@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/src/framework/registerBoundaryAdapters.js

@@ -0,0 +1,46 @@
+/**
+ * Auth boundary adapter assembly.
+ *
+ * Resolves the default rate limiter, fingerprint builder, and cache adapters
+ * for a single app instance. Plugins may still override these defaults
+ * through the registrar during setupMiddleware.
+ */
+import { boundaryCacheFactories } from './boundaryAdapters';
+import { createDefaultFingerprintBuilder, createMemoryRateLimitAdapter, } from '../../packages/bunshot-core/src/index.js';
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+async function resolveOptionalCacheAdapters(options) {
+    const redisClient = options.redisEnabled && options.redis ? options.redis : null;
+    const context = {
+        redis: redisClient,
+        mongo: options.mongoMode !== false ? options.appConnection : null,
+        sqliteDb: options.sqliteDb,
+    };
+    const stores = ['memory'];
+    if (context.redis)
+        stores.push('redis');
+    if (context.sqliteDb)
+        stores.push('sqlite');
+    if (context.mongo)
+        stores.push('mongo');
+    const resolved = await Promise.all(stores.map(async (store) => [store, await boundaryCacheFactories[store](context)]));
+    return new Map(resolved);
+}
+export async function resolveBoundaryAdapters(options) {
+    return {
+        rateLimitAdapter: createMemoryRateLimitAdapter(),
+        fingerprintBuilder: createDefaultFingerprintBuilder(),
+        cacheAdapters: await resolveOptionalCacheAdapters(options),
+    };
+}
+export function applyBoundaryAdapters(registrar, boundaryAdapters) {
+    registrar.setRateLimitAdapter(boundaryAdapters.rateLimitAdapter);
+    registrar.setFingerprintBuilder(boundaryAdapters.fingerprintBuilder);
+    for (const [store, adapter] of boundaryAdapters.cacheAdapters) {
+        registrar.addCacheAdapter(store, adapter);
+    }
+}
+export async function registerBoundaryAdapters(registrar, options) {
+    applyBoundaryAdapters(registrar, await resolveBoundaryAdapters(options));
+}

package/dist/src/framework/routes/admin.d.ts

@@ -0,0 +1,9 @@
+import type { AppEnv } from "../../lib/context";
+export interface AdminApiConfig {
+    enabled: boolean;
+    /** Default: "admin" */
+    adminRole?: string;
+    /** Default: "/admin" */
+    mountPath?: string;
+}
+export declare function createAdminRouter(config: AdminApiConfig): import("@hono/zod-openapi").OpenAPIHono<AppEnv, {}, "/">;

package/dist/src/framework/routes/admin.js

@@ -0,0 +1,361 @@
+import { z } from "zod";
+import { createRoute } from "../lib/createRoute";
+import { createRouter } from "../../lib/context";
+import { userAuth } from "../../../packages/bunshot-auth/src/middleware/userAuth";
+import { requireRole } from "../../../packages/bunshot-auth/src/middleware/requireRole";
+import { getAuthAdapter } from "../../../packages/bunshot-auth/src/lib/authAdapter";
+import { getUserSessions, deleteUserSessions } from "../../../packages/bunshot-auth/src/lib/session";
+import { setSuspended } from "../../../packages/bunshot-auth/src/lib/suspension";
+import { getAuthEventBus } from "../../../packages/bunshot-auth/src/lib/authEventBus";
+import { getClientIp } from "../../../packages/bunshot-auth/src/lib/clientIp";
+import { offsetParams, parseOffsetParams } from "../lib/pagination";
+// ---------------------------------------------------------------------------
+// Zod schemas
+// ---------------------------------------------------------------------------
+const ErrorResponse = z.object({ error: z.string() });
+const AdminUserRecord = z.object({
+    id: z.string(),
+    email: z.string().optional(),
+    displayName: z.string().optional(),
+    firstName: z.string().optional(),
+    lastName: z.string().optional(),
+    externalId: z.string().optional(),
+    suspended: z.boolean(),
+    suspendedReason: z.string().optional(),
+    emailVerified: z.boolean().optional(),
+    providerIds: z.array(z.string()).optional(),
+}).openapi("AdminUserRecord");
+const AdminUserListResponse = z.object({
+    users: z.array(AdminUserRecord),
+    total: z.number().int().nonnegative(),
+    limit: z.number().int().positive(),
+    offset: z.number().int().nonnegative(),
+}).openapi("AdminUserListResponse");
+const AdminUserResponse = AdminUserRecord.openapi("AdminUserResponse");
+const AdminUpdateUserBody = z.object({
+    displayName: z.string().optional(),
+    firstName: z.string().optional(),
+    lastName: z.string().optional(),
+    externalId: z.string().optional(),
+});
+const AdminSuspendBody = z.object({
+    reason: z.string().optional(),
+});
+const AdminSetRolesBody = z.object({
+    roles: z.array(z.string()),
+});
+const AdminRolesResponse = z.object({
+    roles: z.array(z.string()),
+}).openapi("AdminRolesResponse");
+const AdminSessionRecord = z.object({
+    sessionId: z.string(),
+    userId: z.string(),
+    createdAt: z.number().optional(),
+    lastActiveAt: z.number().optional(),
+    ip: z.string().optional(),
+    userAgent: z.string().optional(),
+    active: z.boolean().optional(),
+}).openapi("AdminSessionRecord");
+const AdminSessionListResponse = z.object({
+    sessions: z.array(AdminSessionRecord),
+}).openapi("AdminSessionListResponse");
+const AdminMessageResponse = z.object({ message: z.string() }).openapi("AdminMessageResponse");
+const tags = ["Admin"];
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+export function createAdminRouter(config) {
+    const router = createRouter();
+    const adminRole = config.adminRole ?? "admin";
+    const guard = [userAuth, requireRole.global(adminRole)];
+    // -------------------------------------------------------------------------
+    // GET /users — paginated user list
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "get",
+        path: "/users",
+        summary: "List users",
+        description: "Returns a paginated list of users. Supports offset pagination and optional email/search filter.",
+        tags,
+        middleware: guard,
+        request: {
+            query: z.object({
+                ...offsetParams({ limit: 50, maxLimit: 200 }).shape,
+                search: z.string().optional().describe("Filter by email (partial match)"),
+            }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminUserListResponse } }, description: "Paginated user list." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        if (!adapter.listUsers) {
+            return c.json({ error: "listUsers not supported by the configured auth adapter" }, 500);
+        }
+        const query = c.req.valid("query");
+        const { limit, offset } = parseOffsetParams(query, { limit: 50, maxLimit: 200 });
+        const search = query.search;
+        const { users, totalResults } = await adapter.listUsers({
+            ...(search ? { email: search } : {}),
+            startIndex: offset,
+            count: limit,
+        });
+        return c.json({ users, total: totalResults, limit, offset });
+    });
+    // -------------------------------------------------------------------------
+    // GET /users/:userId — get single user
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "get",
+        path: "/users/:userId",
+        summary: "Get a user",
+        description: "Returns a single user record by ID.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminUserResponse } }, description: "User record." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+            404: { content: { "application/json": { schema: ErrorResponse } }, description: "User not found." },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        const { userId } = c.req.valid("param");
+        if (!adapter.getUser) {
+            return c.json({ error: "getUser not supported by the configured auth adapter" }, 500);
+        }
+        const user = await adapter.getUser(userId);
+        if (!user)
+            return c.json({ error: "User not found" }, 404);
+        return c.json({ id: userId, ...user });
+    });
+    // -------------------------------------------------------------------------
+    // PATCH /users/:userId — update profile
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "patch",
+        path: "/users/:userId",
+        summary: "Update user profile",
+        description: "Updates display name, first/last name, or external ID for a user.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+            body: { content: { "application/json": { schema: AdminUpdateUserBody } } },
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminMessageResponse } }, description: "Profile updated." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+            404: { content: { "application/json": { schema: ErrorResponse } }, description: "User not found." },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        const { userId } = c.req.valid("param");
+        const body = c.req.valid("json");
+        if (!adapter.updateProfile) {
+            return c.json({ error: "updateProfile not supported by the configured auth adapter" }, 500);
+        }
+        if (adapter.getUser) {
+            const existing = await adapter.getUser(userId);
+            if (!existing)
+                return c.json({ error: "User not found" }, 404);
+        }
+        await adapter.updateProfile(userId, body);
+        getAuthEventBus().emit('security.admin.user.modified', { userId, meta: { fields: Object.keys(body), actorId: c.get("authUserId"), ip: getClientIp(c), requestId: c.get("requestId") ?? undefined, sessionId: c.get("sessionId") ?? undefined } });
+        return c.json({ message: "Profile updated" });
+    });
+    // -------------------------------------------------------------------------
+    // POST /users/:userId/suspend
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "post",
+        path: "/users/:userId/suspend",
+        summary: "Suspend a user",
+        description: "Suspends a user account. Suspended users cannot log in.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+            body: { content: { "application/json": { schema: AdminSuspendBody } }, required: false },
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminMessageResponse } }, description: "User suspended." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const { userId } = c.req.valid("param");
+        let reason;
+        try {
+            const body = await c.req.json().catch(() => ({}));
+            reason = body?.reason;
+        }
+        catch {
+            // body is optional
+        }
+        await setSuspended(userId, true, reason);
+        getAuthEventBus().emit('security.auth.account.suspended', { userId, meta: { reason, actorId: c.get("authUserId"), ip: getClientIp(c), requestId: c.get("requestId") ?? undefined, sessionId: c.get("sessionId") ?? undefined } });
+        return c.json({ message: "User suspended" });
+    });
+    // -------------------------------------------------------------------------
+    // POST /users/:userId/unsuspend
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "post",
+        path: "/users/:userId/unsuspend",
+        summary: "Unsuspend a user",
+        description: "Restores a suspended user account.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminMessageResponse } }, description: "User unsuspended." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const { userId } = c.req.valid("param");
+        await setSuspended(userId, false);
+        getAuthEventBus().emit('security.auth.account.unsuspended', { userId, meta: { actorId: c.get("authUserId"), ip: getClientIp(c), requestId: c.get("requestId") ?? undefined, sessionId: c.get("sessionId") ?? undefined } });
+        return c.json({ message: "User unsuspended" });
+    });
+    // -------------------------------------------------------------------------
+    // GET /users/:userId/roles
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "get",
+        path: "/users/:userId/roles",
+        summary: "Get user roles",
+        description: "Returns the app-wide roles assigned to a user.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminRolesResponse } }, description: "User roles." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        const { userId } = c.req.valid("param");
+        const roles = adapter.getRoles ? await adapter.getRoles(userId) : [];
+        return c.json({ roles });
+    });
+    // -------------------------------------------------------------------------
+    // PUT /users/:userId/roles
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "put",
+        path: "/users/:userId/roles",
+        summary: "Set user roles",
+        description: "Replaces all app-wide roles for a user.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+            body: { content: { "application/json": { schema: AdminSetRolesBody } } },
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminRolesResponse } }, description: "Updated roles." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        const { userId } = c.req.valid("param");
+        const { roles } = c.req.valid("json");
+        if (adapter.setRoles) {
+            await adapter.setRoles(userId, roles);
+        }
+        getAuthEventBus().emit('security.admin.role.changed', { userId, meta: { roles, actorId: c.get("authUserId"), ip: getClientIp(c), requestId: c.get("requestId") ?? undefined, sessionId: c.get("sessionId") ?? undefined } });
+        return c.json({ roles });
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /users/:userId — delete user
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "delete",
+        path: "/users/:userId",
+        summary: "Delete a user",
+        description: "Permanently deletes a user account and revokes all sessions.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminMessageResponse } }, description: "User deleted." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+            404: { content: { "application/json": { schema: ErrorResponse } }, description: "User not found or delete not supported." },
+        },
+    }), async (c) => {
+        const adapter = getAuthAdapter();
+        const { userId } = c.req.valid("param");
+        if (!adapter.deleteUser) {
+            return c.json({ error: "deleteUser not supported by the configured auth adapter" }, 404);
+        }
+        // Revoke all sessions first
+        await deleteUserSessions(userId);
+        await adapter.deleteUser(userId);
+        getAuthEventBus().emit('security.admin.user.deleted', { userId, meta: { actorId: c.get("authUserId"), ip: getClientIp(c), requestId: c.get("requestId") ?? undefined, sessionId: c.get("sessionId") ?? undefined } });
+        return c.json({ message: "User deleted" });
+    });
+    // -------------------------------------------------------------------------
+    // GET /users/:userId/sessions
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "get",
+        path: "/users/:userId/sessions",
+        summary: "List user sessions",
+        description: "Returns all active sessions for a user.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminSessionListResponse } }, description: "Session list." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const { userId } = c.req.valid("param");
+        const sessions = await getUserSessions(userId);
+        return c.json({ sessions });
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /users/:userId/sessions — revoke all sessions
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: "delete",
+        path: "/users/:userId/sessions",
+        summary: "Revoke all user sessions",
+        description: "Revokes all active sessions for a user, forcing them to re-authenticate.",
+        tags,
+        middleware: guard,
+        request: {
+            params: z.object({ userId: z.string() }),
+        },
+        responses: {
+            200: { content: { "application/json": { schema: AdminMessageResponse } }, description: "Sessions revoked." },
+            401: { content: { "application/json": { schema: ErrorResponse } }, description: "Unauthorized." },
+            403: { content: { "application/json": { schema: ErrorResponse } }, description: "Forbidden." },
+        },
+    }), async (c) => {
+        const { userId } = c.req.valid("param");
+        await deleteUserSessions(userId);
+        return c.json({ message: "Sessions revoked" });
+    });
+    return router;
+}

package/dist/src/framework/routes/health.d.ts

@@ -0,0 +1 @@
+export declare const router: import("@hono/zod-openapi").OpenAPIHono<import("../../../packages/bunshot-core/src/index.js").AppEnv, {}, "/">;

package/dist/src/framework/routes/health.js

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+import { createRoute, createRouter } from '../../../packages/bunshot-core/src/index.js';
+export const router = createRouter();
+router.openapi(createRoute({
+    method: 'get',
+    path: '/health',
+    tags: ['Core'],
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: z.object({
+                        status: z.enum(['ok']),
+                        timestamp: z.string(),
+                    }),
+                },
+            },
+            description: 'Service health check',
+        },
+    },
+}), c => c.json({ status: 'ok', timestamp: new Date().toISOString() }));

package/dist/src/framework/routes/home.d.ts

@@ -0,0 +1 @@
+export declare const router: import("@hono/zod-openapi").OpenAPIHono<import("../../../packages/bunshot-core/src/index.js").AppEnv, {}, "/">;

package/dist/src/framework/routes/home.js

@@ -0,0 +1,18 @@
+import { createRoute } from '@hono/zod-openapi';
+import { z } from 'zod';
+import { createRouter } from '../../../packages/bunshot-core/src/index.js';
+export const router = createRouter();
+router.openapi(createRoute({
+    method: 'get',
+    path: '/',
+    tags: ['Core'],
+    responses: {
+        200: {
+            content: { 'application/json': { schema: z.object({ message: z.string() }) } },
+            description: 'API is running',
+        },
+    },
+}), c => {
+    const appName = c.get('bunshotCtx')?.config?.appName ?? 'Core API';
+    return c.json({ message: `${appName} is running` });
+});

package/dist/src/framework/routes/jobs.d.ts

@@ -0,0 +1,3 @@
+import type { QueueFactory } from '../../lib/queue';
+import type { JobsConfig } from '../../app';
+export declare const createJobsRouter: (config: JobsConfig, queueFactory: QueueFactory) => import("@hono/zod-openapi").OpenAPIHono<import("../../../packages/bunshot-core/src/index.js").AppEnv, {}, "/">;