@hachej/boring-core 0.1.63 → 0.1.65

package/dist/{chunk-ZMS6O4CY.js → chunk-CIRY3ZLU.js}

@@ -12,7 +12,7 @@ import {
   workspaceRuntimes,
   workspaceSettings,
   workspaces
-} from "./chunk-BVZ2YT3M.js";
+} from "./chunk-EFM5IWTK.js";
 import {
   noopTelemetry,
   safeCapture
@@ -599,6 +599,30 @@ async function closeDbPoolIfPresent(app) {
 }
 function installShutdownHandlers(app) {
   let shuttingDown = false;
+  const activeRequests = /* @__PURE__ */ new Set();
+  const drainWaiters = /* @__PURE__ */ new Set();
+  const notifyRequestDrained = () => {
+    if (activeRequests.size > 0) return;
+    for (const resolve3 of drainWaiters) resolve3();
+    drainWaiters.clear();
+  };
+  app.addHook("onRequest", async (request) => {
+    activeRequests.add(request.id);
+  });
+  app.addHook("onResponse", async (request) => {
+    activeRequests.delete(request.id);
+    notifyRequestDrained();
+  });
+  app.addHook("onError", async (request) => {
+    activeRequests.delete(request.id);
+    notifyRequestDrained();
+  });
+  const waitForInflightRequests = async () => {
+    if (activeRequests.size === 0) return;
+    await new Promise((resolve3) => {
+      drainWaiters.add(resolve3);
+    });
+  };
   const onSignal = async (signal) => {
     if (shuttingDown) return;
     shuttingDown = true;
@@ -606,7 +630,7 @@ function installShutdownHandlers(app) {
     try {
       let timeoutHandle;
       const result = await Promise.race([
-        app.close(),
+        Promise.all([app.close(), waitForInflightRequests()]).then(() => "closed"),
         new Promise((resolve3) => {
           timeoutHandle = setTimeout(() => {
             resolve3("timeout");
@@ -767,6 +791,24 @@ async function createCoreApp(config, options) {
   return app;
 }
 
+// src/server/app/userSettingsLocks.ts
+var userSettingsWriteQueues = /* @__PURE__ */ new Map();
+function userSettingsWriteKey(userId, appId) {
+  return `${appId}\0${userId}`;
+}
+async function withUserSettingsWriteLock(userId, appId, fn) {
+  const key = userSettingsWriteKey(userId, appId);
+  const previous = userSettingsWriteQueues.get(key) ?? Promise.resolve();
+  const run = previous.catch(() => void 0).then(fn);
+  const settled = run.then(() => void 0, () => void 0);
+  userSettingsWriteQueues.set(key, settled);
+  try {
+    return await run;
+  } finally {
+    if (userSettingsWriteQueues.get(key) === settled) userSettingsWriteQueues.delete(key);
+  }
+}
+
 // src/server/app/routes.ts
 import fp from "fastify-plugin";
 import { z as z2 } from "zod";
@@ -904,6 +946,24 @@ async function deleteUserCompletely(userId, deps) {
 
 // src/server/app/routes.ts
 var HEALTH_DB_TIMEOUT_MS = 2e3;
+var SERVER_OWNED_USER_SETTINGS_PREFIX = "__server";
+function stripServerOwnedUserSettings(next) {
+  const sanitized = { ...next };
+  for (const key of Object.keys(sanitized)) {
+    if (key.startsWith(SERVER_OWNED_USER_SETTINGS_PREFIX)) delete sanitized[key];
+  }
+  return sanitized;
+}
+function sanitizeUserSettingsResult(result) {
+  return { ...result, settings: stripServerOwnedUserSettings(result.settings) };
+}
+function preserveServerOwnedUserSettings(next, current) {
+  const sanitized = stripServerOwnedUserSettings(next);
+  for (const [key, value] of Object.entries(current)) {
+    if (key.startsWith(SERVER_OWNED_USER_SETTINGS_PREFIX)) sanitized[key] = value;
+  }
+  return sanitized;
+}
 async function pingDatabase(sqlClient, timeoutMs) {
   const timeoutMessage = `Database ping timed out after ${timeoutMs}ms`;
   let timeoutId;
@@ -964,7 +1024,7 @@ var routesPlugin = async (app, opts) => {
   app.get("/api/v1/me", async (request) => {
     const user = request.user;
     const settings = await userStore.getUserSettings(user.id, app.config.appId);
-    return { user, settings };
+    return { user, settings: sanitizeUserSettingsResult(settings) };
   });
   app.put("/api/v1/me/settings", async (request, reply) => {
     const parsed = updateSettingsBody.safeParse(request.body);
@@ -976,13 +1036,19 @@ var routesPlugin = async (app, opts) => {
         requestId: request.id
       });
     }
-    const result = await userStore.putUserSettings(
-      request.user.id,
-      app.config.appId,
-      parsed.data
-    );
+    const userId = request.user.id;
+    const clientSettings = parsed.data.settings ? stripServerOwnedUserSettings(parsed.data.settings) : void 0;
+    const result = userStore.putClientUserSettings ? await userStore.putClientUserSettings(userId, app.config.appId, { ...parsed.data, ...clientSettings ? { settings: clientSettings } : {} }) : await withUserSettingsWriteLock(userId, app.config.appId, async () => {
+      const current = parsed.data.settings ? await userStore.getUserSettings(userId, app.config.appId) : void 0;
+      const updates = parsed.data.settings ? { ...parsed.data, settings: preserveServerOwnedUserSettings(parsed.data.settings, current?.settings ?? {}) } : parsed.data;
+      return await userStore.putUserSettings(
+        userId,
+        app.config.appId,
+        updates
+      );
+    });
     reply.status(200);
-    return result;
+    return sanitizeUserSettingsResult(result);
   });
   app.delete("/api/v1/me", async (request, reply) => {
     const parsed = deleteMeBody.safeParse(request.body);
@@ -1715,14 +1781,14 @@ function createPostSignupHook(deps) {
 import { betterAuth, APIError } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { magicLink } from "better-auth/plugins/magic-link";
-import { zxcvbn, zxcvbnOptions } from "@zxcvbn-ts/core";
+import { ZxcvbnFactory } from "@zxcvbn-ts/core";
 import * as zxcvbnCommon from "@zxcvbn-ts/language-common";
 import * as zxcvbnEn from "@zxcvbn-ts/language-en";
 var MIN_ZXCVBN_SCORE = 2;
-var zxcvbnInitialized = false;
-function ensureZxcvbn() {
-  if (zxcvbnInitialized) return;
-  zxcvbnOptions.setOptions({
+var zxcvbnInstance = null;
+function getZxcvbn() {
+  if (zxcvbnInstance) return zxcvbnInstance;
+  zxcvbnInstance = new ZxcvbnFactory({
     translations: zxcvbnEn.translations,
     graphs: zxcvbnCommon.adjacencyGraphs,
     dictionary: {
@@ -1730,11 +1796,10 @@ function ensureZxcvbn() {
       ...zxcvbnEn.dictionary
     }
   });
-  zxcvbnInitialized = true;
+  return zxcvbnInstance;
 }
 function validatePasswordStrength(password) {
-  ensureZxcvbn();
-  const result = zxcvbn(password);
+  const result = getZxcvbn().check(password);
   if (result.score < MIN_ZXCVBN_SCORE) {
     return {
       valid: false,
@@ -1748,6 +1813,29 @@ function buildMailTransport(config) {
   const env = process.env.NODE_ENV === "production" ? "production" : process.env.NODE_ENV === "test" ? "test" : "development";
   return createMailTransport(config.auth.mail.transportUrl, config.auth.mail.from, env);
 }
+async function createReplayableRequest(request) {
+  if (request.bodyUsed || request.method === "GET" || request.method === "HEAD") return request;
+  const body2 = await request.text();
+  const init = {
+    method: request.method,
+    headers: request.headers,
+    body: body2,
+    redirect: request.redirect,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy,
+    integrity: request.integrity,
+    keepalive: request.keepalive,
+    credentials: request.credentials,
+    cache: request.cache,
+    mode: request.mode
+  };
+  const replayable = new Request(request.url, init);
+  Object.defineProperty(replayable, "clone", {
+    configurable: true,
+    value: () => new Request(request.url, init)
+  });
+  return replayable;
+}
 function createAuth(config, db, opts) {
   const transport = buildMailTransport(config);
   const telemetry = opts?.telemetry ?? noopTelemetry;
@@ -1806,7 +1894,7 @@ function createAuth(config, db, opts) {
       }
     } : {}
   };
-  return betterAuth({
+  const auth = betterAuth({
     database: drizzleAdapter(db, { provider: "pg", schema: schema_exports }),
     secret: config.auth.secret,
     baseURL: config.auth.url,
@@ -1911,6 +1999,9 @@ function createAuth(config, db, opts) {
     socialProviders,
     plugins
   });
+  const handler = auth.handler.bind(auth);
+  auth.handler = async (request) => handler(await createReplayableRequest(request));
+  return auth;
 }
 
 // src/server/auth/authHook.ts
@@ -2040,6 +2131,7 @@ var updateWorkspaceBody = z3.object({
 
 // src/server/routes/workspaces.ts
 var DEFAULT_WORKSPACE_NAME = "Default workspace";
+var COMPANY_CONTEXT_WORKSPACE_MANAGED_BY = "company-context";
 var workspaceRoutesPlugin = async (app) => {
   const store = app.workspaceStore;
   const provisioner = app.provisioner;
@@ -2193,6 +2285,23 @@ var workspaceRoutesPlugin = async (app) => {
     async (request) => {
       const { id } = request.params;
       request.log.info({ workspaceId: id }, "workspace.delete.start");
+      const workspace = await store.get(id);
+      if (!workspace) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_FOUND,
+          message: "Workspace not found",
+          requestId: request.id
+        });
+      }
+      if (workspace.managedBy === COMPANY_CONTEXT_WORKSPACE_MANAGED_BY) {
+        throw new HttpError({
+          status: 403,
+          code: ERROR_CODES.FORBIDDEN,
+          message: "Managed workspace cannot be deleted",
+          requestId: request.id
+        });
+      }
       if (provisioner) {
         try {
           await provisioner.destroy(id);
@@ -2919,6 +3028,7 @@ export {
   validateConfig,
   buildRuntimeConfigPayload,
   createCoreApp,
+  withUserSettingsWriteLock,
   registerRoutes,
   MailDeliveryError,
   createMailTransport,