@getstrata/core 0.4.0 → 0.5.1

package/dist/entries/queue/types.js

@@ -0,0 +1 @@
+// @bun

package/dist/entries/security/oauthState.js

@@ -0,0 +1,75 @@
+// @bun
+// ../../src/core/security/oauthState.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+var OAUTH_STATE_COOKIE = "oauth_state";
+var OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
+function resolveOAuthStateSecret() {
+  return process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-oauth-state-secret";
+}
+function signOAuthState(state, issuedAt) {
+  const payload = `${state}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveOAuthStateSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function createOAuthStateCookie() {
+  const state = randomBytes(24).toString("hex");
+  const issuedAt = Date.now();
+  const value = signOAuthState(state, issuedAt);
+  return {
+    state,
+    cookie: `${OAUTH_STATE_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`
+  };
+}
+function readOAuthStateCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === OAUTH_STATE_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function verifyOAuthState(request, returnedState) {
+  if (!returnedState || returnedState.trim().length === 0) {
+    return false;
+  }
+  const cookieValue = readOAuthStateCookie(request);
+  if (!cookieValue) {
+    return false;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return false;
+  }
+  const [cookieState, issuedAtRaw, cookieSignature] = parts;
+  if (!cookieState || !issuedAtRaw || !cookieSignature) {
+    return false;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (cookieState !== returnedState || !Number.isFinite(issuedAt)) {
+    return false;
+  }
+  if (Date.now() - issuedAt > OAUTH_STATE_TTL_MS) {
+    return false;
+  }
+  const expectedSignature = signOAuthState(cookieState, issuedAt).split(".").pop();
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+function clearOAuthStateCookie() {
+  return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+export {
+  verifyOAuthState,
+  createOAuthStateCookie,
+  clearOAuthStateCookie,
+  OAUTH_STATE_COOKIE
+};

package/dist/entries/security/publicReads.js

@@ -0,0 +1,33 @@
+// @bun
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+function guestCanViewResource() {
+  return isPublicReadsEnabled();
+}
+export {
+  isPublicReadsEnabled,
+  guestCanViewResource
+};

package/dist/entries/security/safeUrl.js

@@ -0,0 +1,143 @@
+// @bun
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/security/safeUrl.ts
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+export {
+  isBlockedHostname,
+  assertSafeOutboundUrl
+};

package/dist/entries/security/securityEvents.js

@@ -0,0 +1,41 @@
+// @bun
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var authContext = new AsyncLocalStorage;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage2;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+export {
+  logSecurityEvent
+};

package/dist/entries/security/stripeWebhook.js

@@ -0,0 +1,115 @@
+// @bun
+// ../../src/core/security/stripeWebhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/security/stripeWebhook.ts
+function verifyStripeWebhookSignature(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
+  if (!signatureHeader?.trim()) {
+    throw new UnauthorizedError("Missing Stripe signature.");
+  }
+  const entries = signatureHeader.split(",").map((part) => part.trim());
+  let timestamp = null;
+  const signatures = [];
+  for (const entry of entries) {
+    const [key, value] = entry.split("=");
+    if (key === "t" && value) {
+      timestamp = value;
+    }
+    if (key === "v1" && value) {
+      signatures.push(value);
+    }
+  }
+  if (!timestamp || signatures.length === 0) {
+    throw new UnauthorizedError("Invalid Stripe signature header.");
+  }
+  const timestampNumber = Number.parseInt(timestamp, 10);
+  if (!Number.isFinite(timestampNumber)) {
+    throw new UnauthorizedError("Invalid Stripe signature timestamp.");
+  }
+  const ageSeconds = Math.floor(Date.now() / 1000) - timestampNumber;
+  if (ageSeconds > toleranceSeconds) {
+    throw new UnauthorizedError("Stripe signature timestamp is too old.");
+  }
+  const payload = `${timestamp}.${rawBody}`;
+  const expected = createHmac("sha256", secret).update(payload, "utf8").digest("hex");
+  const expectedBuffer = Buffer.from(expected);
+  const matched = signatures.some((signature) => {
+    const actualBuffer = Buffer.from(signature);
+    if (actualBuffer.length !== expectedBuffer.length) {
+      return false;
+    }
+    return timingSafeEqual(actualBuffer, expectedBuffer);
+  });
+  if (!matched) {
+    throw new UnauthorizedError("Invalid Stripe webhook signature.");
+  }
+}
+export {
+  verifyStripeWebhookSignature
+};

package/dist/entries/security/tokenExpiry.js

@@ -0,0 +1,16 @@
+// @bun
+// ../../src/core/security/tokenExpiry.ts
+function resolveDefaultTokenExpiryDays() {
+  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
+  if (!raw) {
+    return null;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return null;
+  }
+  return parsed;
+}
+export {
+  resolveDefaultTokenExpiryDays
+};

package/dist/entries/security/totp.js

@@ -0,0 +1,51 @@
+// @bun
+// ../../src/core/security/totp.ts
+import { createHmac } from "crypto";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
+    }
+    bits += value.toString(2).padStart(5, "0");
+  }
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  }
+  return Buffer.from(bytes);
+}
+function generateTotp(secret, counter, digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
+  }
+  const timestep = Math.floor(Date.now() / 30000);
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (generateTotp(secret, timestep + offset) === normalized) {
+      return true;
+    }
+  }
+  return false;
+}
+export {
+  verifyTotp,
+  generateTotp
+};

package/dist/entries/storage/storage.js

@@ -0,0 +1,123 @@
+// @bun
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+var {S3Client } = globalThis.Bun;
+
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
+  }
+  resolvePath(path) {
+    return join(this.rootDirectory, path.replace(/^\/+/, ""));
+  }
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
+  }
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
+  }
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  put(path, contents) {
+    return this.driver.put(path, contents);
+  }
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
+  }
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
+}
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
+}
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
+  }
+  return new LocalStorageDriver(process.env.STORAGE_PATH ?? "storage");
+}
+var defaultStorage = new StorageManager(createStorageDriver());
+function storage() {
+  return defaultStorage;
+}
+export {
+  storage,
+  resolveS3Config,
+  createStorageDriver,
+  createS3Client,
+  StorageManager,
+  S3StorageDriver,
+  LocalStorageDriver
+};

package/dist/entries/tenant/tenantContext.js

@@ -0,0 +1,30 @@
+// @bun
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var tenantContext = new AsyncLocalStorage;
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+export {
+  tenantContext,
+  runWithTenant,
+  rateLimitMultiplierForPlan,
+  currentTenantId,
+  currentTenant
+};