@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/cli.js

@@ -15,11 +15,11 @@ ${z.join(`
   // Uncomment to require email verification before login:
   // emailVerification: {
   //   required: true,
-  //   onSend: async (email, token) => { /* send via Resend, SendGrid, etc. */ },
+  //   // Listen to auth:delivery.email_verification bus event to send the email
   // },
   // Uncomment to enable password reset:
   // passwordReset: {
-  //   onSend: async (email, token) => { /* send via Resend, SendGrid, etc. */ },
+  //   // Listen to auth:delivery.password_reset bus event to send the reset email
   // },
   refreshTokens: { accessTokenExpiry: 900, refreshTokenExpiry: 2_592_000 },
   sessionPolicy: { trackLastActive: true },
@@ -75,7 +75,7 @@ export const security: SecurityConfig = {
 export const security: SecurityConfig = {
   cors: "*",
   bearerAuth: false,
-};`;let z=m,G=["  roles: Object.values(USER_ROLES),","  defaultRole: USER_ROLES.USER,"];if(z.passwordPolicy==="relaxed")G.push("  passwordPolicy: { minLength: 8, requireLetter: true, requireDigit: true },");else if(z.passwordPolicy==="strong")G.push("  passwordPolicy: { minLength: 12, requireLetter: true, requireDigit: true, requireSpecial: true },");else G.push("  passwordPolicy: { minLength: 1, requireLetter: false, requireDigit: false, requireSpecial: false },");if(z.emailVerification)G.push("  emailVerification: {"),G.push("    required: true,"),G.push("    onSend: async (email, token) => { /* send via Resend, SendGrid, etc. */ },"),G.push("  },");if(z.passwordReset)G.push("  passwordReset: {"),G.push("    onSend: async (email, token) => { /* send via Resend, SendGrid, etc. */ },"),G.push("  },");if(z.refreshTokens)G.push("  refreshTokens: { accessTokenExpiry: 900, refreshTokenExpiry: 2_592_000 },");if(z.mfa==="optional")G.push("  mfa: { issuer: APP_NAME },");else if(z.mfa==="required")G.push("  mfa: { issuer: APP_NAME, required: true },");G.push("  sessionPolicy: { trackLastActive: true },");let U=`export const auth: AuthConfig = {
+};`;let z=m,G=["  roles: Object.values(USER_ROLES),","  defaultRole: USER_ROLES.USER,"];if(z.passwordPolicy==="relaxed")G.push("  passwordPolicy: { minLength: 8, requireLetter: true, requireDigit: true },");else if(z.passwordPolicy==="strong")G.push("  passwordPolicy: { minLength: 12, requireLetter: true, requireDigit: true, requireSpecial: true },");else G.push("  passwordPolicy: { minLength: 1, requireLetter: false, requireDigit: false, requireSpecial: false },");if(z.emailVerification)G.push("  emailVerification: {"),G.push("    required: true,"),G.push("    // Listen to auth:delivery.email_verification bus event to send the email"),G.push("  },");if(z.passwordReset)G.push("  passwordReset: {"),G.push("    // Listen to auth:delivery.password_reset bus event to send the reset email"),G.push("  },");if(z.refreshTokens)G.push("  refreshTokens: { accessTokenExpiry: 900, refreshTokenExpiry: 2_592_000 },");if(z.mfa==="optional")G.push("  mfa: { issuer: APP_NAME },");else if(z.mfa==="required")G.push("  mfa: { issuer: APP_NAME, required: true },");G.push("  sessionPolicy: { trackLastActive: true },");let U=`export const auth: AuthConfig = {
 ${G.join(`
 `)}
 };`,J=['  cors: "*",'];if(z.csrf)J.push("  csrf: { enabled: true },");let $=`export const security: SecurityConfig = {
@@ -98,7 +98,7 @@ import {
   type DbConfig,
   type SecurityConfig,
 } from "@lastshotlabs/bunshot";
-import { APP_NAME, APP_VERSION, USER_ROLES } from "@lib/constants";
+import { APP_NAME, APP_VERSION, USER_ROLES } from "@shared/constants";
 
 export const app: AppMeta = {
   name: APP_NAME,

package/dist/packages/bunshot-admin/src/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Thin pass-through plugin — wires an AdminAccessProvider and ManagedUserProvider
+ * into the Bunshot framework. Has no storage adapter of its own; persistence is
+ * delegated to the configured providers (e.g. bunshot-auth).
+ * If admin grows into a full plugin (own storage, queues, etc.), scaffold the
+ * full canonical structure at that time.
+ */
+export { createAdminPlugin } from './plugin';
+export { adminPluginConfigSchema } from './types/config';
+export type { AdminPluginConfig } from './types/config';
+export type { AdminPrincipal, AdminAccessProvider, ManagedUserProvider, ManagedUserCapabilities, ManagedUserRecord, SessionRecord, ListUsersInput, ListUsersResult, SuspendUserInput, UnsuspendUserInput, UpdateUserInput, } from './types/provider';
+export type { AdminEnv, AdminVariables } from './types/env';
+export { createAuth0AccessProvider } from './providers/auth0Access';
+export type { Auth0AccessProviderConfig } from './providers/auth0Access';
+export { registerAdminResourceTypes } from './lib/resourceTypes';

package/dist/packages/bunshot-admin/src/index.js

@@ -0,0 +1,11 @@
+/**
+ * Thin pass-through plugin — wires an AdminAccessProvider and ManagedUserProvider
+ * into the Bunshot framework. Has no storage adapter of its own; persistence is
+ * delegated to the configured providers (e.g. bunshot-auth).
+ * If admin grows into a full plugin (own storage, queues, etc.), scaffold the
+ * full canonical structure at that time.
+ */
+export { createAdminPlugin } from './plugin';
+export { adminPluginConfigSchema } from './types/config';
+export { createAuth0AccessProvider } from './providers/auth0Access';
+export { registerAdminResourceTypes } from './lib/resourceTypes';

package/dist/packages/bunshot-admin/src/lib/resourceTypes.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionRegistry } from '../../../bunshot-core/src/index.js';
+/**
+ * Registers all admin resource types into the given registry.
+ * Call this before createApp() — the registry is immutable after registration.
+ * super-admin is not listed in any roles map; registry.getActionsForRole(*, 'super-admin')
+ * always returns ['*'], handled inside createPermissionRegistry().
+ */
+export declare function registerAdminResourceTypes(registry: PermissionRegistry): void;

package/dist/packages/bunshot-admin/src/lib/resourceTypes.js

@@ -0,0 +1,33 @@
+/**
+ * Registers all admin resource types into the given registry.
+ * Call this before createApp() — the registry is immutable after registration.
+ * super-admin is not listed in any roles map; registry.getActionsForRole(*, 'super-admin')
+ * always returns ['*'], handled inside createPermissionRegistry().
+ */
+export function registerAdminResourceTypes(registry) {
+    registry.register({
+        resourceType: 'admin:user',
+        actions: ['read', 'write', 'suspend', 'delete'],
+        roles: { 'tenant-admin': ['read', 'write', 'suspend'], support: ['read'] },
+    });
+    registry.register({
+        resourceType: 'admin:session',
+        actions: ['read', 'revoke'],
+        roles: { 'tenant-admin': ['read', 'revoke'], support: ['read'] },
+    });
+    registry.register({
+        resourceType: 'admin:role',
+        actions: ['read', 'write'],
+        roles: { 'tenant-admin': ['read', 'write'] },
+    });
+    registry.register({
+        resourceType: 'admin:audit',
+        actions: ['read'],
+        roles: { 'tenant-admin': ['read'], support: ['read'], auditor: ['read'] },
+    });
+    registry.register({
+        resourceType: 'admin:permission',
+        actions: ['read', 'write'],
+        roles: { 'tenant-admin': ['read', 'write'] },
+    });
+}

package/dist/packages/bunshot-admin/src/lib/typedRoute.d.ts

@@ -0,0 +1,14 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type { AdminEnv } from '../types/env';
+/**
+ * Typed wrapper for router.openapi() — works around generic type erasure
+ * in @hono/zod-openapi when route definitions come from createRoute().
+ * Consolidates the single unavoidable cast here instead of scattering
+ * `as any` across every route registration.
+ */
+export declare function registerRoute(router: OpenAPIHono<AdminEnv>, route: Parameters<OpenAPIHono<AdminEnv>['openapi']>[0], handler: Parameters<OpenAPIHono<AdminEnv>['openapi']>[1]): any;
+/**
+ * Creates a typed OpenAPIHono router scoped to AdminEnv.
+ * Centralises the createRouter() → OpenAPIHono<AdminEnv> double-cast alongside registerRoute.
+ */
+export declare function createTypedRouter(): OpenAPIHono<AdminEnv>;

package/dist/packages/bunshot-admin/src/lib/typedRoute.js

@@ -0,0 +1,17 @@
+import { createRouter } from '../../../bunshot-core/src/index.js';
+/**
+ * Typed wrapper for router.openapi() — works around generic type erasure
+ * in @hono/zod-openapi when route definitions come from createRoute().
+ * Consolidates the single unavoidable cast here instead of scattering
+ * `as any` across every route registration.
+ */
+export function registerRoute(router, route, handler) {
+    return router.openapi(route, handler);
+}
+/**
+ * Creates a typed OpenAPIHono router scoped to AdminEnv.
+ * Centralises the createRouter() → OpenAPIHono<AdminEnv> double-cast alongside registerRoute.
+ */
+export function createTypedRouter() {
+    return createRouter();
+}

package/dist/packages/bunshot-admin/src/plugin.d.ts

@@ -0,0 +1,4 @@
+import type { StandalonePlugin } from '../../bunshot-core/src/index.js';
+import type { AdminPluginConfig } from './types/config';
+export type { AdminPluginConfig };
+export declare function createAdminPlugin(rawConfig: AdminPluginConfig): StandalonePlugin;

package/dist/packages/bunshot-admin/src/plugin.js

@@ -0,0 +1,46 @@
+import { validatePluginConfig } from '../../bunshot-core/src/index.js';
+import { createAdminRouter } from './routes/admin';
+import { createMailRouter } from './routes/mail';
+import { createPermissionsRouter } from './routes/permissions';
+import { adminPluginConfigSchema } from './types/config';
+export function createAdminPlugin(rawConfig) {
+    const config = validatePluginConfig('bunshot-admin', rawConfig, adminPluginConfigSchema);
+    async function doSetup(app, _frameworkConfig, bus) {
+        const { accessProvider, managedUserProvider } = config;
+        const mountPath = config.mountPath ?? '/admin';
+        // Single auth guard protecting all routes under mountPath (admin, permissions, mail).
+        // Placing the guard here rather than inside each sub-router ensures every
+        // independently-mounted router is covered by the same access check.
+        // Cast to Hono<AdminEnv> so the middleware context is typed with adminPrincipal.
+        app.use(`${mountPath}/*`, async (c, next) => {
+            const principal = await accessProvider.verifyRequest(c);
+            if (!principal)
+                return c.json({ error: 'Unauthorized' }, 401);
+            c.set('adminPrincipal', principal);
+            await next();
+        });
+        const adminRouter = createAdminRouter({
+            managedUserProvider,
+            bus,
+            evaluator: config.permissions.evaluator,
+            auditLog: config.auditLog,
+        });
+        app.route(mountPath, adminRouter);
+        const permissionsRouter = createPermissionsRouter({
+            evaluator: config.permissions.evaluator,
+            adapter: config.permissions.adapter,
+            registry: config.permissions.registry,
+        });
+        app.route(`${mountPath}/permissions`, permissionsRouter);
+        if (config.mailRenderer) {
+            const mailRouter = createMailRouter({ renderer: config.mailRenderer });
+            app.route(mountPath, mailRouter);
+        }
+    }
+    return {
+        name: 'bunshot-admin',
+        dependencies: [],
+        setupRoutes: doSetup,
+        setup: doSetup,
+    };
+}

package/dist/packages/bunshot-admin/src/providers/auth0Access.d.ts

@@ -0,0 +1,6 @@
+import type { AdminAccessProvider } from '../types/provider';
+export interface Auth0AccessProviderConfig {
+    domain: string;
+    audience: string;
+}
+export declare function createAuth0AccessProvider(config: Auth0AccessProviderConfig): AdminAccessProvider;

package/dist/packages/bunshot-admin/src/providers/auth0Access.js

@@ -0,0 +1,32 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+export function createAuth0AccessProvider(config) {
+    const jwksUrl = new URL(`https://${config.domain}/.well-known/jwks.json`);
+    const JWKS = createRemoteJWKSet(jwksUrl);
+    return {
+        name: 'auth0',
+        async verifyRequest(c) {
+            try {
+                const authHeader = c.req.header('authorization') ?? '';
+                if (!authHeader.startsWith('Bearer '))
+                    return null;
+                const token = authHeader.slice(7);
+                const { payload } = await jwtVerify(token, JWKS, {
+                    audience: config.audience,
+                });
+                const auth0Payload = payload;
+                if (!auth0Payload.sub)
+                    return null;
+                return {
+                    subject: auth0Payload.sub,
+                    provider: 'auth0',
+                    email: auth0Payload.email ?? undefined,
+                    displayName: auth0Payload.name ?? undefined,
+                    rawClaims: payload,
+                };
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}

package/dist/packages/bunshot-admin/src/routes/admin.d.ts

@@ -0,0 +1,10 @@
+import type { AuditLogProvider, BunshotEventBus, PermissionEvaluator } from '../../../bunshot-core/src/index.js';
+import type { AdminEnv } from '../types/env';
+import type { ManagedUserProvider } from '../types/provider';
+export interface AdminRouterConfig {
+    managedUserProvider: ManagedUserProvider;
+    bus: BunshotEventBus;
+    evaluator: PermissionEvaluator;
+    auditLog?: AuditLogProvider;
+}
+export declare function createAdminRouter(config: AdminRouterConfig): import("@hono/zod-openapi").OpenAPIHono<AdminEnv, {}, "/">;