@getstrata/core 0.5.70 → 0.5.72

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 0.5.72
+
+- OpenAPI treats `POST /auth/forgot-password` and `POST /auth/reset-password` as public operations (no bearer).
+
+## 0.5.71
+
+- OpenAPI treats `POST /auth/login` and `POST /auth/register` as public (no bearer), including when routes are registered under `API_PREFIX`.
+- Route summaries look up `PUBLIC_ROUTE_DESCRIPTIONS` after stripping `API_PREFIX`.
+
 ## 0.5.70
 
 - `OAuthProvider.getAuthorizationUrl` / `exchangeCode` accept an optional `redirectUri` so HTMX login can use `/oauth/:provider/callback` while the API keeps `OAUTH_REDIRECT_URI`.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.70 && git push origin v0.5.70`
+2. Tag a release: `git tag v0.5.72 && git push origin v0.5.72`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/entries/openapi/generator.js

@@ -51,6 +51,9 @@ function sdkClientClassName() {
 var PUBLIC_ROUTE_DESCRIPTIONS = {
   "GET /auth/me": "Current authenticated user",
   "POST /auth/login": "Login with email and password",
+  "POST /auth/register": "Register with name, email, and password",
+  "POST /auth/forgot-password": "Request a password reset email",
+  "POST /auth/reset-password": "Reset password with email and token",
   "GET /auth/tokens": "List API tokens",
   "POST /auth/tokens": "Create API token",
   "DELETE /auth/tokens/:id": "Revoke API token",
@@ -83,27 +86,38 @@ var PUBLIC_ROUTE_DESCRIPTIONS = {
 function toOpenApiPath(path) {
   return path.replace(/:([A-Za-z_]+)/g, "{$1}");
 }
+function toRelativeApiPath(path) {
+  const prefix = apiPrefix();
+  if (path === prefix) {
+    return "/";
+  }
+  if (path.startsWith(`${prefix}/`)) {
+    return path.slice(prefix.length);
+  }
+  return path;
+}
 function requiresBearerAuth(path, method) {
-  if (path.startsWith("/auth/login") || path.startsWith("/auth/oauth")) {
+  const relative = toRelativeApiPath(path);
+  if (relative.startsWith("/auth/login") || relative.startsWith("/auth/register") || relative.startsWith("/auth/forgot-password") || relative.startsWith("/auth/reset-password") || relative.startsWith("/auth/oauth")) {
     return false;
   }
-  if (path.startsWith("/scim/") || path.startsWith("/billing/webhooks/")) {
+  if (relative.startsWith("/scim/") || relative.startsWith("/billing/webhooks/") || path.startsWith("/scim/") || path.startsWith("/billing/webhooks/")) {
     return false;
   }
-  if (["/health", "/ready", "/metrics", "/"].includes(path)) {
+  if (["/health", "/ready", "/metrics", "/"].includes(relative) || ["/health", "/ready", "/metrics", "/"].includes(path)) {
     return false;
   }
-  if (method === "GET" && ["/organizations", "/projects", "/tasks", "/search"].some((prefix) => path.startsWith(prefix))) {
+  if (method === "GET" && ["/organizations", "/projects", "/tasks", "/search"].some((prefix) => relative.startsWith(prefix) || path.startsWith(prefix))) {
     return false;
   }
-  return path.startsWith("/auth/") || ["POST", "PATCH", "PUT", "DELETE"].includes(method);
+  return relative.startsWith("/auth/") || ["POST", "PATCH", "PUT", "DELETE"].includes(method);
 }
 function generateOpenApiSpec(routes) {
   const paths = {};
   for (const route of routes) {
     const openApiPath = toOpenApiPath(route.path);
     const method = route.method.toLowerCase();
-    const description = PUBLIC_ROUTE_DESCRIPTIONS[`${route.method} ${route.path}`] ?? `${route.method} ${route.path}`;
+    const description = PUBLIC_ROUTE_DESCRIPTIONS[`${route.method} ${toRelativeApiPath(route.path)}`] ?? PUBLIC_ROUTE_DESCRIPTIONS[`${route.method} ${route.path}`] ?? `${route.method} ${route.path}`;
     paths[openApiPath] ??= {};
     paths[openApiPath][method] = {
       summary: description,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.70",
+  "version": "0.5.72",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",