@getstrata/core 2.2.36 → 2.2.38

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 2.2.38
+
+Qualify packed OIDC and SAML callbacks across Postgres, SQLite and MySQL. Fix explicitly non-migrating local bootstrap provisioning, dialect-safe transactional SAML replay, verified bearer ACS recipient binding, and independent SAML Response Destination validation through a maintained parser. Fix owned listener/client address mismatches with typed generated native options and optional CLI HOST, retaining default production binding. Preserve existing generated auth, production guards, compiler/runtime assertions and coverage gates; live provider and deployment qualification remain separate.
+
+## 2.2.37
+
+Fix MySQL repository entity-returning mutations with transaction-pinned readback, persisted keys/defaults, honest null and deletion outcomes, complete model event payloads and injected connection ownership. Preserve native Postgres/SQLite RETURNING and conditional affected-row metadata. Close owned generated OpenAPI and failed-job command applications on success and failure before exit; retain both command and cleanup errors. Add mandatory packaged MySQL production column-tenancy CLI and HTTP auth/SCIM acceptance with an owned DML-only account, unchanged route/spec/SDK contracts, native ORM regressions and cleanup tests. Records dogfood issues #232 and #233 without application SQL workarounds.
+
 ## 2.2.36
 
 Add a mandatory installed-package SQLite column-tenancy CLI/OpenAPI/HTTP profile, including cookie/token/JWT/Basic and repeated SCIM isolation, while preserving existing Postgres security, route inventories, compiler combinations and Docker gates. Reconcile observability/rotation trackers against shipped capabilities and remaining operational qualification.

package/dist/core/auth/saml/samlServiceProvider.d.ts

@@ -10,6 +10,27 @@ interface SamlServiceProviderOptions {
     wantAuthnResponseSigned?: boolean;
     disableRequestedAuthnContext?: boolean;
 }
+interface VerifiedSamlAssertion {
+    Assertion?: {
+        $?: {
+            ID?: string;
+        };
+        Subject?: Array<{
+            SubjectConfirmation?: Array<{
+                $?: {
+                    Method?: string;
+                };
+                SubjectConfirmationData?: Array<{
+                    $?: {
+                        Recipient?: string;
+                        NotBefore?: string;
+                        NotOnOrAfter?: string;
+                    };
+                }>;
+            }>;
+        }>;
+    };
+}
 interface NodeSamlProfile {
     ID?: string;
     nameID?: string;
@@ -17,13 +38,8 @@ interface NodeSamlProfile {
     name?: string;
     issuer?: string;
     sessionIndex?: string | string[];
-    getAssertion?: () => {
-        Assertion?: {
-            $?: {
-                ID?: string;
-            };
-        };
-    };
+    getAssertion?: () => VerifiedSamlAssertion;
+    getSamlResponseXml?: () => string;
     [key: string]: unknown;
 }
 type NodeSamlClient = {

package/dist/core/database/baseRepository.d.ts

@@ -35,6 +35,10 @@ declare class BaseRepository<TEntity extends object, PrimaryKey extends keyof TE
     constructor(table: TableDefinition<TEntity, PrimaryKey>, connection?: DatabaseConnection);
     private assertTransactionalEvent;
     private runModelMutation;
+    private mysqlMutation;
+    private mysqlRow;
+    private mysqlAffected;
+    private mysqlWriteById;
     count(options?: ExtendedQueryOptions<TEntity>): Promise<number>;
     findAll(options?: ExtendedQueryOptions<TEntity>): Promise<TEntity[]>;
     paginate(options: {

package/dist/core/database/index.d.ts

@@ -24,7 +24,7 @@ export { Blueprint, ColumnDefinition, compileBlueprint, createSchemaBuilder, For
 export { createSqliteConnection } from "./sqliteConnection.ts";
 export type { TableDefinition } from "./table.ts";
 export { defineTable } from "./table.ts";
-export { runInTransaction } from "./transaction.ts";
+export { isActiveTransactionConnection, runInTransaction } from "./transaction.ts";
 export type { DatabaseComparable, DatabaseScalar, MutationValues, QueryFilterValue, QueryJoin, QueryJoinOn, QueryOperator, QueryOptions, QueryOrder, QuerySelectItem, QueryWhere, UpdateValues, } from "./types.ts";
 export type { WhereNode } from "./whereBuilder.ts";
 export { WhereBuilder } from "./whereBuilder.ts";

package/dist/core/database/transaction.d.ts

@@ -1,7 +1,11 @@
 import { type TransactionAcquisitionMetrics } from "./acquisitionMetrics.ts";
 import type { DatabaseConnection } from "./baseRepository.ts";
 import { hasActiveTransaction, requestTransactionRollback } from "./transactionControl.ts";
+/** Recognizes the callback handle without admitting an unrelated pool. */
+declare function isActiveTransactionConnection(connection: DatabaseConnection): boolean;
 interface TransactionOptions {
+    /** Explicit root pool for injected repositories; cannot switch an active transaction's owner. */
+    connection?: DatabaseConnection;
     /** Cancel admission/pool checkout only. Does not cancel SQL or an admitted business callback. */
     acquisitionSignal?: AbortSignal;
     /** Observe native checkout only; requires a reserve-capable adapter. */
@@ -11,4 +15,4 @@ declare function runInTransaction<TValue>(operation: (connection: DatabaseConnec
 export type { TransactionAcquisitionMetrics, TransactionAcquisitionSnapshot, } from "./acquisitionMetrics.ts";
 export { createTransactionAcquisitionMetrics, renderTransactionAcquisitionMetrics, } from "./acquisitionMetrics.ts";
 export type { TransactionOptions };
-export { hasActiveTransaction, requestTransactionRollback, runInTransaction };
+export { hasActiveTransaction, isActiveTransactionConnection, requestTransactionRollback, runInTransaction, };

package/dist/entries/audit/exportAuditLogs.js

@@ -733,6 +733,17 @@ var init_repositoryConnection = __esm(() => {
 
 // ../../src/core/database/transaction.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+function scopedConnection(source) {
+  const connection = createDatabaseConnection(source);
+  transactionAliases.set(connection, source);
+  return connection;
+}
+function isActiveTransactionConnection(connection) {
+  if (!hasActiveTransaction() || !hasActiveDatabaseConnection())
+    return false;
+  const active = getActiveDatabaseConnection(connection);
+  return connection === active || transactionAliases.get(connection) === active;
+}
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -749,7 +760,7 @@ async function runInSavepoint(connection, operation) {
     return await settleTransaction(() => runWithDeferredModelEvents(async () => {
       await connection.unsafe(`SAVEPOINT ${name}`);
       try {
-        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(connection)))));
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(scopedConnection(connection)))));
         await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
         return result;
       } catch (error) {
@@ -772,9 +783,12 @@ async function runInTransaction(operation, options = {}) {
     signal?.throwIfAborted();
     return operation(connection);
   };
-  const pool = resolveRepositoryConnection();
+  const pool = options.connection ?? resolveRepositoryConnection();
   if (hasActiveDatabaseConnection()) {
-    return await runInSavepoint(getActiveDatabaseConnection(pool), admittedOperation);
+    const active = getActiveDatabaseConnection(pool);
+    if (options.connection && options.connection !== active && options.connection !== transactionRoots.get(active) && transactionAliases.get(options.connection) !== active)
+      throw new Error("Cannot switch database connections within an active transaction.");
+    return await runInSavepoint(active, admittedOperation);
   }
   if (!supportsTransactions(pool)) {
     throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
@@ -793,14 +807,15 @@ async function runInTransaction(operation, options = {}) {
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
       return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
-        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
+        transactionRoots.set(transaction, pool);
+        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(scopedConnection(transaction))))));
       }));
     } finally {
       await reserved?.release();
     }
   }));
 }
-var transactionFrame, outerFrames;
+var transactionFrame, outerFrames, transactionRoots, transactionAliases;
 var init_transaction = __esm(() => {
   init_deferredModelEvents();
   init_asyncContextStore();
@@ -812,6 +827,8 @@ var init_transaction = __esm(() => {
   init_acquisitionMetrics();
   transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
   outerFrames = new WeakMap;
+  transactionRoots = new WeakMap;
+  transactionAliases = new WeakMap;
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts

package/dist/entries/auth/basicAuthGuard.js

@@ -733,6 +733,17 @@ var init_repositoryConnection = __esm(() => {
 
 // ../../src/core/database/transaction.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+function scopedConnection(source) {
+  const connection = createDatabaseConnection(source);
+  transactionAliases.set(connection, source);
+  return connection;
+}
+function isActiveTransactionConnection(connection) {
+  if (!hasActiveTransaction() || !hasActiveDatabaseConnection())
+    return false;
+  const active = getActiveDatabaseConnection(connection);
+  return connection === active || transactionAliases.get(connection) === active;
+}
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -749,7 +760,7 @@ async function runInSavepoint(connection, operation) {
     return await settleTransaction(() => runWithDeferredModelEvents(async () => {
       await connection.unsafe(`SAVEPOINT ${name}`);
       try {
-        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(connection)))));
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(scopedConnection(connection)))));
         await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
         return result;
       } catch (error) {
@@ -772,9 +783,12 @@ async function runInTransaction(operation, options = {}) {
     signal?.throwIfAborted();
     return operation(connection);
   };
-  const pool = resolveRepositoryConnection();
+  const pool = options.connection ?? resolveRepositoryConnection();
   if (hasActiveDatabaseConnection()) {
-    return await runInSavepoint(getActiveDatabaseConnection(pool), admittedOperation);
+    const active = getActiveDatabaseConnection(pool);
+    if (options.connection && options.connection !== active && options.connection !== transactionRoots.get(active) && transactionAliases.get(options.connection) !== active)
+      throw new Error("Cannot switch database connections within an active transaction.");
+    return await runInSavepoint(active, admittedOperation);
   }
   if (!supportsTransactions(pool)) {
     throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
@@ -793,14 +807,15 @@ async function runInTransaction(operation, options = {}) {
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
       return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
-        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
+        transactionRoots.set(transaction, pool);
+        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(scopedConnection(transaction))))));
       }));
     } finally {
       await reserved?.release();
     }
   }));
 }
-var transactionFrame, outerFrames;
+var transactionFrame, outerFrames, transactionRoots, transactionAliases;
 var init_transaction = __esm(() => {
   init_deferredModelEvents();
   init_asyncContextStore();
@@ -812,6 +827,8 @@ var init_transaction = __esm(() => {
   init_acquisitionMetrics();
   transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
   outerFrames = new WeakMap;
+  transactionRoots = new WeakMap;
+  transactionAliases = new WeakMap;
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts