@lastshotlabs/bunshot 0.0.21 → 0.0.27

package/dist/middleware/requireStepUp.js

@@ -0,0 +1,29 @@
+import { getMfaVerifiedAt } from "../lib/session";
+import { HttpError } from "../lib/HttpError";
+/**
+ * Middleware that requires the user to have recently completed step-up MFA.
+ *
+ * Attach to sensitive routes that require fresh MFA verification:
+ * ```
+ * router.post("/transfer", userAuth, requireStepUp(), transferHandler);
+ * ```
+ *
+ * The user completes step-up via POST /auth/step-up.
+ * After successful step-up, mfaVerifiedAt is stored in their session.
+ */
+export const requireStepUp = (opts) => async (c, next) => {
+    const sessionId = c.get("sessionId");
+    if (!sessionId) {
+        throw new HttpError(401, "Authentication required");
+    }
+    const maxAge = opts?.maxAge ?? 300;
+    const verifiedAt = await getMfaVerifiedAt(sessionId);
+    if (verifiedAt === null) {
+        throw new HttpError(403, "Step-up authentication required", "STEP_UP_REQUIRED");
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (now - verifiedAt > maxAge) {
+        throw new HttpError(403, "Step-up authentication expired", "STEP_UP_REQUIRED");
+    }
+    await next();
+};

package/dist/middleware/scimAuth.d.ts

@@ -0,0 +1,8 @@
+import type { MiddlewareHandler } from "hono";
+import type { AppEnv } from "../lib/context";
+export declare function setScimTokens(tokens: string | string[]): void;
+/**
+ * Middleware that validates SCIM bearer tokens.
+ * Tokens are checked with timingSafeEqual to prevent timing attacks.
+ */
+export declare const scimAuth: MiddlewareHandler<AppEnv>;

package/dist/middleware/scimAuth.js

@@ -0,0 +1,29 @@
+import { timingSafeEqual } from "../lib/crypto";
+import { HttpError } from "../lib/HttpError";
+let _scimTokens = [];
+export function setScimTokens(tokens) {
+    _scimTokens = Array.isArray(tokens) ? tokens : [tokens];
+}
+/**
+ * Middleware that validates SCIM bearer tokens.
+ * Tokens are checked with timingSafeEqual to prevent timing attacks.
+ */
+export const scimAuth = async (c, next) => {
+    const authHeader = c.req.header("authorization") ?? "";
+    if (!authHeader.startsWith("Bearer ")) {
+        throw new HttpError(401, "SCIM bearer token required");
+    }
+    const provided = authHeader.slice(7);
+    const valid = _scimTokens.some((token) => {
+        try {
+            return timingSafeEqual(provided, token);
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!valid) {
+        throw new HttpError(401, "Invalid SCIM token");
+    }
+    await next();
+};

package/dist/middleware/upload.d.ts

@@ -0,0 +1,5 @@
+import type { MiddlewareHandler } from "hono";
+import type { AppEnv } from "../lib/context";
+import type { UploadOpts } from "../lib/upload";
+export type UploadMiddlewareOptions = UploadOpts;
+export declare const handleUpload: (opts?: UploadMiddlewareOptions) => MiddlewareHandler<AppEnv>;

package/dist/middleware/upload.js

@@ -0,0 +1,27 @@
+import { parseUpload, getUploadConfig } from "../lib/upload";
+export const handleUpload = (opts) => {
+    return async (c, next) => {
+        const config = getUploadConfig();
+        const merged = { ...config, ...opts };
+        const maxFileSize = merged.maxFileSize ?? 10 * 1024 * 1024;
+        const maxFiles = merged.maxFiles ?? 10;
+        // Content-Length pre-check to avoid Bun killing the connection
+        const contentLength = Number(c.req.header("content-length") ?? 0);
+        if (contentLength > 0 && contentLength > maxFileSize * maxFiles) {
+            return c.json({ error: `Request body too large. Maximum is ${maxFileSize * maxFiles} bytes` }, 413);
+        }
+        let results;
+        try {
+            results = await parseUpload(c, opts);
+        }
+        catch (err) {
+            if (err?.status === 400)
+                return c.json({ error: err.message }, 400);
+            if (err?.status === 413)
+                return c.json({ error: err.message }, 413);
+            throw err;
+        }
+        c.set("uploadResults", results);
+        await next();
+    };
+};

package/dist/middleware/webhookAuth.d.ts

@@ -0,0 +1,30 @@
+import type { MiddlewareHandler, Context } from "hono";
+import type { AppEnv } from "../lib/context";
+export interface WebhookTimestampOptions {
+    /** Header name containing the Unix timestamp (seconds or ms). */
+    header: string;
+    /**
+     * Allowed age of the timestamp in milliseconds.
+     * Values below 1e10 in the header are treated as Unix seconds and auto-converted.
+     */
+    tolerance: number;
+}
+export interface WebhookAuthOptions {
+    /**
+     * Shared HMAC secret. Pass a function for dynamic resolution
+     * (e.g. per-tenant secret lookup). If the function throws, a 500 is returned.
+     */
+    secret: string | ((c: Context<AppEnv>) => string | Promise<string>);
+    /** Header that carries the signature. Default: `"x-webhook-signature"`. */
+    header?: string;
+    /** HMAC algorithm. Default: `"sha256"`. */
+    algorithm?: "sha256" | "sha512";
+    /**
+     * Strip this prefix from the signature header value before comparing.
+     * e.g. `"sha256="` for GitHub-style `X-Hub-Signature-256: sha256=<hex>`.
+     */
+    prefix?: string;
+    /** Optional replay-protection via a timestamp header. */
+    timestamp?: WebhookTimestampOptions;
+}
+export declare const webhookAuth: (options: WebhookAuthOptions) => MiddlewareHandler<AppEnv>;

package/dist/middleware/webhookAuth.js

@@ -0,0 +1,58 @@
+import { createHmac } from "crypto";
+import { timingSafeEqual } from "../lib/crypto";
+import { HttpError } from "../lib/HttpError";
+export const webhookAuth = (options) => async (c, next) => {
+    const algorithm = options.algorithm ?? "sha256";
+    const sigHeader = options.header ?? "x-webhook-signature";
+    // --- Optional timestamp replay protection ---
+    if (options.timestamp) {
+        const { header: tsHeader, tolerance } = options.timestamp;
+        const rawTs = c.req.header(tsHeader);
+        const tsNum = rawTs !== undefined ? parseInt(rawTs, 10) : NaN;
+        if (isNaN(tsNum)) {
+            throw new HttpError(401, "Unauthorized", "EXPIRED_TIMESTAMP");
+        }
+        // Auto-detect Unix seconds (< 1e10) vs milliseconds
+        const tsMs = tsNum < 1e10 ? tsNum * 1000 : tsNum;
+        if (Math.abs(Date.now() - tsMs) > tolerance) {
+            throw new HttpError(401, "Unauthorized", "EXPIRED_TIMESTAMP");
+        }
+    }
+    // --- Signature header ---
+    const rawSig = c.req.header(sigHeader);
+    if (!rawSig) {
+        throw new HttpError(401, "Unauthorized", "INVALID_SIGNATURE");
+    }
+    const provided = options.prefix && rawSig.startsWith(options.prefix)
+        ? rawSig.slice(options.prefix.length)
+        : rawSig;
+    // --- Secret resolution ---
+    let secret;
+    if (typeof options.secret === "function") {
+        try {
+            secret = await options.secret(c);
+        }
+        catch {
+            throw new HttpError(500, "Internal Server Error", "WEBHOOK_SECRET_ERROR");
+        }
+    }
+    else {
+        secret = options.secret;
+    }
+    // --- Body reading (Hono caches this — downstream c.req.json() still works) ---
+    const body = await c.req.text();
+    // --- HMAC computation & comparison ---
+    const computed = createHmac(algorithm, secret).update(body).digest("hex");
+    let valid;
+    try {
+        valid = timingSafeEqual(computed, provided);
+    }
+    catch {
+        // timingSafeEqual can throw if buffer byte lengths differ (e.g. multi-byte Unicode in sig)
+        valid = false;
+    }
+    if (!valid) {
+        throw new HttpError(401, "Unauthorized", "INVALID_SIGNATURE");
+    }
+    await next();
+};

package/dist/models/AuditLog.d.ts

@@ -0,0 +1,30 @@
+import type { Document, Model } from "mongoose";
+interface IAuditLog {
+    /** UUID assigned by the caller — stable cross-store identifier. */
+    id: string;
+    userId: string | null;
+    sessionId: string | null;
+    tenantId: string | null;
+    method: string;
+    path: string;
+    status: number;
+    ip: string | null;
+    userAgent: string | null;
+    action?: string;
+    resource?: string;
+    resourceId?: string;
+    meta?: Record<string, unknown>;
+    createdAt: Date;
+    /**
+     * Optional TTL field. MongoDB will automatically delete the document
+     * once this date is in the past (via `expireAfterSeconds: 0` index).
+     */
+    expiresAt?: Date;
+}
+type AuditLogDocument = IAuditLog & Document;
+export declare const AuditLog: Model<AuditLogDocument, {}, {}, {}, Document<unknown, {}, AuditLogDocument, {}, import("mongoose").DefaultSchemaOptions> & IAuditLog & Document<import("mongoose").Types.ObjectId, any, any, Record<string, any>, {}> & Required<{
+    _id: import("mongoose").Types.ObjectId;
+}> & {
+    __v: number;
+}, any, AuditLogDocument>;
+export {};

package/dist/models/AuditLog.js

@@ -0,0 +1,39 @@
+import { authConnection, mongoose } from "../lib/mongo";
+let _AuditLog = null;
+function getAuditLogModel() {
+    if (!_AuditLog) {
+        const { Schema } = mongoose;
+        const schema = new Schema({
+            id: { type: String, required: true, unique: true },
+            userId: { type: String, default: null },
+            sessionId: { type: String, default: null },
+            tenantId: { type: String, default: null },
+            method: { type: String, required: true },
+            path: { type: String, required: true },
+            status: { type: Number, required: true },
+            ip: { type: String, default: null },
+            userAgent: { type: String, default: null },
+            action: { type: String },
+            resource: { type: String },
+            resourceId: { type: String },
+            meta: { type: Schema.Types.Mixed },
+            expiresAt: { type: Date, index: { expireAfterSeconds: 0 } },
+        }, {
+            collection: "audit_logs",
+            // Mongoose manages createdAt; no updatedAt needed for immutable log entries.
+            timestamps: { createdAt: "createdAt", updatedAt: false },
+        });
+        schema.index({ userId: 1, createdAt: 1 });
+        schema.index({ tenantId: 1, createdAt: 1 });
+        schema.index({ path: 1 });
+        _AuditLog = authConnection.model("AuditLog", schema);
+    }
+    return _AuditLog;
+}
+export const AuditLog = new Proxy({}, {
+    get(_, prop) {
+        const model = getAuditLogModel();
+        const val = model[prop];
+        return typeof val === "function" ? val.bind(model) : val;
+    },
+});

package/dist/models/AuthUser.d.ts

@@ -25,6 +25,13 @@ interface IAuthUser {
         name?: string;
         createdAt: Date;
     }>;
+    displayName?: string;
+    firstName?: string;
+    lastName?: string;
+    externalId?: string;
+    suspended: boolean;
+    suspendedAt?: Date;
+    suspendedReason?: string;
 }
 type AuthUserDocument = IAuthUser & Document;
 export declare const AuthUser: Model<AuthUserDocument, {}, {}, {}, Document<unknown, {}, AuthUserDocument, {}, import("mongoose").DefaultSchemaOptions> & IAuthUser & Document<import("mongoose").Types.ObjectId, any, any, Record<string, any>, {}> & Required<{

package/dist/models/AuthUser.js

@@ -31,6 +31,13 @@ function getAuthUser() {
                     name: { type: String },
                     createdAt: { type: Date, default: Date.now },
                 }],
+            displayName: { type: String, default: null },
+            firstName: { type: String, default: null },
+            lastName: { type: String, default: null },
+            externalId: { type: String, default: null, index: true, sparse: true },
+            suspended: { type: Boolean, default: false },
+            suspendedAt: { type: Date, default: null },
+            suspendedReason: { type: String, default: null },
         }, { timestamps: true });
         schema.index({ providerIds: 1 });
         _AuthUser = authConnection.model("AuthUser", schema);

package/dist/models/Group.d.ts

@@ -0,0 +1,21 @@
+import type { Document, Model } from "mongoose";
+interface IGroup {
+    name: string;
+    displayName?: string;
+    description?: string;
+    roles: string[];
+    /**
+     * null = app-wide group, string = tenant-scoped group.
+     * Immutable after creation — adapters must reject updates that include tenantId.
+     */
+    tenantId: string | null;
+}
+type GroupDocument = IGroup & Document;
+export declare const Group: Model<GroupDocument, {}, {}, {}, Document<unknown, {}, GroupDocument, {}, import("mongoose").DefaultSchemaOptions> & IGroup & Document<import("mongoose").Types.ObjectId, any, any, Record<string, any>, {}> & Required<{
+    _id: import("mongoose").Types.ObjectId;
+}> & {
+    __v: number;
+} & {
+    id: string;
+}, any, GroupDocument>;
+export {};

package/dist/models/Group.js

@@ -0,0 +1,28 @@
+import { authConnection, mongoose } from "../lib/mongo";
+let _Group = null;
+function getGroup() {
+    if (!_Group) {
+        const { Schema } = mongoose;
+        const schema = new Schema({
+            name: { type: String, required: true },
+            displayName: { type: String },
+            description: { type: String },
+            roles: [{ type: String }],
+            tenantId: { type: String, default: null },
+        }, { timestamps: true });
+        // Name is unique within scope (app-wide or per-tenant).
+        // MongoDB treats null as a value, so this compound index correctly enforces uniqueness
+        // for app-wide groups (both have tenantId: null) and per-tenant groups separately.
+        schema.index({ name: 1, tenantId: 1 }, { unique: true });
+        schema.index({ tenantId: 1 });
+        _Group = authConnection.model("Group", schema);
+    }
+    return _Group;
+}
+export const Group = new Proxy({}, {
+    get(_, prop) {
+        const model = getGroup();
+        const val = model[prop];
+        return typeof val === "function" ? val.bind(model) : val;
+    },
+});

package/dist/models/GroupMembership.d.ts

@@ -0,0 +1,21 @@
+import type { Document, Model } from "mongoose";
+interface IGroupMembership {
+    userId: string;
+    groupId: string;
+    /** Per-member extra roles on top of the group's baseline roles. */
+    roles: string[];
+    /**
+     * Denormalized from the group at insert time for efficient tenant-scoped queries.
+     * Immutable: group.tenantId cannot change after creation, so this is always consistent.
+     */
+    tenantId: string | null;
+}
+type GroupMembershipDocument = IGroupMembership & Document;
+export declare const GroupMembership: Model<GroupMembershipDocument, {}, {}, {}, Document<unknown, {}, GroupMembershipDocument, {}, import("mongoose").DefaultSchemaOptions> & IGroupMembership & Document<import("mongoose").Types.ObjectId, any, any, Record<string, any>, {}> & Required<{
+    _id: import("mongoose").Types.ObjectId;
+}> & {
+    __v: number;
+} & {
+    id: string;
+}, any, GroupMembershipDocument>;
+export {};

package/dist/models/GroupMembership.js

@@ -0,0 +1,25 @@
+import { authConnection, mongoose } from "../lib/mongo";
+let _GroupMembership = null;
+function getGroupMembership() {
+    if (!_GroupMembership) {
+        const { Schema } = mongoose;
+        const schema = new Schema({
+            userId: { type: String, required: true },
+            groupId: { type: String, required: true },
+            roles: [{ type: String }],
+            tenantId: { type: String, default: null },
+        }, { timestamps: { createdAt: true, updatedAt: false } });
+        schema.index({ userId: 1, groupId: 1 }, { unique: true });
+        schema.index({ groupId: 1 });
+        schema.index({ userId: 1, tenantId: 1 });
+        _GroupMembership = authConnection.model("GroupMembership", schema);
+    }
+    return _GroupMembership;
+}
+export const GroupMembership = new Proxy({}, {
+    get(_, prop) {
+        const model = getGroupMembership();
+        const val = model[prop];
+        return typeof val === "function" ? val.bind(model) : val;
+    },
+});

package/dist/models/M2MClient.d.ts

@@ -0,0 +1,18 @@
+import mongoose from "mongoose";
+export interface IM2MClient {
+    _id: string;
+    clientId: string;
+    clientSecretHash: string;
+    name: string;
+    scopes: string[];
+    active: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare const M2MClient: mongoose.Model<IM2MClient, {}, {}, {}, mongoose.Document<unknown, {}, IM2MClient, {}, mongoose.DefaultSchemaOptions> & IM2MClient & Required<{
+    _id: string;
+}> & {
+    __v: number;
+} & {
+    id: string;
+}, any, IM2MClient>;

package/dist/models/M2MClient.js

@@ -0,0 +1,18 @@
+import mongoose from "mongoose";
+const m2mClientSchema = new mongoose.Schema({
+    clientId: { type: String, required: true, unique: true },
+    clientSecretHash: { type: String, required: true },
+    name: { type: String, required: true },
+    scopes: { type: [String], default: [] },
+    active: { type: Boolean, default: true },
+}, { timestamps: true });
+// Lazy proxy pattern (same as AuthUser.ts)
+export const M2MClient = new Proxy({}, {
+    get(_, prop) {
+        const { authConnection } = require("../lib/mongo");
+        if (!authConnection)
+            throw new Error("authConnection not initialized — call connectAuthMongo() or connectMongo() first");
+        const model = authConnection.models["M2MClient"] ?? authConnection.model("M2MClient", m2mClientSchema);
+        return model[prop];
+    },
+});

package/dist/routes/auth.d.ts

@@ -1,4 +1,4 @@
-import type { PrimaryField, EmailVerificationConfig, PasswordResetConfig, RefreshTokenConfig } from "../lib/appConfig";
+import type { PrimaryField, EmailVerificationConfig, PasswordResetConfig, RefreshTokenConfig, StepUpConfig } from "../lib/appConfig";
 import type { AuthRateLimitConfig, AccountDeletionConfig } from "../app";
 export interface AuthRouterOptions {
     primaryField: PrimaryField;
@@ -7,5 +7,6 @@ export interface AuthRouterOptions {
     rateLimit?: AuthRateLimitConfig;
     accountDeletion?: AccountDeletionConfig;
     refreshTokens?: RefreshTokenConfig;
+    stepUp?: StepUpConfig;
 }
-export declare const createAuthRouter: ({ primaryField, emailVerification, passwordReset, rateLimit, accountDeletion, refreshTokens }: AuthRouterOptions) => import("@hono/zod-openapi").OpenAPIHono<import("../lib/context").AppEnv, {}, "/">;
+export declare const createAuthRouter: ({ primaryField, emailVerification, passwordReset, rateLimit, accountDeletion, refreshTokens, stepUp }: AuthRouterOptions) => import("@hono/zod-openapi").OpenAPIHono<import("../lib/context").AppEnv, {}, "/">;