantDatabase(tenant, async () => {
+        const response = await next();
+        const headers = new Headers(response.headers);
+        headers.set("x-tenant-id", String(tenant.id));
+        headers.set("x-tenant-region", tenant.region);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      });
+    } catch (error) {
+      if (error instanceof HttpError) {
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+      throw error;
+    }
+  };
+}
+export {
+  resolveUserTenantId,
+  createTenantMiddleware,
+  auditChecksum,
+  DEFAULT_TENANT
+};

package/dist/entries/tracing/traceContext.js

@@ -0,0 +1,15 @@
+// @bun
+// ../../src/core/tracing/traceContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var traceContextStorage = new AsyncLocalStorage;
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+function currentTraceId() {
+  return traceContextStorage.getStore()?.traceId ?? null;
+}
+export {
+  traceContextStorage,
+  runWithTraceContext,
+  currentTraceId
+};

package/dist/entries/validation/rules.js

@@ -0,0 +1,232 @@
+// @bun
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/validation/rules.ts
+function required() {
+  return (field, value) => {
+    if (value === undefined || value === null || typeof value === "string" && value.trim() === "") {
+      return `"${field}" is required.`;
+    }
+    return;
+  };
+}
+function stringRule() {
+  return (field, value) => {
+    if (value === undefined || value === null) {
+      return;
+    }
+    if (typeof value !== "string") {
+      return `"${field}" must be a string.`;
+    }
+    return;
+  };
+}
+function minLength(minimum) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (value.trim().length < minimum) {
+      return `"${field}" must be at least ${minimum} characters.`;
+    }
+    return;
+  };
+}
+function maxLength(maximum) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (value.trim().length > maximum) {
+      return `"${field}" must be at most ${maximum} characters.`;
+    }
+    return;
+  };
+}
+function pattern(expression) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (!expression.test(value.trim())) {
+      return `"${field}" has an invalid format.`;
+    }
+    return;
+  };
+}
+function enumRule(allowedValues) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (!allowedValues.includes(value)) {
+      return `"${field}" must be one of: ${allowedValues.join(", ")}.`;
+    }
+    return;
+  };
+}
+function optional() {
+  return () => {
+    return;
+  };
+}
+function integerRule() {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed)) {
+      return `"${field}" must be an integer.`;
+    }
+    return;
+  };
+}
+function emailRule() {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    const normalized = value.trim();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
+      return `"${field}" must be a valid email address.`;
+    }
+    return;
+  };
+}
+function confirmed(fieldName) {
+  return (field, value, payload) => {
+    const confirmationKey = `${fieldName}_confirmation`;
+    const confirmation = payload[confirmationKey];
+    if (value !== confirmation) {
+      return `"${field}" confirmation does not match.`;
+    }
+    return;
+  };
+}
+function positiveIntegerRule() {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      return `"${field}" must be a positive integer.`;
+    }
+    return;
+  };
+}
+function integerRange(minimum, maximum) {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {
+      return `"${field}" must be an integer between ${minimum} and ${maximum}.`;
+    }
+    return;
+  };
+}
+function validateObject(payload, schema) {
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new ValidationError("Request body must be a JSON object.");
+  }
+  const body = payload;
+  const errors = {};
+  const output = {};
+  for (const [field, rules] of Object.entries(schema)) {
+    const messages = rules.map((rule) => rule(field, body[field], body)).filter((message) => message !== undefined);
+    if (messages.length > 0) {
+      errors[field] = messages;
+      continue;
+    }
+    if (field in body && body[field] !== undefined) {
+      const rawValue = body[field];
+      output[field] = typeof rawValue === "string" ? rawValue.trim() : rawValue;
+    }
+  }
+  if (Object.keys(errors).length > 0) {
+    throw new ValidationError("The given data was invalid.", errors);
+  }
+  return output;
+}
+export {
+  validateObject,
+  stringRule,
+  required,
+  positiveIntegerRule,
+  pattern,
+  optional,
+  minLength,
+  maxLength,
+  integerRule,
+  integerRange,
+  enumRule,
+  emailRule,
+  confirmed
+};