@getstrata/core 0.5.101 → 0.7.4

package/dist/core/runtime/frontendMode.d.ts

@@ -1,6 +1,14 @@
-type FrontendMode = "api" | "server-htmx" | "spa-react";
+declare const FRONTEND_MODES: readonly ["api", "server-htmx", "spa-react", "hybrid"];
+declare const DEFAULT_SPA_PREFIX = "/app";
+type FrontendMode = (typeof FRONTEND_MODES)[number];
+declare const FRONTEND_MODE_PATTERN: RegExp;
+declare function parseFrontendMode(value: string | undefined): FrontendMode;
 declare function readFrontendMode(): FrontendMode;
+declare function isViewsMode(mode: FrontendMode): boolean;
+declare function isSpaMode(mode: FrontendMode): boolean;
 declare function isViewsEnabled(): boolean;
 declare function isSpaEnabled(): boolean;
+declare function normalizeSpaPrefix(value: string | undefined): string;
+declare function readSpaPrefix(): string;
 export type { FrontendMode };
-export { isSpaEnabled, isViewsEnabled, readFrontendMode };
+export { DEFAULT_SPA_PREFIX, FRONTEND_MODE_PATTERN, FRONTEND_MODES, isSpaEnabled, isSpaMode, isViewsEnabled, isViewsMode, normalizeSpaPrefix, parseFrontendMode, readFrontendMode, readSpaPrefix, };

package/dist/entries/auth/basicAuthGuard.js

@@ -0,0 +1,137 @@
+// @bun
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
+
+// ../../src/core/http/statelessAuth.ts
+function authorizationScheme(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  const scheme = header.split(/\s+/, 1)[0];
+  return scheme ? scheme.toLowerCase() : "";
+}
+function requestUsesHeaderCredentials(request) {
+  const scheme = authorizationScheme(request);
+  return scheme === "bearer" || scheme === "basic";
+}
+function readBearerToken(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  const token = header.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function readBasicCredentials(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("basic ")) {
+    return null;
+  }
+  const encoded = header.slice("Basic ".length).trim();
+  if (!encoded) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) {
+      return null;
+    }
+    return {
+      username: decoded.slice(0, separator),
+      password: decoded.slice(separator + 1)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/core/auth/password.ts
+async function hashPassword(password) {
+  return await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+}
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+
+// ../../src/core/auth/basicAuthGuard.ts
+class BasicAuthGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const credentials = readBasicCredentials(request);
+    if (!credentials) {
+      return null;
+    }
+    const directory = resolveAuthUserDirectory(this.container);
+    if (!directory) {
+      return null;
+    }
+    if (typeof directory.verifyCredentials === "function") {
+      return await directory.verifyCredentials(credentials.username, credentials.password);
+    }
+    if (typeof directory.findByEmail !== "function") {
+      return null;
+    }
+    const record = await directory.findByEmail(credentials.username);
+    if (!record?.password) {
+      return null;
+    }
+    if (!await verifyPassword(credentials.password, record.password)) {
+      return null;
+    }
+    return {
+      id: record.id,
+      role: record.role,
+      emailVerifiedAt: record.email_verified_at ?? null
+    };
+  }
+}
+export {
+  BasicAuthGuard
+};

package/dist/entries/auth/jwt.js

@@ -0,0 +1,135 @@
+// @bun
+// ../../src/core/auth/jwt.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/jwt.ts
+function resolveJwtSecret(secret) {
+  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+}
+function jwtTtlSeconds(override) {
+  if (typeof override === "number" && Number.isInteger(override) && override > 0) {
+    return override;
+  }
+  const parsed = Number.parseInt(process.env.JWT_TTL_SECONDS ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : 3600;
+}
+function encodeJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function decodeJson(value) {
+  try {
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function signPart(headerAndPayload, secret) {
+  return createHmac("sha256", secret).update(headerAndPayload).digest("base64url");
+}
+function signaturesMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function signJwt(payload, options = {}) {
+  const now = Math.floor(Date.now() / 1000);
+  const body = {
+    ...payload,
+    iat: now,
+    exp: now + jwtTtlSeconds(options.ttlSeconds)
+  };
+  const header = encodeJson({ alg: "HS256", typ: "JWT" });
+  const data = encodeJson(body);
+  const unsigned = `${header}.${data}`;
+  const signature = signPart(unsigned, resolveJwtSecret(options.secret));
+  return `${unsigned}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [header, data, signature] = parts;
+  if (!header || !data || !signature) {
+    return null;
+  }
+  const expected = signPart(`${header}.${data}`, resolveJwtSecret(secret));
+  if (!signaturesMatch(signature, expected)) {
+    return null;
+  }
+  const parsedHeader = decodeJson(header);
+  if (parsedHeader?.alg !== "HS256") {
+    return null;
+  }
+  const payload = decodeJson(data);
+  if (!payload || payload.sub === undefined || payload.sub === null) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+    return null;
+  }
+  return payload;
+}
+export {
+  jwtTtlSeconds,
+  resolveJwtSecret,
+  signJwt,
+  verifyJwt
+};

package/dist/entries/auth/jwtGuard.js

@@ -0,0 +1,203 @@
+// @bun
+// ../../src/core/http/statelessAuth.ts
+function authorizationScheme(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  const scheme = header.split(/\s+/, 1)[0];
+  return scheme ? scheme.toLowerCase() : "";
+}
+function requestUsesHeaderCredentials(request) {
+  const scheme = authorizationScheme(request);
+  return scheme === "bearer" || scheme === "basic";
+}
+function readBearerToken(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  const token = header.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function readBasicCredentials(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("basic ")) {
+    return null;
+  }
+  const encoded = header.slice("Basic ".length).trim();
+  if (!encoded) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) {
+      return null;
+    }
+    return {
+      username: decoded.slice(0, separator),
+      password: decoded.slice(separator + 1)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/core/auth/jwt.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/jwt.ts
+function resolveJwtSecret(secret) {
+  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+}
+function jwtTtlSeconds(override) {
+  if (typeof override === "number" && Number.isInteger(override) && override > 0) {
+    return override;
+  }
+  const parsed = Number.parseInt(process.env.JWT_TTL_SECONDS ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : 3600;
+}
+function encodeJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function decodeJson(value) {
+  try {
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function signPart(headerAndPayload, secret) {
+  return createHmac("sha256", secret).update(headerAndPayload).digest("base64url");
+}
+function signaturesMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function signJwt(payload, options = {}) {
+  const now = Math.floor(Date.now() / 1000);
+  const body = {
+    ...payload,
+    iat: now,
+    exp: now + jwtTtlSeconds(options.ttlSeconds)
+  };
+  const header = encodeJson({ alg: "HS256", typ: "JWT" });
+  const data = encodeJson(body);
+  const unsigned = `${header}.${data}`;
+  const signature = signPart(unsigned, resolveJwtSecret(options.secret));
+  return `${unsigned}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [header, data, signature] = parts;
+  if (!header || !data || !signature) {
+    return null;
+  }
+  const expected = signPart(`${header}.${data}`, resolveJwtSecret(secret));
+  if (!signaturesMatch(signature, expected)) {
+    return null;
+  }
+  const parsedHeader = decodeJson(header);
+  if (parsedHeader?.alg !== "HS256") {
+    return null;
+  }
+  const payload = decodeJson(data);
+  if (!payload || payload.sub === undefined || payload.sub === null) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+    return null;
+  }
+  return payload;
+}
+
+// ../../src/core/auth/jwtGuard.ts
+function authUserFromJwt(payload) {
+  return {
+    id: payload.sub,
+    ...payload.role ? { role: String(payload.role) } : {},
+    ...Array.isArray(payload.abilities) ? { abilities: payload.abilities.map(String) } : {},
+    ...payload.emailVerifiedAt !== undefined ? { emailVerifiedAt: payload.emailVerifiedAt } : {}
+  };
+}
+
+class JwtGuard {
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  resolve(request) {
+    const token = readBearerToken(request);
+    if (token?.split(".").length !== 3) {
+      return null;
+    }
+    const payload = verifyJwt(token, this.options.secret);
+    if (!payload) {
+      return null;
+    }
+    return authUserFromJwt(payload);
+  }
+}
+export {
+  JwtGuard,
+  authUserFromJwt
+};

package/dist/entries/auth/sessionGuard.js

@@ -46,35 +46,17 @@ function resolveAuthUserDirectory(container) {
 
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
-  "organizations:read",
-  "organizations:create",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
+  "profile:read",
   "auth:tokens:read",
   "auth:tokens:write",
   "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
   "webhooks:read",
   "webhooks:write",
-  "audit:read"
+  "audit:read",
+  "audit:export"
 ];
 var PLATFORM_ADMIN_ABILITIES = ["*"];
 function resolveAbilitiesForRole(role) {

package/dist/entries/auth/tokenAbilityChecker.js

@@ -0,0 +1,24 @@
+// @bun
+// ../../src/core/auth/tokenAbilityChecker.ts
+import { ForbiddenError } from "@getstrata/core/errors/http";
+function tokenCan(user, ability) {
+  if (!user) {
+    return false;
+  }
+  const abilities = user.abilities ?? [];
+  return abilities.includes("*") || abilities.includes(ability);
+}
+function createTokenAbilityChecker() {
+  return {
+    tokenCan,
+    requireAbility(user, ability) {
+      if (!tokenCan(user, ability)) {
+        throw new ForbiddenError(`Missing ability: ${ability}`);
+      }
+    }
+  };
+}
+export {
+  createTokenAbilityChecker,
+  tokenCan
+};

package/dist/entries/cache/tags.js

@@ -6,7 +6,13 @@ var CACHE_TAGS = {
   tasks: "tasks",
   comments: "comments",
   attachments: "attachments",
-  reports: "reports"
+  reports: "reports",
+  users: "users",
+  departments: "departments",
+  positions: "positions",
+  applications: "applications",
+  careers: "careers",
+  offers: "offers"
 };
 export {
   CACHE_TAGS

package/dist/entries/database/connectionContext.js

@@ -0,0 +1 @@
+export * from "../../index.js";

package/dist/entries/database/dialect.js

@@ -0,0 +1 @@
+export * from "../../index.js";

package/dist/entries/database/factory.js

@@ -151,10 +151,11 @@ class Factory {
     return made;
   }
   async createOne(overrides = {}) {
-    const created = await this.persist(this.insertable(this.makeOne(overrides)));
-    for (const child of this.children) {
-      await child.factory.for(created, child.foreignKey).create();
-    }
+    return this.persistCreated(this.makeOne(overrides));
+  }
+  async persistCreated(record) {
+    const created = await this.persist(this.insertable(record));
+    await Promise.all(this.children.map((child) => child.factory.for(created, child.foreignKey).create()));
     for (const callback of this.afterCreatingCallbacks) {
       await callback(created);
     }