@getstrata/core 0.5.81 → 0.5.83

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 0.5.83
+
+- `MEMBER_ABILITIES` includes `auth:tokens:delete` so Jetstream-style personal access token revoke works for members (`DELETE /auth/tokens/:id`). HTML `/account/tokens/:id/revoke` was already authenticated-only.
+- `buildOtpauthUrl()` defaults the issuer through `appDisplayName()` (`APP_NAME`).
+
+## 0.5.82
+
+- `MEMBER_ABILITIES` includes `organizations:create` so Jetstream-style extra teams work for members (HTML `POST /organizations` and JSON `POST /organizations`). `OrganizationPolicy.create` already allowed any authenticated user.
+
 ## 0.5.81
 
 - `@getstrata/core/auth/intendedUrlCookie` (`createIntendedUrlCookie`, `readIntendedUrl`, `clearIntendedUrlCookie`, `createIntendedUrlCookieFromRequest`). Fortify intended URL after HTML email verification: register with `redirect=` and Laravel `verified` HTML redirects stash `${APP_KEY_PREFIX}_intended` (`INTENDED_URL_COOKIE_NAME`, default `workhub_intended`; TTL `INTENDED_URL_TTL_SECONDS`, default 86400s). `GET /verify-email` honors and clears it.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.83 && git push origin v0.5.83`
+2. Tag a release: `git tag v0.5.84 && git push origin v0.5.84`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/auth/abilityCatalog.d.ts

@@ -1,5 +1,5 @@
-declare const MEMBER_ABILITIES: readonly ["organizations:read", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write"];
-declare const ADMIN_ABILITIES: readonly ["organizations:read", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "organizations:create", "organizations:update", "organizations:delete", "projects:update", "projects:delete", "tasks:update", "tasks:delete", "comments:update", "comments:delete", "attachments:delete", "webhooks:read", "webhooks:write", "audit:read"];
+declare const MEMBER_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete"];
+declare const ADMIN_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete", "organizations:create", "organizations:update", "organizations:delete", "projects:update", "projects:delete", "tasks:update", "tasks:delete", "comments:update", "comments:delete", "attachments:delete", "webhooks:read", "webhooks:write", "audit:read"];
 declare const PLATFORM_ADMIN_ABILITIES: readonly ["*"];
 interface AbilityCatalog {
     member: readonly string[];

package/dist/entries/auth/sessionGuard.js

@@ -47,6 +47,7 @@ function resolveAuthUserDirectory(container) {
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
+  "organizations:create",
   "projects:read",
   "projects:create",
   "tasks:read",
@@ -56,7 +57,8 @@ var MEMBER_ABILITIES = [
   "attachments:read",
   "attachments:create",
   "auth:tokens:read",
-  "auth:tokens:write"
+  "auth:tokens:write",
+  "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,

package/dist/entries/security/totp.js

@@ -1,6 +1,62 @@
 // @bun
 // ../../src/core/security/totp.ts
 import { createHmac, randomBytes } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/security/totp.ts
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -35,7 +91,7 @@ function generateTotpSecret(byteLength = 20) {
   return encodeBase32(randomBytes(byteLength));
 }
 function buildOtpauthUrl(options) {
-  const issuer = options.issuer?.trim() || process.env.APP_NAME?.trim() || "WorkHub";
+  const issuer = options.issuer?.trim() || appDisplayName();
   const label = `${issuer}:${options.account}`;
   const params = new URLSearchParams({
     secret: options.secret,

package/dist/index.js

@@ -198,6 +198,7 @@ function resolveAuthUserDirectory(container) {
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
+  "organizations:create",
   "projects:read",
   "projects:create",
   "tasks:read",
@@ -207,7 +208,8 @@ var MEMBER_ABILITIES = [
   "attachments:read",
   "attachments:create",
   "auth:tokens:read",
-  "auth:tokens:write"
+  "auth:tokens:write",
+  "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.81",
+  "version": "0.5.83",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",