@getstrata/core 0.5.56 → 0.5.57

package/dist/entries/http/webErrorResponse.js

@@ -1,6 +1,6 @@
 // @bun
 // ../../src/core/http/webErrorResponse.ts
-import { HttpError as HttpError2, UnauthorizedError as UnauthorizedError2, ValidationError } from "@getstrata/core/errors/http";
+import { HttpError as HttpError2, UnauthorizedError, ValidationError } from "@getstrata/core/errors/http";
 
 // ../../src/config/frontend.ts
 function readFrontendMode() {
@@ -310,298 +310,14 @@ function isHtmxRequest(request) {
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_AUTH_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
-// ../../src/modules/user/provider.ts
-import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
-import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
-import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/modules/user/apiTokenRepository.ts
-import { BaseRepository } from "@getstrata/core/database/baseRepository";
-
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/modules/user/apiTokenTable.ts
-import { defineTable } from "@getstrata/core/database/table";
-var apiTokenTable = defineTable({
-  name: "api_token",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "user_id",
-    "name",
-    "token_hash",
-    "abilities",
-    "last_used_at",
-    "expires_at",
-    "created_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/authService.ts
-import { verifyPassword } from "@getstrata/core/auth/password";
-import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError } from "@getstrata/core/errors/http";
-import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
-import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
-import { verifyTotp } from "@getstrata/core/security/totp";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/domain/abilities.ts
-var MEMBER_ABILITIES = [
-  "organizations:read",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
-  "auth:tokens:read",
-  "auth:tokens:write"
-];
-var ADMIN_ABILITIES = [
-  ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
-  "webhooks:read",
-  "webhooks:write",
-  "audit:read"
-];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
-
-// ../../src/modules/user/notificationRepository.ts
-import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
-
-// ../../src/modules/user/notificationTable.ts
-import { defineTable as defineTable2 } from "@getstrata/core/database/table";
-var notificationTable = defineTable2({
-  name: "notification",
-  primaryKey: "id",
-  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
-  defaultOrderBy: { column: "created_at", direction: "DESC" }
-});
-
-// ../../src/modules/user/notificationService.ts
-import { NotFoundError } from "@getstrata/core/errors/http";
-
-// ../../src/modules/user/oauthIdentityRepository.ts
-import { BaseRepository as BaseRepository3 } from "@getstrata/core/database/baseRepository";
-import { defineTable as defineTable3 } from "@getstrata/core/database/table";
-var oauthIdentityTable = defineTable3({
-  name: "oauth_identity",
-  primaryKey: "id",
-  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
-});
-
-// ../../src/modules/user/repository.ts
-import {
-  emailLookupForQuery,
-  protectEmail,
-  revealEmail
-} from "@getstrata/core/crypto/fieldEncryption";
-import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
-import { BaseRepository as BaseRepository4 } from "@getstrata/core/database/baseRepository";
-import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/user/table.ts
-import { defineTable as defineTable4 } from "@getstrata/core/database/table";
-var userTable = defineTable4({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/tokenService.ts
-import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
-import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
-
-// ../../src/modules/user/provider.ts
-var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
@@ -634,6 +350,20 @@ function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
 
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
 function runWithRequestMeta(meta, callback) {
@@ -665,9 +395,10 @@ function tokensMatch(left, right) {
 }
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
   };
 }
 function resolveCsrfToken(request) {
@@ -835,7 +566,7 @@ async function resolveWebLayoutData(container, request) {
   if (!Number.isInteger(userId) || userId <= 0) {
     return { authUser: null, csrfToken, flash };
   }
-  if (!container.has(tokenServiceToken)) {
+  if (!container.has(CORE_TOKEN_SERVICE_TOKEN)) {
     return {
       authUser: {
         id: userId,
@@ -846,7 +577,7 @@ async function resolveWebLayoutData(container, request) {
       flash
     };
   }
-  const tokenService = container.resolve(tokenServiceToken);
+  const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
   try {
     const user = await tokenService.findByIdOrThrow(userId);
     return {
@@ -907,7 +638,7 @@ function webErrorResponse(error, request) {
     return null;
   }
   const mappedError = error instanceof HttpError2 ? error : mapDatabaseError(error);
-  if (mappedError instanceof UnauthorizedError2) {
+  if (mappedError instanceof UnauthorizedError) {
     const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
     return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
   }

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -1,7 +1,7 @@
 // @bun
 // ../../src/core/jobs/dispatchWebhookJob.ts
 import { createHmac } from "crypto";
-import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
 
 // ../../src/config/app.ts
 var appConfig = {
@@ -169,12 +169,118 @@ async function safeFetch(input, init = {}, options = {}) {
   }
 }
 
+// ../../src/core/tenant/resolveTenant.ts
+import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  if (!isTenancyEnabled()) {
+    return {
+      id: tenantId,
+      slug: "default",
+      plan: "free",
+      region: "eu"
+    };
+  }
+  const rows = await db`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  if (!isTenancyEnabled()) {
+    return await runWithTenant(tenant, callback);
+  }
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    return await runWithTenant(tenant, callback);
+  }
+  return await getDefaultDatabasePool().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
+}
+
 // ../../src/core/jobs/dispatchWebhookJob.ts
 class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const rows = await db`
+    const tenant = await resolveTenant(payload.tenantId) ?? {
+      id: payload.tenantId,
+      slug: "job",
+      plan: "free",
+      region: "eu"
+    };
+    const failure = await runWithTenantDatabase(tenant, async () => await this.deliver(payload));
+    if (failure) {
+      throw failure;
+    }
+  }
+  async deliver(payload) {
+    const rows = await db2`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -204,7 +310,7 @@ class DispatchWebhookJob extends Job {
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await db`
+      await db2`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -214,9 +320,9 @@ class DispatchWebhookJob extends Job {
           ${errorMessage}
         )
       `;
-      throw error instanceof Error ? error : new Error(errorMessage);
+      return error instanceof Error ? error : new Error(errorMessage);
     }
-    await db`
+    await db2`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},

package/dist/entries/logging/requestLoggingMiddleware.js

@@ -2,6 +2,21 @@
 // ../../src/core/logging/requestLoggingMiddleware.ts
 import { runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/http/clientIp.ts
+function trustForwardedFor(env = process.env) {
+  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
+}
+function readClientIp(request, env = process.env) {
+  if (!trustForwardedFor(env)) {
+    return;
+  }
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  if (forwarded) {
+    return forwarded;
+  }
+  return request.headers.get("x-real-ip")?.trim() || undefined;
+}
+
 // ../../src/core/logging/logger.ts
 class Logger {
   channel;
@@ -42,7 +57,7 @@ var appLogger = new Logger("app");
 function createRequestLoggingMiddleware() {
   return async (request, next) => {
     return await runWithRequestMeta({
-      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      ipAddress: readClientIp(request) ?? null,
       userAgent: request.headers.get("user-agent"),
       request
     }, async () => {

package/dist/entries/security/scimTenantTokens.js

@@ -1,7 +1,4 @@
 // @bun
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-
 // ../../src/core/security/timingSafeCompare.ts
 import { timingSafeEqual } from "crypto";
 function timingSafeCompareString(left, right) {
@@ -39,7 +36,7 @@ function resolveScimTenantFromToken(token) {
       return tenantId;
     }
   }
-  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? TEST_SCIM_BEARER_TOKEN;
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? "";
   if (timingSafeCompareString(token, fallbackToken)) {
     return 1;
   }

package/dist/entries/tenant/tenancyConfig.js

@@ -0,0 +1,12 @@
+// @bun
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+export {
+  isTenancyEnabled,
+  readTenancyDriver
+};

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -28,6 +28,14 @@ function hasActiveDatabaseConnection() {
   return activeConnection.getStore() !== undefined;
 }
 
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 function runWithTenant(tenant, callback) {
@@ -43,6 +51,9 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
+  if (!isTenancyEnabled()) {
+    return await runWithTenant(tenant, callback);
+  }
   if (hasActiveDatabaseConnection()) {
     const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
     await applyTenantContextToTransaction(activeConnection2, tenant.id);