@getstrata/core 1.0.9 → 1.1.1

package/dist/entries/auth/oneTimeToken.js

@@ -0,0 +1,362 @@
+// @bun
+// ../../src/core/auth/oneTimeToken.ts
+import { randomBytes } from "crypto";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+var postgresDialect = {
+  driver: "pgsql",
+  placeholder(index) {
+    return `$${index}`;
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "NOW()";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "ILIKE";
+  },
+  nullsLastSuffix() {
+    return " NULLS LAST";
+  },
+  castToText(expression) {
+    return `${expression}::text`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var mysqlDialect = {
+  driver: "mysql",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `\`${assertSafeIdentifier(identifier)}\``;
+  },
+  nowExpression() {
+    return "CURRENT_TIMESTAMP";
+  },
+  timestampValue(value) {
+    return value.toISOString().slice(0, 19).replace("T", " ");
+  },
+  returningClause() {
+    return "";
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS CHAR)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    if (updateColumns.length === 0) {
+      const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+      return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = VALUES(${quoted})`;
+    }).join(", ");
+    return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+  }
+};
+var sqliteDialect = {
+  driver: "sqlite",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS TEXT)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var dialects = {
+  pgsql: postgresDialect,
+  mysql: mysqlDialect,
+  sqlite: sqliteDialect
+};
+var dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+var dialectOverride = null;
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+
+// ../../src/core/auth/tokenHash.ts
+import { createHmac } from "crypto";
+
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/tokenHash.ts
+function resolveTokenPepper() {
+  return requireConfiguredSecret(["TOKEN_HASH_PEPPER"], "token-pepper");
+}
+function hashApiToken(token) {
+  return createHmac("sha256", resolveTokenPepper()).update(token).digest("hex");
+}
+
+// ../../src/core/auth/oneTimeToken.ts
+var AUTH_ONE_TIME_PURPOSES = {
+  passwordReset: "password_reset",
+  emailVerify: "email_verify"
+};
+function generateOneTimeToken() {
+  const plain = randomBytes(32).toString("hex");
+  return { plain, hash: hashApiToken(plain) };
+}
+function hashOneTimeToken(plain) {
+  return hashApiToken(plain.trim());
+}
+function isMissingRelation(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /no such table|does not exist|unknown table|er_no_such_table/i.test(message);
+}
+async function consumeOneTimeToken(sql, purpose, plain, now = new Date) {
+  const token = plain.trim();
+  if (!token) {
+    return null;
+  }
+  const dialect = currentSqlDialect();
+  const consumedAt = now.toISOString();
+  const hash = hashOneTimeToken(token);
+  const returning = dialect.returningClause("user_id");
+  const updated = await sql.unsafe(`UPDATE auth_one_time_tokens
+     SET consumed_at = ${dialect.placeholder(1)}
+     WHERE purpose = ${dialect.placeholder(2)}
+       AND token_hash = ${dialect.placeholder(3)}
+       AND consumed_at IS NULL
+       AND expires_at > ${dialect.placeholder(4)}${returning}`, [consumedAt, purpose, hash, consumedAt]);
+  if (returning) {
+    const userId = updated[0]?.user_id;
+    return userId == null ? null : Number(userId);
+  }
+  const header = updated[0];
+  const affected = Number(header?.affectedRows ?? header?.changes ?? 0);
+  if (affected !== 1) {
+    return null;
+  }
+  const rows = await sql.unsafe(`SELECT user_id FROM auth_one_time_tokens
+     WHERE purpose = ${dialect.placeholder(1)} AND token_hash = ${dialect.placeholder(2)}`, [purpose, hash]);
+  return rows[0] ? Number(rows[0].user_id) : null;
+}
+async function revokeUserSessions(sql, userId, options = {}) {
+  const dialect = currentSqlDialect();
+  await sql.unsafe(`UPDATE users SET session_valid_after = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)}`, [new Date().toISOString(), userId]);
+  try {
+    await sql.unsafe(`DELETE FROM sessions WHERE user_id = ${dialect.placeholder(1)}`, [userId]);
+  } catch (error) {
+    if (!isMissingRelation(error)) {
+      throw error;
+    }
+  }
+  if (options.revokeApiTokens === false) {
+    return;
+  }
+  try {
+    await sql.unsafe(`DELETE FROM api_tokens WHERE user_id = ${dialect.placeholder(1)}`, [userId]);
+  } catch (error) {
+    if (!isMissingRelation(error)) {
+      throw error;
+    }
+  }
+}
+export {
+  AUTH_ONE_TIME_PURPOSES,
+  consumeOneTimeToken,
+  generateOneTimeToken,
+  hashOneTimeToken,
+  revokeUserSessions
+};

package/dist/entries/auth/password.js

@@ -3,7 +3,7 @@
 async function hashPassword(password) {
   return await Bun.password.hash(password, {
     algorithm: "bcrypt",
-    cost: 10
+    cost: 12
   });
 }
 async function verifyPassword(password, passwordHash) {