@getstrata/core 0.4.0 → 0.5.1

package/dist/entries/auth/policy.js

@@ -0,0 +1,134 @@
+// @bun
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var authContext = new AsyncLocalStorage;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/policy.ts
+class Policy {
+  constructor() {}
+  view(_user, _resource) {
+    return false;
+  }
+  create(_user) {
+    return false;
+  }
+  update(_user, _resource) {
+    return false;
+  }
+  delete(_user, _resource) {
+    return false;
+  }
+}
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
+
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
+    }
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
+    }
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
+    }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
+    }
+  }
+}
+export {
+  PolicyGate,
+  Policy
+};

package/dist/entries/auth/sessionCookie.js

@@ -0,0 +1,75 @@
+// @bun
+// ../../src/core/auth/sessionCookie.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SESSION_COOKIE = "workhub_session";
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function resolveSessionSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
+}
+function signSession(userId, issuedAt) {
+  const payload = `${userId}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCookieValue(request, cookieName) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === cookieName) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function readSessionUserId(request) {
+  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  if (!cookieValue) {
+    return null;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
+  const userId = Number.parseInt(String(userIdRaw), 10);
+  const issuedAt = Number.parseInt(String(issuedAtRaw), 10);
+  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > SESSION_TTL_SECONDS * 1000) {
+    return null;
+  }
+  const expectedSignature = signSession(userId, issuedAt).split(".").pop();
+  if (!expectedSignature || !cookieSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return userId;
+}
+function createSessionCookie(userId) {
+  const issuedAt = Date.now();
+  const value = signSession(userId, issuedAt);
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+}
+function clearSessionCookie() {
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+}
+export {
+  readSessionUserId,
+  createSessionCookie,
+  clearSessionCookie,
+  SESSION_TTL_SECONDS,
+  SESSION_COOKIE
+};

package/dist/entries/auth/tokenHash.js

@@ -0,0 +1,17 @@
+// @bun
+// ../../src/core/auth/tokenHash.ts
+import { createHash, createHmac } from "crypto";
+function resolveTokenPepper() {
+  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
+}
+function hashApiToken(token) {
+  const pepper = resolveTokenPepper();
+  if (pepper && pepper !== "workhub-dev-token-pepper") {
+    return createHmac("sha256", pepper).update(token).digest("hex");
+  }
+  return createHash("sha256").update(token).digest("hex");
+}
+export {
+  resolveTokenPepper,
+  hashApiToken
+};

package/dist/entries/cache/tags.js

@@ -0,0 +1,13 @@
+// @bun
+// ../../src/core/cache/tags.ts
+var CACHE_TAGS = {
+  organizations: "organizations",
+  projects: "projects",
+  tasks: "tasks",
+  comments: "comments",
+  attachments: "attachments",
+  reports: "reports"
+};
+export {
+  CACHE_TAGS
+};

package/dist/entries/crypto/fieldEncryption.js

@@ -0,0 +1,93 @@
+// @bun
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
+  }
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+}
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return (process.env.APP_ENV ?? "local") === "production";
+}
+function encryptField(plaintext, key) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
+  return `${ENCRYPTION_PREFIX}${payload}`;
+}
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+function hashLookupValue(normalizedValue, key) {
+  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function protectEmail(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return { storedEmail: normalized, emailLookup: normalized };
+  }
+  return {
+    storedEmail: encryptField(normalized, key),
+    emailLookup: hashLookupValue(normalized, key)
+  };
+}
+function revealEmail(storedEmail) {
+  const key = resolveEncryptionKey();
+  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
+    return storedEmail;
+  }
+  return decryptField(storedEmail, key);
+}
+function emailLookupForQuery(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return normalized;
+  }
+  return hashLookupValue(normalized, key);
+}
+export {
+  revealEmail,
+  resolveEncryptionKey,
+  protectEmail,
+  normalizeEmail,
+  isFieldEncryptionEnabled,
+  hashLookupValue,
+  encryptField,
+  emailLookupForQuery,
+  decryptField
+};

package/dist/entries/crypto/mfaSecret.js

@@ -0,0 +1,105 @@
+// @bun
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
+  }
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+}
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return (process.env.APP_ENV ?? "local") === "production";
+}
+function encryptField(plaintext, key) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
+  return `${ENCRYPTION_PREFIX}${payload}`;
+}
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+function hashLookupValue(normalizedValue, key) {
+  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function protectEmail(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return { storedEmail: normalized, emailLookup: normalized };
+  }
+  return {
+    storedEmail: encryptField(normalized, key),
+    emailLookup: hashLookupValue(normalized, key)
+  };
+}
+function revealEmail(storedEmail) {
+  const key = resolveEncryptionKey();
+  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
+    return storedEmail;
+  }
+  return decryptField(storedEmail, key);
+}
+function emailLookupForQuery(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return normalized;
+  }
+  return hashLookupValue(normalized, key);
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function protectMfaSecret(secret) {
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key) {
+    return secret;
+  }
+  return encryptField(secret, key);
+}
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
+  }
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+    return stored;
+  }
+  return decryptField(stored, key);
+}
+export {
+  revealMfaSecret,
+  protectMfaSecret
+};

package/dist/entries/database/factory.js

@@ -0,0 +1,17 @@
+// @bun
+// ../../src/core/database/factory.ts
+class Factory {
+  constructor() {}
+  definition() {
+    throw new Error("Factory definition must be implemented by subclass.");
+  }
+  make(overrides = {}) {
+    return {
+      ...this.definition(),
+      ...overrides
+    };
+  }
+}
+export {
+  Factory
+};

package/dist/entries/database/seeders.js

@@ -0,0 +1,30 @@
+// @bun
+// ../../src/core/database/seeders/runner.ts
+import { readdir } from "fs/promises";
+import { join } from "path";
+import { pathToFileURL } from "url";
+async function loadSeedersFromDirectory(directory) {
+  const entries = await readdir(directory);
+  const seederFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const loadedSeeders = await Promise.all(seederFiles.map(async (fileName) => {
+    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
+    const module = await import(moduleUrl);
+    return module.default;
+  }));
+  return loadedSeeders.filter((seeder) => seeder?.name !== undefined);
+}
+async function runSeedersFromDirectory(directory, db, options) {
+  const seeders = await loadSeedersFromDirectory(directory);
+  if (seeders.length === 0) {
+    return 0;
+  }
+  for (const seeder of seeders) {
+    options?.onSeeder?.(seeder.name);
+    await seeder.run(db);
+  }
+  return seeders.length;
+}
+export {
+  runSeedersFromDirectory,
+  loadSeedersFromDirectory
+};

package/dist/entries/database/types.js

@@ -0,0 +1 @@
+// @bun