@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/packages/bunshot-auth/src/routes/groups.d.ts

@@ -0,0 +1,4 @@
+import type { AppEnv } from '../../../bunshot-core/src/index.js';
+import type { GroupsConfig } from '../types/groups';
+export type { GroupsConfig, GroupsManagementConfig } from '../types/groups';
+export declare const createGroupsRouter: (config: GroupsConfig) => import("@hono/zod-openapi").OpenAPIHono<AppEnv, {}, "/">;

package/dist/packages/bunshot-auth/src/routes/groups.js

@@ -0,0 +1,481 @@
+import { isProd } from '../lib/env';
+import { addGroupMember, createGroup, deleteGroup, getGroup, getGroupMembers, getUserGroups, listGroups, removeGroupMember, updateGroup, updateGroupMembership, } from '../lib/groups';
+import { requireRole } from '../middleware/requireRole';
+import { userAuth } from '../middleware/userAuth';
+import { ErrorResponse } from '../schemas/error';
+import { z } from 'zod';
+import { createRoute, withSecurity } from '../../../bunshot-core/src/index.js';
+import { createRouter } from '../../../bunshot-core/src/index.js';
+import { HttpError } from '../../../bunshot-core/src/index.js';
+import { getAuthRuntimeFromRequest } from '../runtime';
+// ---------------------------------------------------------------------------
+// Zod schemas
+// ---------------------------------------------------------------------------
+const SLUG_REGEX = /^[a-z0-9_-]+$/;
+const GroupBody = z.object({
+    name: z
+        .string()
+        .min(1)
+        .max(100)
+        .regex(SLUG_REGEX, 'name must be a slug: lowercase letters, digits, underscores, or hyphens'),
+    displayName: z.string().max(200).optional(),
+    description: z.string().max(1000).optional(),
+    roles: z.array(z.string()).default([]),
+    tenantId: z.string().nullable().optional().default(null),
+});
+const GroupUpdateBody = z.object({
+    name: z.string().min(1).max(100).regex(SLUG_REGEX, 'name must be a slug').optional(),
+    displayName: z.string().max(200).nullable().optional(),
+    description: z.string().max(1000).nullable().optional(),
+    roles: z.array(z.string()).optional(),
+});
+const MemberBody = z.object({
+    userId: z.string().min(1),
+    roles: z.array(z.string()).default([]),
+});
+const MemberRolesBody = z.object({
+    roles: z.array(z.string()),
+});
+const GroupResponse = z
+    .object({
+    id: z.string(),
+    name: z.string(),
+    displayName: z.string().optional(),
+    description: z.string().optional(),
+    roles: z.array(z.string()),
+    tenantId: z.string().nullable(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+})
+    .openapi('Group');
+const MemberResponse = z
+    .object({
+    userId: z.string(),
+    roles: z.array(z.string()),
+})
+    .openapi('GroupMember');
+const PaginatedGroupsResponse = z
+    .object({
+    items: z.array(GroupResponse),
+    nextCursor: z.string().optional(),
+})
+    .openapi('PaginatedGroups');
+const PaginatedMembersResponse = z
+    .object({
+    items: z.array(MemberResponse),
+    nextCursor: z.string().optional(),
+})
+    .openapi('PaginatedGroupMembers');
+const UserGroupEntry = z
+    .object({
+    group: GroupResponse,
+    membershipRoles: z.array(z.string()),
+})
+    .openapi('UserGroupEntry');
+const PaginationParams = {
+    limit: z.string().optional().openapi({ description: 'Max results (default 50, max 200)' }),
+    cursor: z
+        .string()
+        .optional()
+        .openapi({ description: 'Opaque pagination cursor from a previous response' }),
+};
+const tags = ['Groups'];
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+export const createGroupsRouter = (config) => {
+    const router = createRouter();
+    const getAdapter = (c) => {
+        return getAuthRuntimeFromRequest(c).adapter;
+    };
+    // Normalize: managementRoutes: true is equivalent to managementRoutes: {}
+    const mgmt = config.managementRoutes === true ? {} : (config.managementRoutes ?? {});
+    const guard = mgmt.middleware ?? [
+        userAuth,
+        requireRole.global(mgmt.adminRole ?? 'admin'),
+    ];
+    // Defensive guard warning
+    if (guard.length === 0 && !isProd()) {
+        console.warn('[bunshot] groups.managementRoutes: resolved auth middleware is empty — management routes are unprotected');
+    }
+    // Apply auth guard to all group management routes
+    router.use('/groups/*', ...guard);
+    router.use('/users/:userId/groups', ...guard);
+    // ---------------------------------------------------------------------------
+    // GET /groups — list groups
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/groups',
+        tags,
+        summary: 'List groups',
+        description: 'List groups. Returns tenant-scoped groups when tenantId is in context, app-wide groups otherwise.',
+        request: { query: z.object(PaginationParams) },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: PaginatedGroupsResponse } },
+                description: 'Groups list',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const tenantId = c.get('tenantId') ?? null;
+        const { limit, cursor } = c.req.valid('query');
+        const result = await listGroups(adapter, tenantId, {
+            limit: limit ? Math.min(parseInt(limit, 10), 200) : 50,
+            cursor: cursor || undefined,
+        });
+        return c.json(result, 200);
+    });
+    // ---------------------------------------------------------------------------
+    // POST /groups — create group
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'post',
+        path: '/groups',
+        tags,
+        summary: 'Create group',
+        request: {
+            body: { content: { 'application/json': { schema: GroupBody } }, required: true },
+        },
+        responses: {
+            201: {
+                content: { 'application/json': { schema: z.object({ id: z.string() }) } },
+                description: 'Group created',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            409: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Name already exists in scope',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const body = c.req.valid('json');
+        const result = await createGroup(adapter, {
+            name: body.name,
+            displayName: body.displayName,
+            description: body.description,
+            roles: body.roles,
+            tenantId: body.tenantId ?? null,
+        });
+        return c.json(result, 201);
+    });
+    // ---------------------------------------------------------------------------
+    // GET /groups/:groupId — get group
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/groups/:groupId',
+        tags,
+        summary: 'Get group',
+        request: { params: z.object({ groupId: z.string() }) },
+        responses: {
+            200: { content: { 'application/json': { schema: GroupResponse } }, description: 'Group' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId } = c.req.valid('param');
+        const group = await getGroup(adapter, groupId);
+        if (!group)
+            return c.json({ error: 'Group not found' }, 404);
+        return c.json(group, 200);
+    });
+    // ---------------------------------------------------------------------------
+    // PATCH /groups/:groupId — update group
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'patch',
+        path: '/groups/:groupId',
+        tags,
+        summary: 'Update group',
+        request: {
+            params: z.object({ groupId: z.string() }),
+            body: { content: { 'application/json': { schema: GroupUpdateBody } }, required: true },
+        },
+        responses: {
+            204: { description: 'Updated' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+            409: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Name conflict',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const group = await getGroup(adapter, groupId);
+        if (!group)
+            return c.json({ error: 'Group not found' }, 404);
+        const updates = {};
+        if (body.name !== undefined)
+            updates.name = body.name;
+        if ('displayName' in body)
+            updates.displayName = body.displayName ?? undefined;
+        if ('description' in body)
+            updates.description = body.description ?? undefined;
+        if (body.roles !== undefined)
+            updates.roles = body.roles;
+        await updateGroup(adapter, groupId, updates);
+        return c.body(null, 204);
+    });
+    // ---------------------------------------------------------------------------
+    // DELETE /groups/:groupId — delete group
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'delete',
+        path: '/groups/:groupId',
+        tags,
+        summary: 'Delete group',
+        description: 'Delete a group. All memberships are cascade-deleted.',
+        request: { params: z.object({ groupId: z.string() }) },
+        responses: {
+            204: { description: 'Deleted' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId } = c.req.valid('param');
+        const group = await getGroup(adapter, groupId);
+        if (!group)
+            return c.json({ error: 'Group not found' }, 404);
+        await deleteGroup(adapter, groupId);
+        return c.body(null, 204);
+    });
+    // ---------------------------------------------------------------------------
+    // GET /groups/:groupId/members — list members
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/groups/:groupId/members',
+        tags,
+        summary: 'List group members',
+        request: {
+            params: z.object({ groupId: z.string() }),
+            query: z.object(PaginationParams),
+        },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: PaginatedMembersResponse } },
+                description: 'Members list',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Group not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId } = c.req.valid('param');
+        const { limit, cursor } = c.req.valid('query');
+        const group = await getGroup(adapter, groupId);
+        if (!group)
+            return c.json({ error: 'Group not found' }, 404);
+        const result = await getGroupMembers(adapter, groupId, {
+            limit: limit ? Math.min(parseInt(limit, 10), 200) : 50,
+            cursor: cursor || undefined,
+        });
+        return c.json(result, 200);
+    });
+    // ---------------------------------------------------------------------------
+    // POST /groups/:groupId/members — add member
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'post',
+        path: '/groups/:groupId/members',
+        tags,
+        summary: 'Add group member',
+        request: {
+            params: z.object({ groupId: z.string() }),
+            body: { content: { 'application/json': { schema: MemberBody } }, required: true },
+        },
+        responses: {
+            201: { description: 'Member added' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Group not found',
+            },
+            409: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'User already a member',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        try {
+            await addGroupMember(adapter, groupId, body.userId, body.roles);
+        }
+        catch (err) {
+            if (err instanceof HttpError) {
+                return c.json({ error: err.message }, err.status);
+            }
+            throw err;
+        }
+        return c.body(null, 201);
+    });
+    // ---------------------------------------------------------------------------
+    // PATCH /groups/:groupId/members/:userId — update member roles
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'patch',
+        path: '/groups/:groupId/members/:userId',
+        tags,
+        summary: 'Update member roles',
+        description: 'Update the per-membership roles for an existing group member.',
+        request: {
+            params: z.object({ groupId: z.string(), userId: z.string() }),
+            body: { content: { 'application/json': { schema: MemberRolesBody } }, required: true },
+        },
+        responses: {
+            204: { description: 'Updated' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId, userId } = c.req.valid('param');
+        const { roles } = c.req.valid('json');
+        await updateGroupMembership(adapter, groupId, userId, roles);
+        return c.body(null, 204);
+    });
+    // ---------------------------------------------------------------------------
+    // DELETE /groups/:groupId/members/:userId — remove member
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'delete',
+        path: '/groups/:groupId/members/:userId',
+        tags,
+        summary: 'Remove group member',
+        request: { params: z.object({ groupId: z.string(), userId: z.string() }) },
+        responses: {
+            204: { description: 'Removed' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { groupId, userId } = c.req.valid('param');
+        await removeGroupMember(adapter, groupId, userId);
+        return c.body(null, 204);
+    });
+    // ---------------------------------------------------------------------------
+    // GET /users/:userId/groups — list user's groups
+    // ---------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/users/:userId/groups',
+        tags,
+        summary: "List user's groups",
+        description: 'List groups a user belongs to. Scoped to tenant context when present, app-wide otherwise.',
+        request: { params: z.object({ userId: z.string() }) },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: z.array(UserGroupEntry) } },
+                description: "User's groups",
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const adapter = getAdapter(c);
+        const { userId } = c.req.valid('param');
+        const tenantId = c.get('tenantId') ?? null;
+        const groups = await getUserGroups(adapter, userId, tenantId);
+        return c.json(groups, 200);
+    });
+    return router;
+};

package/dist/packages/bunshot-auth/src/routes/m2m.d.ts

@@ -0,0 +1,2 @@
+import type { AuthRuntimeContext } from '../runtime';
+export declare function createM2MRouter(runtime: AuthRuntimeContext): import("@hono/zod-openapi").OpenAPIHono<import("../../../bunshot-core/src/index.js").AppEnv, {}, "/">;

package/dist/packages/bunshot-auth/src/routes/m2m.js

@@ -0,0 +1,145 @@
+import { signToken } from '../lib/jwt';
+import { z } from 'zod';
+import { createRoute } from '../../../bunshot-core/src/index.js';
+import { createRouter } from '../../../bunshot-core/src/index.js';
+import { getClientIp } from '../../../bunshot-core/src/index.js';
+const tags = ['M2M'];
+const m2mTokenOpts = { windowMs: 60_000, max: 30 }; // 30/min per IP
+const m2mTokenRequestSchema = z.object({
+    grant_type: z.string().max(50),
+    client_id: z.string().max(256),
+    client_secret: z.string().max(512),
+    scope: z.string().max(1024).optional(),
+});
+const m2mTokenResponseSchema = z.object({
+    access_token: z.string(),
+    token_type: z.literal('Bearer'),
+    expires_in: z.number().int(),
+    scope: z.string(),
+});
+const oauth2ErrorSchema = z.object({
+    error: z.string(),
+    error_description: z.string().optional(),
+});
+const m2mTokenRoute = createRoute({
+    method: 'post',
+    path: '/oauth/token',
+    summary: 'OAuth 2.0 client_credentials grant',
+    tags,
+    request: {
+        body: {
+            content: {
+                'application/json': { schema: m2mTokenRequestSchema },
+                'application/x-www-form-urlencoded': { schema: m2mTokenRequestSchema },
+            },
+        },
+    },
+    responses: {
+        200: {
+            content: { 'application/json': { schema: m2mTokenResponseSchema } },
+            description: 'Token issued successfully.',
+        },
+        400: {
+            content: { 'application/json': { schema: oauth2ErrorSchema } },
+            description: 'Invalid request (RFC 6749 Section 5.2).',
+        },
+        401: {
+            content: { 'application/json': { schema: oauth2ErrorSchema } },
+            description: 'Invalid client credentials.',
+        },
+        429: {
+            content: { 'application/json': { schema: oauth2ErrorSchema } },
+            description: 'Rate limit exceeded.',
+        },
+    },
+});
+export function createM2MRouter(runtime) {
+    const { adapter, config } = runtime;
+    const router = createRouter();
+    router.openapi(m2mTokenRoute, async (c) => {
+        const ip = getClientIp(c);
+        if (await runtime.rateLimit.trackAttempt(`m2m-token:${ip}`, m2mTokenOpts)) {
+            return c.json({
+                error: 'rate_limit_exceeded',
+                error_description: 'Too many token requests. Try again later.',
+            }, 429);
+        }
+        // Handle both JSON and form-urlencoded bodies
+        let body;
+        const contentType = c.req.header('content-type') ?? '';
+        if (contentType.includes('application/x-www-form-urlencoded')) {
+            const text = await c.req.text();
+            const params = new URLSearchParams(text);
+            body = {
+                grant_type: params.get('grant_type') ?? undefined,
+                client_id: params.get('client_id') ?? undefined,
+                client_secret: params.get('client_secret') ?? undefined,
+                scope: params.get('scope') ?? undefined,
+            };
+        }
+        else {
+            try {
+                body = await c.req.json();
+            }
+            catch {
+                return c.json({ error: 'invalid_request', error_description: 'Invalid request body' }, 400);
+            }
+        }
+        const validated = m2mTokenRequestSchema.safeParse(body);
+        if (!validated.success) {
+            const detail = validated.error.issues
+                .map(i => `${i.path.join('.')}: ${i.message}`)
+                .join('; ');
+            return c.json({ error: 'invalid_request', error_description: detail }, 400);
+        }
+        const { grant_type, client_id: clientId, client_secret: clientSecret, scope, } = validated.data;
+        if (grant_type !== 'client_credentials') {
+            return c.json({ error: 'unsupported_grant_type', error_description: 'Unsupported grant type' }, 400);
+        }
+        if (!adapter.getM2MClient) {
+            return c.json({
+                error: 'invalid_request',
+                error_description: 'M2M client credentials not supported by auth adapter',
+            }, 400);
+        }
+        const client = await adapter.getM2MClient(clientId);
+        if (!client) {
+            return c.json({ error: 'invalid_client', error_description: 'Invalid client credentials' }, 401);
+        }
+        const secretValid = await Bun.password.verify(clientSecret, client.clientSecretHash);
+        if (!secretValid) {
+            return c.json({ error: 'invalid_client', error_description: 'Invalid client credentials' }, 401);
+        }
+        if (!client.active) {
+            return c.json({ error: 'invalid_client', error_description: 'Client is disabled' }, 401);
+        }
+        // Validate requested scopes against client's allowed scopes
+        let grantedScopes = client.scopes;
+        if (scope) {
+            const requested = scope.split(' ');
+            const invalid = requested.filter(s => !client.scopes.includes(s));
+            if (invalid.length > 0) {
+                return c.json({
+                    error: 'invalid_scope',
+                    error_description: `Scope not allowed: ${invalid.join(', ')}`,
+                }, 400);
+            }
+            grantedScopes = requested;
+        }
+        const expiry = config.m2m?.tokenExpiry ?? 3600;
+        const token = await signToken({ sub: clientId, scope: grantedScopes.join(' ') }, expiry, config, runtime.signing);
+        return c.json({
+            access_token: token,
+            token_type: 'Bearer',
+            expires_in: expiry,
+            scope: grantedScopes.join(' '),
+        }, 200);
+    }, (result, c) => {
+        // Per-route validation hook: return RFC 6749 errors instead of standard Bunshot shape
+        if (!result.success) {
+            const detail = result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`).join('; ');
+            return c.json({ error: 'invalid_request', error_description: detail }, 400);
+        }
+    });
+    return router;
+}

package/dist/packages/bunshot-auth/src/routes/mfa.d.ts

@@ -0,0 +1,6 @@
+import type { AuthRateLimitConfig } from '../config/authConfig';
+import type { AuthRuntimeContext } from '../runtime';
+export interface MfaRouterOptions {
+    rateLimit?: AuthRateLimitConfig;
+}
+export declare const createMfaRouter: ({ rateLimit }: MfaRouterOptions | undefined, runtime: AuthRuntimeContext) => import("@hono/zod-openapi").OpenAPIHono<import("../../../bunshot-core/src/index.js").AppEnv, {}, "/">;