@getstrata/core 0.5.42 → 0.5.44

package/dist/entries/http/routeMiddleware.js

@@ -0,0 +1,32 @@
+// @bun
+// ../../src/core/http/middleware.ts
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
+}
+
+// ../../src/core/http/routeMiddleware.ts
+function withMiddleware(...middleware) {
+  const wrap = composeMiddleware(...middleware);
+  return (handler) => {
+    return wrap(handler);
+  };
+}
+export {
+  withMiddleware
+};

package/dist/entries/http/routeModelBinding.js

@@ -0,0 +1,141 @@
+// @bun
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
+// ../../src/core/http/validation.ts
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
+}
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/routeModelBinding.ts
+function bindRouteModel(param, resolver, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    return await handler(request, model);
+  };
+}
+export {
+  bindRouteModel
+};

package/dist/entries/http/scimThrottleMiddleware.js

@@ -0,0 +1,23 @@
+// @bun
+// ../../src/core/http/scimThrottleMiddleware.ts
+var {RedisClient } = globalThis.Bun;
+function createScimThrottleMiddleware(options) {
+  const client = options.redisUrl ? new RedisClient(options.redisUrl) : null;
+  return async (request, next) => {
+    const identity = request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+    const key = `workhub:scim-throttle:${identity}`;
+    if (client) {
+      const attempts = Number(await client.incr(key));
+      if (attempts === 1) {
+        await client.expire(key, options.decaySeconds);
+      }
+      if (attempts > options.maxAttempts) {
+        return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
+      }
+    }
+    return await next();
+  };
+}
+export {
+  createScimThrottleMiddleware
+};

package/dist/entries/http/securedRouteModelBinding.js

@@ -288,6 +288,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/core/http/validation.ts
 async function parseJsonBody(request, validator) {

package/dist/entries/http/securityHeadersMiddleware.js

@@ -0,0 +1,77 @@
+// @bun
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/contentSecurityPolicy.ts
+function strictApiContentSecurityPolicy() {
+  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
+}
+function serverHtmxContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self' https://unpkg.com",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function spaContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function resolveContentSecurityPolicy(response) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
+  }
+  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx") {
+    return serverHtmxContentSecurityPolicy();
+  }
+  if (frontendMode === "spa-react") {
+    return spaContentSecurityPolicy();
+  }
+  return strictApiContentSecurityPolicy();
+}
+
+// ../../src/core/http/securityHeadersMiddleware.ts
+function createSecurityHeadersMiddleware() {
+  return async (_request, next) => {
+    const response = await next();
+    const headers = new Headers(response.headers);
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-XSS-Protection", "0");
+    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
+    if (appConfig.env === "production") {
+      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+export {
+  createSecurityHeadersMiddleware
+};

package/dist/entries/http/throttleMiddleware.js

@@ -0,0 +1,87 @@
+// @bun
+// ../../src/core/http/throttleMiddleware.ts
+var {RedisClient } = globalThis.Bun;
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
+// ../../src/core/http/throttleMiddleware.ts
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
+  }
+  if (user) {
+    return `user:${user.id}`;
+  }
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function createThrottleMiddleware(options) {
+  const client = new RedisClient(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  return async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    const path = new URL(request.url).pathname;
+    const throttleKey = `${prefix}${identity}:${path}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (attempts > maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
+export {
+  resolveThrottleIdentity,
+  createThrottleMiddleware
+};

package/dist/entries/http/webErrorResponse.js

@@ -2153,6 +2153,45 @@ class Blueprint {
     });
   }
 }
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
 // ../../src/core/database/schema/errors.ts
 class UnsupportedSchemaFeatureError extends Error {
   constructor(feature, driver) {
@@ -2497,6 +2536,25 @@ class SchemaBuilder {
     }
   }
 }
+
+class Schema {
+  static builder(driver) {
+    return new SchemaBuilder(driver ?? resolveDatabaseDriver());
+  }
+  static async run(db, driver, callback) {
+    const schema = Schema.builder(driver);
+    await callback(schema);
+    await schema.execute(db);
+  }
+}
+function createSchemaBuilder(db, driver) {
+  const builder = Schema.builder(driver);
+  return Object.assign(builder, {
+    async commit() {
+      await builder.execute(db);
+    }
+  });
+}
 // ../../src/core/database/table.ts
 function defineTable(definition) {
   return definition;
@@ -2567,6 +2625,7 @@ var db = new Proxy(function database() {}, {
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
+var connection_default = db;
 
 // ../../src/modules/user/apiTokenTable.ts
 var apiTokenTable = defineTable({
@@ -2708,6 +2767,9 @@ function currentAuthUser() {
 
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
 function currentRequestMeta() {
   return requestMetaContext.getStore() ?? {
     ipAddress: null,
@@ -2801,6 +2863,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/domain/abilities.ts
 var MEMBER_ABILITIES = [

package/dist/entries/http/webFormRequest.js

@@ -140,6 +140,16 @@ function currentTenant() {
 function currentTenantId() {
   return currentTenant()?.id ?? 1;
 }
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
 
 // ../../src/core/http/validation.ts
 async function parseJsonBody(request, validator) {

package/dist/entries/logging/requestLoggingMiddleware.js

@@ -0,0 +1,89 @@
+// @bun
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/http/requestMetaContext.ts
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
+  };
+}
+export {
+  createRequestLoggingMiddleware
+};