@hilbras/keystone 1.5.0 → 1.9.0

package/src/plugins/rateLimit.ts

@@ -1,133 +0,0 @@
-import crypto from "node:crypto";
-import fp from "fastify-plugin";
-import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
-import { redis, isRedisReady } from "../services/redis.js";
-
-interface RateLimitPluginOptions {
-  keyPrefix: string;
-  maxAttempts: number;
-  windowSeconds: number;
-}
-
-export interface GlobalRateLimitOptions {
-  maxRequests?: number;
-  windowSeconds?: number;
-  keyPrefix?: string;
-}
-
-/**
- * Atomic sliding-window rate limit script.
- *
- * Returns the number of requests already seen in the current window *before*
- * recording the current request. The request is only recorded when the count
- * is still below the limit, so blocked requests do not pollute the window.
- */
-const slidingWindowLua = `
-local key = KEYS[1]
-local windowMs = tonumber(ARGV[1])
-local now = tonumber(ARGV[2])
-local member = ARGV[3]
-local maxAttempts = tonumber(ARGV[4])
-local windowStart = now - windowMs
-
-redis.call("zremrangebyscore", key, 0, windowStart)
-local count = redis.call("zcard", key)
-if count >= maxAttempts then
-  return count
-end
-
-redis.call("zadd", key, now, member)
-redis.call("pexpire", key, windowMs)
-return count
-`;
-
-async function isAllowed(key: string, maxAttempts: number, windowSeconds: number): Promise<boolean> {
-  if (!isRedisReady()) {
-    // Fail open when Redis is not connected; the endpoint remains functional.
-    return true;
-  }
-
-  const now = Date.now();
-  const member = `${now}:${cryptoRandom()}`;
-
-  try {
-    const count = (await redis.eval(
-      slidingWindowLua,
-      1,
-      key,
-      windowSeconds * 1000,
-      now,
-      member,
-      maxAttempts
-    )) as number;
-    return count < maxAttempts;
-  } catch (err) {
-    // Fail open on transient Redis errors so a network blip cannot lock users out.
-    console.error("[rateLimit] Redis error:", err);
-    return true;
-  }
-}
-
-function cryptoRandom(): string {
-  return crypto.randomBytes(8).toString("hex");
-}
-
-function clientIdentifier(request: FastifyRequest): string {
-  return (
-    (request.headers["x-forwarded-for"] as string)?.split(",")[0]?.trim() ||
-    request.ip
-  );
-}
-
-export function rateLimit(options: RateLimitPluginOptions) {
-  return async function preHandler(request: FastifyRequest, reply: FastifyReply) {
-    const id = clientIdentifier(request);
-    const key = `${options.keyPrefix}:${id}:${(request.body as Record<string, string> | undefined)?.email ?? ""}`;
-    const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
-    if (!allowed) {
-      return reply
-        .header("Retry-After", String(options.windowSeconds))
-        .status(429)
-        .send({ error: "Too many attempts. Please try again later." });
-    }
-  };
-}
-
-export function globalRateLimit(options: GlobalRateLimitOptions = {}) {
-  const maxRequests = options.maxRequests ?? 100;
-  const windowSeconds = options.windowSeconds ?? 60;
-  const keyPrefix = options.keyPrefix ?? "global";
-
-  return async function onRequest(request: FastifyRequest, reply: FastifyReply) {
-    const id = clientIdentifier(request);
-    const key = `${keyPrefix}:${id}`;
-    const allowed = await isAllowed(key, maxRequests, windowSeconds);
-    if (!allowed) {
-      return reply
-        .header("Retry-After", String(windowSeconds))
-        .status(429)
-        .send({ error: "Rate limit exceeded. Please slow down." });
-    }
-  };
-}
-
-export function appRateLimit(options: { maxAttempts: number; windowSeconds: number }) {
-  return async function preHandler(request: FastifyRequest, reply: FastifyReply) {
-    const clientId = (request.body as Record<string, string> | undefined)?.client_id ?? "anonymous";
-    const id = clientIdentifier(request);
-    const key = `app:${clientId}:${id}`;
-    const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
-    if (!allowed) {
-      return reply
-        .header("Retry-After", String(options.windowSeconds))
-        .status(429)
-        .send({ error: "Too many attempts for this application. Please try again later." });
-    }
-  };
-}
-
-export default fp(async function rateLimitPlugin(app: FastifyInstance) {
-  app.addHook("onClose", async () => {
-    await redis.quit();
-  });
-});

package/src/plugins/requestLogger.ts

@@ -1,25 +0,0 @@
-import fp from "fastify-plugin";
-import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
-
-export default fp(async function requestLogger(app: FastifyInstance) {
-  app.addHook("onRequest", async (request: FastifyRequest, reply: FastifyReply) => {
-    (request as unknown as Record<string, unknown>)._startTime = Date.now();
-    reply.header("request-id", request.id);
-  });
-
-  app.addHook("onResponse", async (request: FastifyRequest, reply: FastifyReply) => {
-    const start = (request as unknown as Record<string, unknown>)._startTime as number | undefined;
-    const durationMs = start ? Date.now() - start : undefined;
-    request.log.info(
-      {
-        requestId: request.id,
-        method: request.method,
-        path: request.url,
-        statusCode: reply.statusCode,
-        durationMs,
-        ip: request.ip,
-      },
-      "request"
-    );
-  });
-});

package/src/plugins/tracing.ts

@@ -1,22 +0,0 @@
-import { NodeSDK } from "@opentelemetry/sdk-node";
-import { getNodeAutoInstrumentations } from "@opentelemetry/auto-instrumentations-node";
-import { config } from "../config.js";
-
-let sdk: NodeSDK | undefined;
-
-export function startTracing(): void {
-  if (sdk) return;
-  if (config.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
-    sdk = new NodeSDK({
-      instrumentations: [getNodeAutoInstrumentations()],
-    });
-    sdk.start();
-  }
-}
-
-export async function stopTracing(): Promise<void> {
-  if (sdk) {
-    await sdk.shutdown();
-    sdk = undefined;
-  }
-}

package/src/repositories/apiKey.ts

@@ -1,158 +0,0 @@
-import { eq, and } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { apiKeys, type ApiKey } from "../db/schema.js";
-
-type ApiKeyPublic = Omit<ApiKey, "keyHash">;
-
-export interface ApiKeyRepository {
-  create(input: {
-    userId?: string | null;
-    serviceAccountId?: string | null;
-    orgId?: string | null;
-    appId?: string | null;
-    name: string;
-    prefix: string;
-    keyHash: string;
-    scopes?: string[];
-    expiresAt?: Date | null;
-  }): Promise<ApiKey>;
-  listByUserId(userId: string): Promise<ApiKeyPublic[]>;
-  listByOrgId(orgId: string): Promise<ApiKeyPublic[]>;
-  listByServiceAccountId(serviceAccountId: string): Promise<ApiKeyPublic[]>;
-  revokeByKeyIdAndUserId(keyId: string, userId: string): Promise<ApiKeyPublic | undefined>;
-  revokeByKeyIdAndOrgId(keyId: string, orgId: string): Promise<ApiKeyPublic | undefined>;
-}
-
-export class DrizzleApiKeyRepository implements ApiKeyRepository {
-  async create(input: {
-    userId?: string | null;
-    serviceAccountId?: string | null;
-    orgId?: string | null;
-    appId?: string | null;
-    name: string;
-    prefix: string;
-    keyHash: string;
-    scopes?: string[];
-    expiresAt?: Date | null;
-  }): Promise<ApiKey> {
-    const [record] = await db
-      .insert(apiKeys)
-      .values({
-        userId: input.userId ?? null,
-        serviceAccountId: input.serviceAccountId ?? null,
-        orgId: input.orgId ?? null,
-        appId: input.appId ?? null,
-        name: input.name,
-        prefix: input.prefix,
-        keyHash: input.keyHash,
-        scopes: input.scopes?.length ? input.scopes : ["api:read"],
-        expiresAt: input.expiresAt ?? null,
-      })
-      .returning();
-    return record;
-  }
-
-  async listByUserId(userId: string): Promise<ApiKeyPublic[]> {
-    return db
-      .select({
-        id: apiKeys.id,
-        userId: apiKeys.userId,
-        serviceAccountId: apiKeys.serviceAccountId,
-        orgId: apiKeys.orgId,
-        appId: apiKeys.appId,
-        name: apiKeys.name,
-        prefix: apiKeys.prefix,
-        scopes: apiKeys.scopes,
-        lastUsedAt: apiKeys.lastUsedAt,
-        expiresAt: apiKeys.expiresAt,
-        revokedAt: apiKeys.revokedAt,
-        createdAt: apiKeys.createdAt,
-      })
-      .from(apiKeys)
-      .where(eq(apiKeys.userId, userId));
-  }
-
-  async listByOrgId(orgId: string): Promise<ApiKeyPublic[]> {
-    return db
-      .select({
-        id: apiKeys.id,
-        userId: apiKeys.userId,
-        serviceAccountId: apiKeys.serviceAccountId,
-        orgId: apiKeys.orgId,
-        appId: apiKeys.appId,
-        name: apiKeys.name,
-        prefix: apiKeys.prefix,
-        scopes: apiKeys.scopes,
-        lastUsedAt: apiKeys.lastUsedAt,
-        expiresAt: apiKeys.expiresAt,
-        revokedAt: apiKeys.revokedAt,
-        createdAt: apiKeys.createdAt,
-      })
-      .from(apiKeys)
-      .where(eq(apiKeys.orgId, orgId));
-  }
-
-  async listByServiceAccountId(serviceAccountId: string): Promise<ApiKeyPublic[]> {
-    return db
-      .select({
-        id: apiKeys.id,
-        userId: apiKeys.userId,
-        serviceAccountId: apiKeys.serviceAccountId,
-        orgId: apiKeys.orgId,
-        appId: apiKeys.appId,
-        name: apiKeys.name,
-        prefix: apiKeys.prefix,
-        scopes: apiKeys.scopes,
-        lastUsedAt: apiKeys.lastUsedAt,
-        expiresAt: apiKeys.expiresAt,
-        revokedAt: apiKeys.revokedAt,
-        createdAt: apiKeys.createdAt,
-      })
-      .from(apiKeys)
-      .where(eq(apiKeys.serviceAccountId, serviceAccountId));
-  }
-
-  async revokeByKeyIdAndUserId(keyId: string, userId: string): Promise<ApiKeyPublic | undefined> {
-    const [record] = await db
-      .update(apiKeys)
-      .set({ revokedAt: new Date() })
-      .where(and(eq(apiKeys.id, keyId), eq(apiKeys.userId, userId)))
-      .returning({
-        id: apiKeys.id,
-        userId: apiKeys.userId,
-        serviceAccountId: apiKeys.serviceAccountId,
-        orgId: apiKeys.orgId,
-        appId: apiKeys.appId,
-        name: apiKeys.name,
-        prefix: apiKeys.prefix,
-        scopes: apiKeys.scopes,
-        lastUsedAt: apiKeys.lastUsedAt,
-        expiresAt: apiKeys.expiresAt,
-        revokedAt: apiKeys.revokedAt,
-        createdAt: apiKeys.createdAt,
-      });
-    return record;
-  }
-
-  async revokeByKeyIdAndOrgId(keyId: string, orgId: string): Promise<ApiKeyPublic | undefined> {
-    const [record] = await db
-      .update(apiKeys)
-      .set({ revokedAt: new Date() })
-      .where(and(eq(apiKeys.id, keyId), eq(apiKeys.orgId, orgId)))
-      .returning({
-        id: apiKeys.id,
-        userId: apiKeys.userId,
-        serviceAccountId: apiKeys.serviceAccountId,
-        orgId: apiKeys.orgId,
-        appId: apiKeys.appId,
-        name: apiKeys.name,
-        prefix: apiKeys.prefix,
-        scopes: apiKeys.scopes,
-        lastUsedAt: apiKeys.lastUsedAt,
-        expiresAt: apiKeys.expiresAt,
-        revokedAt: apiKeys.revokedAt,
-        createdAt: apiKeys.createdAt,
-      });
-    return record;
-  }
-}

package/src/repositories/application.ts

@@ -1,70 +0,0 @@
-import crypto from "node:crypto";
-import { eq, and } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { applications, type Application } from "../db/schema.js";
-import { generateClientSecret, hashClientSecret } from "../services/secrets.js";
-import type {
-  ApplicationRepository,
-  CreateApplicationInput,
-  UpdateApplicationInput,
-} from "./types.js";
-
-export class DrizzleApplicationRepository implements ApplicationRepository {
-  private generateClientId(): string {
-    return `app_${crypto.randomBytes(16).toString("base64url")}`;
-  }
-
-  async create(input: CreateApplicationInput): Promise<Application & { clientSecret: string }> {
-    const clientSecret = input.clientSecret || generateClientSecret();
-    const [app] = await db
-      .insert(applications)
-      .values({
-        orgId: input.orgId,
-        clientId: input.clientId || this.generateClientId(),
-        clientSecretHash: hashClientSecret(clientSecret),
-        name: input.name,
-        redirectUris: input.redirectUris ?? [],
-        allowedOrigins: input.allowedOrigins ?? [],
-      })
-      .returning();
-    return { ...app, clientSecret };
-  }
-
-  async findByClientId(clientId: string): Promise<Application | undefined> {
-    const [app] = await db
-      .select()
-      .from(applications)
-      .where(eq(applications.clientId, clientId))
-      .limit(1);
-    return app;
-  }
-
-  async listByOrgId(orgId: string): Promise<Application[]> {
-    return db.select().from(applications).where(eq(applications.orgId, orgId));
-  }
-
-  async update(
-    appId: string,
-    orgId: string,
-    input: UpdateApplicationInput
-  ): Promise<Application | undefined> {
-    const [updated] = await db
-      .update(applications)
-      .set(input)
-      .where(and(eq(applications.id, appId), eq(applications.orgId, orgId)))
-      .returning();
-    return updated;
-  }
-
-  async verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined> {
-    const [app] = await db
-      .select()
-      .from(applications)
-      .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
-      .limit(1);
-
-    if (!app) return undefined;
-    if (app.clientSecretHash !== hashClientSecret(secret)) return undefined;
-    return app;
-  }
-}

package/src/repositories/audit.ts

@@ -1,32 +0,0 @@
-import { eq, and, desc, sql } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { auditLog } from "../db/schema.js";
-import type { AuditRepository } from "./types.js";
-
-export class DrizzleAuditRepository implements AuditRepository {
-  async list(opts: {
-    orgId?: string;
-    appId?: string;
-    userId?: string;
-    event?: string;
-    limit?: number;
-    offset?: number;
-  }): Promise<typeof auditLog.$inferSelect[]> {
-    const limit = opts.limit ?? 50;
-    const offset = opts.offset ?? 0;
-
-    const conditions = [];
-    if (opts.orgId) conditions.push(eq(auditLog.orgId, opts.orgId));
-    if (opts.appId) conditions.push(eq(auditLog.appId, opts.appId));
-    if (opts.userId) conditions.push(eq(auditLog.userId, opts.userId));
-    if (opts.event) conditions.push(eq(auditLog.event, opts.event));
-
-    return db
-      .select()
-      .from(auditLog)
-      .where(conditions.length ? and(...conditions) : sql`true`)
-      .orderBy(desc(auditLog.createdAt))
-      .limit(limit)
-      .offset(offset);
-  }
-}

package/src/repositories/index.ts

@@ -1,9 +0,0 @@
-export * from "./types.js";
-export { DrizzleUserRepository, DrizzleIdentityRepository } from "./user.js";
-export { DrizzleOrganizationRepository } from "./organization.js";
-export { DrizzleApplicationRepository } from "./application.js";
-export { DrizzleAuditRepository } from "./audit.js";
-export { DrizzlePermissionRepository } from "./permission.js";
-export { DrizzleApiKeyRepository, type ApiKeyRepository } from "./apiKey.js";
-export { DrizzleSamlConnectionRepository, type SamlConnectionRepository } from "./samlConnection.js";
-export { DrizzleOidcConnectionRepository, type OidcConnectionRepository } from "./oidcConnection.js";

package/src/repositories/oidcConnection.ts

@@ -1,111 +0,0 @@
-import { eq, and } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { oidcConnections, type OidcConnection } from "../db/schema.js";
-
-export type OidcConnectionListItem = {
-  id: string;
-  name: string;
-  issuer: string;
-  authorizationEndpoint: string;
-  tokenEndpoint: string;
-  userinfoEndpoint: string | null;
-  jwksUri: string | null;
-  clientId: string;
-  scopes: string[];
-  isActive: boolean;
-  createdAt: Date;
-};
-
-export interface OidcConnectionRepository {
-  listByOrgId(orgId: string): Promise<OidcConnectionListItem[]>;
-  findById(id: string): Promise<OidcConnection | undefined>;
-  findActiveById(id: string): Promise<OidcConnection | undefined>;
-  create(input: {
-    orgId: string;
-    name: string;
-    issuer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    userinfoEndpoint?: string;
-    jwksUri?: string;
-    clientId: string;
-    clientSecret: string;
-    scopes?: string[];
-    attributeMapping?: Record<string, unknown>;
-    isActive?: boolean;
-  }): Promise<OidcConnection>;
-  deleteByIdAndOrgId(id: string, orgId: string): Promise<OidcConnection | undefined>;
-}
-
-export class DrizzleOidcConnectionRepository implements OidcConnectionRepository {
-  async listByOrgId(orgId: string) {
-    return db
-      .select({
-        id: oidcConnections.id,
-        name: oidcConnections.name,
-        issuer: oidcConnections.issuer,
-        authorizationEndpoint: oidcConnections.authorizationEndpoint,
-        tokenEndpoint: oidcConnections.tokenEndpoint,
-        userinfoEndpoint: oidcConnections.userinfoEndpoint,
-        jwksUri: oidcConnections.jwksUri,
-        clientId: oidcConnections.clientId,
-        scopes: oidcConnections.scopes,
-        isActive: oidcConnections.isActive,
-        createdAt: oidcConnections.createdAt,
-      })
-      .from(oidcConnections)
-      .where(eq(oidcConnections.orgId, orgId));
-  }
-
-  async findById(id: string) {
-    const [connection] = await db.select().from(oidcConnections).where(eq(oidcConnections.id, id)).limit(1);
-    return connection;
-  }
-
-  async findActiveById(id: string) {
-    const [connection] = await db.select().from(oidcConnections).where(and(eq(oidcConnections.id, id), eq(oidcConnections.isActive, true))).limit(1);
-    return connection;
-  }
-
-  async create(input: {
-    orgId: string;
-    name: string;
-    issuer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    userinfoEndpoint?: string;
-    jwksUri?: string;
-    clientId: string;
-    clientSecret: string;
-    scopes?: string[];
-    attributeMapping?: Record<string, unknown>;
-    isActive?: boolean;
-  }) {
-    const [connection] = await db
-      .insert(oidcConnections)
-      .values({
-        orgId: input.orgId,
-        name: input.name,
-        issuer: input.issuer,
-        authorizationEndpoint: input.authorizationEndpoint,
-        tokenEndpoint: input.tokenEndpoint,
-        userinfoEndpoint: input.userinfoEndpoint,
-        jwksUri: input.jwksUri,
-        clientId: input.clientId,
-        clientSecret: input.clientSecret,
-        scopes: input.scopes ?? ["openid", "profile", "email"],
-        attributeMapping: input.attributeMapping ?? {},
-        isActive: input.isActive ?? true,
-      })
-      .returning();
-    return connection;
-  }
-
-  async deleteByIdAndOrgId(id: string, orgId: string) {
-    const [record] = await db
-      .delete(oidcConnections)
-      .where(and(eq(oidcConnections.id, id), eq(oidcConnections.orgId, orgId)))
-      .returning();
-    return record;
-  }
-}