@getstrata/core 0.7.3 → 0.7.5

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 0.7.5
+
+- `TENANCY_DRIVER=column`: tenant ALS without Postgres `SET LOCAL` / `set_config`. `isRlsTenancy()` is the RLS-only check.
+- `AuthUserRecord` may include `name` and optional MFA columns used by generated starters.
+
+## 0.7.4
+
+- Default database pool and query handles live on `globalThis`, so the published `@getstrata/core` bundle and `src/core` share one pool in the same process.
+
 ## 0.7.3
 
 - `JsonResource.whenLoaded` returns `null` when a relation is loaded but empty. It does not call the transform, so `new PositionResource(value).toArray()` cannot crash on a missing belongsTo.

package/README.md

@@ -23,7 +23,7 @@ import { EtaViewEngine } from "@getstrata/core/view";
 
 `.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not another template language. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
 
-**Dependency:** `eta` is a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database **engine** is your choice. HiroApp uses **Bun's built-in `Bun.sql`** (Postgres). Create and bind it with `createBunSqlPool()` / `bindBunSql()`, or call `bindDatabaseConnection()` yourself. Extra engines register with `registerNamedConnection` (`database/namedConnections`, `database/sqliteConnection`, `database/mysqlConnection`).
+**Dependency:** `eta` is a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database **engine** is your choice. Generated HiroApp uses **Bun's built-in `Bun.sql`** (Postgres): `createBunSqlPool()`, then `registerDefaultDatabasePool()` and `bindDatabaseConnection()`. `bindBunSql()` is a helper that registers both. Extra engines register with `registerNamedConnection` (`database/namedConnections`, `database/sqliteConnection`, `database/mysqlConnection`).
 
 `orderBy` accepts `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`. `{ ilike }` uses the value as-is. Pass `%term%` yourself.
 
@@ -33,7 +33,7 @@ import { EtaViewEngine } from "@getstrata/core/view";
 - `createFailedJobService`, `FailedJobService.delete()`: failed job persistence and cleanup
 - `runQueueJob`, `jobRegistry`: dispatch retried jobs from admin UIs
 
-HiroApp uses failed-job recovery in the staff dashboard. You do not have to use the admin registry.
+Core ships failed-job helpers and an optional admin resource registry. Generated HiroApp does not include an admin dashboard. You do not have to use the registry.
 
 ## Build and verify (monorepo root)
 
@@ -65,7 +65,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.7.3 && git push origin v0.7.3`
+2. Tag a release: `git tag v0.7.5 && git push origin v0.7.5`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 See [docs/PACKAGING.md](../../docs/PACKAGING.md).

package/dist/core/contracts/authUserDirectory.d.ts

@@ -1,10 +1,14 @@
 import type { AuthUser } from "../auth/authContext";
 interface AuthUserRecord {
     id: number;
+    name?: string | null;
     email?: string | null;
     role: string;
     email_verified_at?: Date | string | null;
     session_valid_after?: Date | string | null;
+    mfa_enabled?: boolean;
+    mfa_secret?: string | null;
+    mfa_recovery_codes?: string | null;
 }
 interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;

package/dist/core/tenant/tenancyConfig.d.ts

@@ -1,5 +1,7 @@
-type TenancyDriver = "rls" | "none";
+type TenancyDriver = "rls" | "column" | "none";
 declare function readTenancyDriver(env?: Record<string, string | undefined>): TenancyDriver;
 declare function isTenancyEnabled(env?: Record<string, string | undefined>): boolean;
+/** Postgres `SET LOCAL` / `set_config` for row-level security. SQLite and MySQL cannot do this. */
+declare function isRlsTenancy(env?: Record<string, string | undefined>): boolean;
 export type { TenancyDriver };
-export { isTenancyEnabled, readTenancyDriver };
+export { isRlsTenancy, isTenancyEnabled, readTenancyDriver };

package/dist/entries/audit/exportAuditLogs.js

@@ -189,7 +189,29 @@ async function safeFetch(input, init = {}, options = {}) {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await db`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();

package/dist/entries/auth/scimAuthMiddleware.js

@@ -79,11 +79,20 @@ import { repositoryConnection as db } from "@getstrata/core/database/repositoryC
 
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 
 // ../../src/core/tenant/resolveTenant.ts
 async function resolveTenant(tenantId) {
@@ -123,7 +132,7 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -189,7 +189,29 @@ async function safeFetch(input, init = {}, options = {}) {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await db`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();

package/dist/entries/tenant/databaseTenantContext.js

@@ -1,7 +1,29 @@
 // @bun
 // ../../src/core/tenant/databaseTenantContext.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await db`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();

package/dist/entries/tenant/tenancyConfig.js

@@ -1,12 +1,22 @@
 // @bun
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 export {
+  isRlsTenancy,
   isTenancyEnabled,
   readTenancyDriver
 };

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -30,11 +30,20 @@ function hasActiveDatabaseConnection() {
 
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
@@ -51,7 +60,7 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {

package/dist/framework/public-api.d.ts

@@ -126,7 +126,7 @@ export { logSecurityEvent } from "../core/security/securityEvents.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
 export { createStorageDriver, LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
 export type { TenancyDriver } from "../core/tenant/tenancyConfig.ts";
-export { isTenancyEnabled, readTenancyDriver } from "../core/tenant/tenancyConfig.ts";
+export { isRlsTenancy, isTenancyEnabled, readTenancyDriver, } from "../core/tenant/tenancyConfig.ts";
 export type { TenantContext } from "../core/tenant/tenantContext.ts";
 export { currentTenant, currentTenantId, rateLimitMultiplierForPlan, runWithTenant, } from "../core/tenant/tenantContext.ts";
 export { isInsideTenantDatabaseScope, runWithTenantDatabase, } from "../core/tenant/tenantDatabaseScope.ts";

package/dist/index.js

@@ -1008,17 +1008,25 @@ class PolicyGate {
   }
 }
 // ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
+var BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
 function bindDatabaseConnection(connection) {
-  boundConnectionHolder.connection = connection;
+  boundConnectionState().connection = connection;
 }
 function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
+  return boundConnectionState().connection;
 }
 function resetBoundDatabaseConnection() {
-  boundConnectionHolder.connection = null;
+  boundConnectionState().connection = null;
 }
 // ../../src/core/database/connectionContext.ts
 var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
@@ -1057,27 +1065,35 @@ function createDatabaseQueryProxy(pool) {
 }
 
 // ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
+var DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
+function defaultConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { pool: null, query: null };
+  globalRecord[DEFAULT_CONNECTION_KEY] = created;
+  return created;
+}
 function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
+  const holder = defaultConnectionState();
+  holder.pool = connection;
+  holder.query = createDatabaseQueryProxy(connection);
 }
 function getDefaultDatabasePool() {
-  if (!defaultPool.connection) {
+  const pool = defaultConnectionState().pool;
+  if (!pool) {
     throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return defaultPool.connection;
+  return pool;
 }
 function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
+  const query = defaultConnectionState().query;
+  if (!query) {
     throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return defaultQuery.connection;
+  return query;
 }
 
 // ../../src/core/security/timingSafeCompare.ts
@@ -1141,11 +1157,20 @@ var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
 
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 
 // ../../src/core/tenant/resolveTenant.ts
 async function resolveTenant(tenantId) {
@@ -1173,7 +1198,7 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {
@@ -8813,6 +8838,9 @@ import { createHash } from "crypto";
 
 // ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();
@@ -9545,6 +9573,7 @@ export {
   isHttpErrorLike,
   isInsideTenantDatabaseScope,
   isPublicReadsEnabled,
+  isRlsTenancy,
   isTenancyEnabled,
   jobRegistry,
   jsonResponse2 as jsonResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",