@getstrata/core 0.4.0 → 0.5.1

package/dist/entries/auth/membershipService.js

@@ -0,0 +1,477 @@
+// @bun
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/bootstrap/config.ts
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/contracts.ts
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
+  }
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
+  }
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
+  }
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
+    }
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
+    }
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
+    }
+    throw new Error(`Service "${key}" is not registered.`);
+  }
+  resolve(key) {
+    return this.get(key);
+  }
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  }
+}
+
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
+  }
+  get(key) {
+    return this.values.get(key);
+  }
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
+    }
+    return this.values.get(key);
+  }
+  has(key) {
+    return this.values.has(key);
+  }
+}
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
+}
+function resolveService(dependencies, token) {
+  return dependencies.container.resolve(token);
+}
+
+// ../../src/bootstrap/applicationRegistry.ts
+var activeContext;
+function requireActiveApplicationContext() {
+  if (!activeContext) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return activeContext;
+}
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
+}
+function resolveApplicationLogger() {
+  return appLogger;
+}
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var authContext = new AsyncLocalStorage;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = new AsyncLocalStorage3;
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
+  }
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
+}
+function currentOrgRole(organizationId) {
+  return membershipContext.getStore()?.rolesByOrganizationId.get(organizationId) ?? null;
+}
+function hasOrgMembership(organizationId) {
+  return currentOrgRole(organizationId) !== null;
+}
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
+}
+function hasMinimumOrgRole2(organizationId, minimum) {
+  const role = currentOrgRole(organizationId);
+  if (!role) {
+    return false;
+  }
+  const ranks = {
+    member: 1,
+    admin: 2,
+    owner: 3
+  };
+  return ranks[role] >= ranks[minimum];
+}
+
+// ../../src/core/auth/membershipService.ts
+class MembershipService {
+  constructor() {}
+  async listOrganizationIdsForUser(userId) {
+    const memberships = await membershipRepository.listForUser(userId);
+    return memberships.map((membership) => membership.organization_id);
+  }
+  async getOrgRole(userId, organizationId) {
+    const membership = await membershipRepository.findMembership(userId, organizationId);
+    return membership?.role ?? null;
+  }
+  async requireOrgAccess(organizationId, minimumRole = "member", user = currentAuthUser()) {
+    if (!user) {
+      throw new ForbiddenError("Authentication required.");
+    }
+    if (isGlobalAdmin(user)) {
+      return "owner";
+    }
+    const role = await this.getOrgRole(resolveUserId(user), organizationId);
+    if (!role || !hasMinimumOrgRole(role, minimumRole)) {
+      throw new ForbiddenError("Organization membership required.");
+    }
+    return role;
+  }
+  async filterAccessibleOrganizationIds(organizationIds, user = currentAuthUser()) {
+    if (!user) {
+      return [];
+    }
+    if (isGlobalAdmin(user)) {
+      return organizationIds;
+    }
+    const allowed = new Set(await this.listOrganizationIdsForUser(resolveUserId(user)));
+    return organizationIds.filter((organizationId) => allowed.has(organizationId));
+  }
+  async addOwnerOnOrganizationCreate(organizationId, userId) {
+    await membershipRepository.addMember({
+      organizationId,
+      userId,
+      role: "owner"
+    });
+  }
+  listMembersForOrganization(organizationId) {
+    return membershipRepository.listForOrganization(organizationId);
+  }
+  addMember(input) {
+    return membershipRepository.addMember(input);
+  }
+  removeMember(organizationId, userId) {
+    return membershipRepository.removeMember(organizationId, userId);
+  }
+}
+function resolveMembershipService() {
+  const dependencies = resolveApplicationDependencies();
+  if (dependencies.container.has("core.membership")) {
+    return dependencies.container.resolve("core.membership");
+  }
+  return new MembershipService;
+}
+export {
+  resolveMembershipService
+};

package/dist/entries/auth/oauth/oidcProvider.js

@@ -0,0 +1,49 @@
+// @bun
+// ../../src/core/auth/oauth/oidcProvider.ts
+class OidcProvider {
+  options;
+  name;
+  constructor(options) {
+    this.options = options;
+    this.name = options.name;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      response_type: "code",
+      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
+      state
+    });
+    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: this.options.redirectUri,
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("OIDC token exchange failed.");
+    }
+    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
+      headers: { authorization: `Bearer ${tokenBody.access_token}` }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: profile.sub,
+      email: profile.email ?? `${profile.sub}@oidc.local`,
+      name: profile.name ?? profile.sub
+    };
+  }
+}
+export {
+  OidcProvider
+};

package/dist/entries/auth/oauth/providers.js

@@ -0,0 +1,71 @@
+// @bun
+// ../../src/core/auth/oauth/providers.ts
+class GitHubOAuthProvider {
+  options;
+  name = "github";
+  constructor(options) {
+    this.options = options;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      scope: "read:user user:email",
+      state
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret,
+        code,
+        redirect_uri: this.options.redirectUri
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("GitHub OAuth token exchange failed.");
+    }
+    const profileResponse = await fetch("https://api.github.com/user", {
+      headers: {
+        authorization: `Bearer ${tokenBody.access_token}`,
+        accept: "application/json",
+        "user-agent": "workhub"
+      }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: String(profile.id),
+      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
+      name: profile.name ?? profile.login
+    };
+  }
+}
+
+class MockOAuthProvider {
+  profile;
+  name = "mock";
+  constructor(profile) {
+    this.profile = profile;
+  }
+  getAuthorizationUrl(state) {
+    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (code !== "valid-code") {
+      throw new Error("Invalid OAuth code.");
+    }
+    return this.profile;
+  }
+}
+export {
+  MockOAuthProvider,
+  GitHubOAuthProvider
+};

package/dist/entries/auth/oauth/samlProvider.js

@@ -0,0 +1,26 @@
+// @bun
+// ../../src/core/auth/oauth/samlProvider.ts
+class SamlProvider {
+  loginUrl;
+  name = "saml";
+  constructor(loginUrl) {
+    this.loginUrl = loginUrl;
+  }
+  getAuthorizationUrl(state) {
+    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (!code.startsWith("saml:")) {
+      throw new Error("Invalid SAML assertion reference.");
+    }
+    const [, email, name] = code.split(":");
+    return {
+      providerUserId: email ?? "saml-user",
+      email: email ?? "saml-user@workhub.test",
+      name: name ?? "SAML User"
+    };
+  }
+}
+export {
+  SamlProvider
+};

package/dist/entries/auth/oauth/types.js

@@ -0,0 +1 @@
+// @bun

package/dist/entries/auth/password.js

@@ -0,0 +1,15 @@
+// @bun
+// ../../src/core/auth/password.ts
+async function hashPassword(password) {
+  return await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+}
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+export {
+  verifyPassword,
+  hashPassword
+};