@getstrata/core 0.5.52 → 0.5.53

package/README.md

@@ -49,7 +49,7 @@ bun run verify:shared-subpaths  # after build: confirm singleton shims
 
 ## Subpath imports
 
-`@getstrata/core` publishes **139+ subpaths** (for example `@getstrata/core/http/authMiddleware`,
+`@getstrata/core` publishes **143+ subpaths** (for example `@getstrata/core/http/authMiddleware`,
 `@getstrata/core/database/migrations`). Prefer subpaths over the root import in apps, bootstrap, and tests.
 
 Some subpaths **re-export the main bundle** so singleton state stays shared (database pool binding,

package/dist/entries/auth/accessControl.js

@@ -1 +1,60 @@
-export * from "../../index.js";
+// @bun
+// ../../src/core/auth/accessControl.ts
+import { ForbiddenError } from "@getstrata/core/errors/http";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+export {
+  resolveUserId,
+  requireAuthenticatedUser,
+  isGlobalAdmin,
+  hasMinimumOrgRole,
+  ROLE_RANK
+};

package/dist/entries/auth/membershipMiddleware.js

@@ -183,9 +183,27 @@ function currentAuthUser() {
 }
 
 // ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
 function isGlobalAdmin(user) {
   return user?.role === "admin";
 }
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
 function resolveUserId(user) {
   const userId = typeof user.id === "number" ? user.id : Number(user.id);
   if (!Number.isInteger(userId) || userId <= 0) {
@@ -209,6 +227,9 @@ async function runWithMembershipContext(callback) {
   };
   return await membershipContext.run(context, callback);
 }
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
+}
 
 // ../../src/core/auth/membershipContextMiddleware.ts
 function createMembershipContextMiddleware() {

package/dist/entries/auth/membershipScope.js

@@ -1 +1,336 @@
-export * from "../../index.js";
+// @bun
+// ../../src/core/auth/membershipScope.ts
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/core/auth/accessControl.ts
+import { ForbiddenError } from "@getstrata/core/errors/http";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
+  }
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
+}
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
+}
+
+// ../../src/core/auth/membershipScope.ts
+function resolveOrganizationScope() {
+  const user = currentAuthUser();
+  if (!user) {
+    return null;
+  }
+  if (isGlobalAdmin(user)) {
+    return null;
+  }
+  return currentOrganizationIds();
+}
+function scopedOrganizationIds(requestedOrganizationId) {
+  const scope = resolveOrganizationScope();
+  if (scope === null) {
+    return requestedOrganizationId === undefined ? null : [requestedOrganizationId];
+  }
+  if (requestedOrganizationId !== undefined) {
+    return scope.includes(requestedOrganizationId) ? [requestedOrganizationId] : [];
+  }
+  return scope;
+}
+function appendOrganizationScope(where, requestedOrganizationId) {
+  const organizationIds = scopedOrganizationIds(requestedOrganizationId);
+  if (organizationIds === null) {
+    return where;
+  }
+  if (organizationIds.length === 0) {
+    return {
+      ...where,
+      organization_id: [-1]
+    };
+  }
+  return {
+    ...where,
+    organization_id: organizationIds.length === 1 ? organizationIds[0] : organizationIds
+  };
+}
+function appendProjectScope(where, accessibleProjectIds, requestedProjectId) {
+  if (accessibleProjectIds === null) {
+    if (requestedProjectId === undefined) {
+      return where;
+    }
+    return {
+      ...where,
+      project_id: requestedProjectId
+    };
+  }
+  if (accessibleProjectIds.length === 0) {
+    return {
+      ...where,
+      project_id: [-1]
+    };
+  }
+  if (requestedProjectId !== undefined) {
+    return {
+      ...where,
+      project_id: accessibleProjectIds.includes(requestedProjectId) ? requestedProjectId : -1
+    };
+  }
+  return {
+    ...where,
+    project_id: accessibleProjectIds
+  };
+}
+function emptyPaginateResult(page, perPage) {
+  return {
+    data: [],
+    meta: {
+      page,
+      per_page: perPage,
+      total: 0,
+      last_page: 1
+    }
+  };
+}
+function assertResourceInCurrentTenant(resourceTenantId, resourceLabel, resourceId) {
+  if (resourceTenantId !== currentTenantId()) {
+    throw new NotFoundError(`${resourceLabel} ${resourceId} not found.`);
+  }
+}
+function assertOrganizationReadable(organizationId) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return;
+  }
+  const organizationIds = scopedOrganizationIds();
+  if (organizationIds !== null && !organizationIds.includes(organizationId)) {
+    throw new NotFoundError(`Organization ${organizationId} not found.`);
+  }
+}
+export {
+  scopedOrganizationIds,
+  resolveOrganizationScope,
+  emptyPaginateResult,
+  assertResourceInCurrentTenant,
+  assertOrganizationReadable,
+  appendProjectScope,
+  appendOrganizationScope
+};