@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/packages/bunshot-admin/src/routes/mail.d.ts

@@ -0,0 +1,6 @@
+import type { MailRenderer } from '../../../bunshot-core/src/index.js';
+import type { AdminEnv } from '../types/env';
+export interface MailRouterConfig {
+    renderer: MailRenderer;
+}
+export declare function createMailRouter(config: MailRouterConfig): import("@hono/zod-openapi").OpenAPIHono<AdminEnv, {}, "/">;

package/dist/packages/bunshot-admin/src/routes/mail.js

@@ -0,0 +1,114 @@
+import { z } from 'zod';
+import { TemplateNotFoundError, createRoute } from '../../../bunshot-core/src/index.js';
+import { createTypedRouter, registerRoute } from '../lib/typedRoute';
+// ---------------------------------------------------------------------------
+// Zod schemas
+// ---------------------------------------------------------------------------
+const ErrorResponse = z.object({ error: z.string() });
+const MailTemplateListResponse = z
+    .object({
+    templates: z.array(z.string()),
+})
+    .openapi('MailTemplateListResponse');
+const MailTemplatePreviewBody = z.object({
+    data: z.record(z.string(), z.unknown()).optional(),
+});
+const MailTemplatePreviewResponse = z
+    .object({
+    subject: z.string().nullable(),
+    html: z.string(),
+    text: z.string().nullable(),
+})
+    .openapi('MailTemplatePreviewResponse');
+const tags = ['Admin'];
+export function createMailRouter(config) {
+    const { renderer } = config;
+    const router = createTypedRouter();
+    // -------------------------------------------------------------------------
+    // GET /mail/templates — list available templates
+    // -------------------------------------------------------------------------
+    registerRoute(router, createRoute({
+        method: 'get',
+        path: '/mail/templates',
+        summary: 'List mail templates',
+        description: 'Returns the list of available mail templates from the configured renderer.',
+        tags,
+        responses: {
+            200: {
+                content: { 'application/json': { schema: MailTemplateListResponse } },
+                description: 'List of template names.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+        },
+    }), async (c) => {
+        const templates = renderer.listTemplates ? await renderer.listTemplates() : [];
+        return c.json({ templates });
+    });
+    // -------------------------------------------------------------------------
+    // POST /mail/templates/:name/preview — render a template with data
+    // -------------------------------------------------------------------------
+    registerRoute(router, createRoute({
+        method: 'post',
+        path: '/mail/templates/:name/preview',
+        summary: 'Preview a mail template',
+        description: 'Renders a mail template with the supplied data and returns subject, html, and text.',
+        tags,
+        request: {
+            params: z.object({ name: z.string() }),
+            body: {
+                content: { 'application/json': { schema: MailTemplatePreviewBody } },
+                required: false,
+            },
+        },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: MailTemplatePreviewResponse } },
+                description: 'Rendered template.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Template not found.',
+            },
+        },
+    }), async (c) => {
+        const name = c.req.param('name');
+        let data = {};
+        try {
+            const body = (await c.req.json().catch(() => ({})));
+            data = body?.data ?? {};
+        }
+        catch {
+            // body is optional
+        }
+        try {
+            const result = await renderer.render(name, data);
+            return c.json({
+                subject: result.subject ?? null,
+                html: result.html,
+                text: result.text ?? null,
+            });
+        }
+        catch (err) {
+            if (err instanceof TemplateNotFoundError) {
+                return c.json({ error: 'Template not found' }, 404);
+            }
+            throw err;
+        }
+    });
+    return router;
+}

package/dist/packages/bunshot-admin/src/routes/permissions.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionEvaluator, PermissionRegistry, PermissionsAdapter } from '../../../bunshot-core/src/index.js';
+import type { AdminEnv } from '../types/env';
+export interface PermissionsRouterConfig {
+    evaluator: PermissionEvaluator;
+    adapter: PermissionsAdapter;
+    registry: PermissionRegistry;
+}
+export declare function createPermissionsRouter(config: PermissionsRouterConfig): import("@hono/zod-openapi").OpenAPIHono<AdminEnv, {}, "/">;

package/dist/packages/bunshot-admin/src/routes/permissions.js

@@ -0,0 +1,315 @@
+import { z } from 'zod';
+import { createRoute, validateGrant } from '../../../bunshot-core/src/index.js';
+import { createTypedRouter, registerRoute } from '../lib/typedRoute';
+const tags = ['Admin Permissions'];
+const ErrorResponse = z.object({ error: z.string() });
+const GrantBody = z.object({
+    subjectId: z.string(),
+    subjectType: z.enum(['user', 'group', 'service-account']),
+    tenantId: z.string().nullable().optional(),
+    resourceType: z.string().nullable().optional(),
+    resourceId: z.string().nullable().optional(),
+    roles: z.array(z.string()).min(1),
+    effect: z.enum(['allow', 'deny']).optional().default('allow'),
+    reason: z.string().optional(),
+    expiresAt: z.string().optional(), // ISO string — parse to Date before validateGrant
+});
+const GrantResponse = z
+    .object({
+    id: z.string(),
+})
+    .openapi('PermissionGrantCreated');
+const GrantRecord = z
+    .object({
+    id: z.string(),
+    subjectId: z.string(),
+    subjectType: z.string(),
+    tenantId: z.string().nullable(),
+    resourceType: z.string().nullable(),
+    resourceId: z.string().nullable(),
+    roles: z.array(z.string()),
+    effect: z.string(),
+    grantedBy: z.string(),
+    grantedAt: z.string(),
+    reason: z.string().optional(),
+    expiresAt: z.string().optional(),
+    revokedBy: z.string().optional(),
+    revokedAt: z.string().optional(),
+})
+    .openapi('PermissionGrant');
+const GrantListResponse = z
+    .object({
+    grants: z.array(GrantRecord),
+})
+    .openapi('PermissionGrantList');
+const ResourceTypeRecord = z
+    .object({
+    resourceType: z.string(),
+    actions: z.array(z.string()),
+    roles: z.record(z.string(), z.array(z.string())),
+})
+    .openapi('ResourceTypeDefinition');
+const ResourceTypeListResponse = z
+    .object({
+    resourceTypes: z.array(ResourceTypeRecord),
+})
+    .openapi('ResourceTypeList');
+// Tenant scope enforcement helper.
+// Returns an error response if principal cannot access the target tenant, or null if allowed.
+function assertPermissionsScope(c, principal, targetTenantId) {
+    // principal.tenantId === undefined means global admin (same as null)
+    const principalTenant = principal.tenantId ?? null;
+    if (principalTenant !== null && targetTenantId !== principalTenant) {
+        return c.json({ error: 'Cross-tenant permission access denied' }, 403);
+    }
+    return null;
+}
+// Permission check — returns false if denied; callers must handle the false case.
+async function checkPerm(c, evaluator, action) {
+    const principal = c.get('adminPrincipal');
+    return evaluator.can({ subjectId: principal.subject, subjectType: 'user' }, action, {
+        tenantId: principal.tenantId,
+        resourceType: 'admin:permission',
+    });
+}
+export function createPermissionsRouter(config) {
+    const { evaluator, adapter, registry } = config;
+    const router = createTypedRouter();
+    // POST /grants — create a grant
+    registerRoute(router, createRoute({
+        method: 'post',
+        path: '/grants',
+        summary: 'Create a permission grant',
+        tags,
+        request: {
+            body: { content: { 'application/json': { schema: GrantBody } } },
+        },
+        responses: {
+            201: {
+                content: { 'application/json': { schema: GrantResponse } },
+                description: 'Grant created.',
+            },
+            400: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Invalid grant shape.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+        },
+    }), async (c) => {
+        if (!(await checkPerm(c, evaluator, 'write')))
+            return c.json({ error: 'Forbidden' }, 403);
+        const principal = c.get('adminPrincipal');
+        const body = (await c.req.json());
+        const targetTenantId = body.tenantId ?? null;
+        const principalTenant = principal.tenantId ?? null;
+        // Tenant scope enforcement
+        const scopeError = assertPermissionsScope(c, principal, targetTenantId);
+        if (scopeError)
+            return scopeError;
+        // Only global admins may create global (tenantId=null) grants
+        if (targetTenantId === null && principalTenant !== null) {
+            return c.json({ error: 'Only global admins may create global grants' }, 403);
+        }
+        // Only global admins may grant super-admin
+        if (body.roles.includes('super-admin') && principalTenant !== null) {
+            return c.json({ error: 'Only global admins may grant super-admin' }, 403);
+        }
+        // Parse expiresAt string to Date BEFORE calling validateGrant
+        const expiresAt = body.expiresAt ? new Date(body.expiresAt) : undefined;
+        try {
+            const grantInput = {
+                subjectId: body.subjectId,
+                subjectType: body.subjectType,
+                tenantId: targetTenantId,
+                resourceType: body.resourceType ?? null,
+                resourceId: body.resourceId ?? null,
+                roles: body.roles,
+                effect: body.effect,
+                grantedBy: principal.subject, // never from client
+                reason: body.reason,
+                expiresAt,
+            };
+            // validateGrant is also called inside createGrant, but call here for early error
+            validateGrant(grantInput);
+            const id = await adapter.createGrant(grantInput);
+            return c.json({ id }, 201);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Invalid grant';
+            return c.json({ error: message }, 400);
+        }
+    });
+    // DELETE /grants/:grantId — revoke a grant
+    registerRoute(router, createRoute({
+        method: 'delete',
+        path: '/grants/:grantId',
+        summary: 'Revoke a permission grant',
+        tags,
+        request: {
+            params: z.object({ grantId: z.string() }),
+        },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: z.object({ message: z.string() }) } },
+                description: 'Grant revoked.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Grant not found.',
+            },
+        },
+    }), async (c) => {
+        if (!(await checkPerm(c, evaluator, 'write')))
+            return c.json({ error: 'Forbidden' }, 403);
+        const principal = c.get('adminPrincipal');
+        const grantId = c.req.param('grantId');
+        const principalTenant = principal.tenantId ?? null;
+        const revoked = await adapter.revokeGrant(grantId, principal.subject, principalTenant !== null ? principalTenant : undefined);
+        if (!revoked)
+            return c.json({ error: 'Grant not found' }, 404);
+        return c.json({ message: 'Grant revoked' }, 200);
+    });
+    // GET /subjects/:subjectType/:subjectId/grants
+    registerRoute(router, createRoute({
+        method: 'get',
+        path: '/subjects/:subjectType/:subjectId/grants',
+        summary: 'List grants for a subject',
+        tags,
+        request: {
+            params: z.object({
+                subjectType: z.enum(['user', 'group', 'service-account']),
+                subjectId: z.string(),
+            }),
+        },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: GrantListResponse } },
+                description: 'Grant list.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+        },
+    }), async (c) => {
+        if (!(await checkPerm(c, evaluator, 'read')))
+            return c.json({ error: 'Forbidden' }, 403);
+        const principal = c.get('adminPrincipal');
+        const subjectType = c.req.param('subjectType');
+        const subjectId = c.req.param('subjectId');
+        const principalTenant = principal.tenantId ?? null;
+        let grants = await adapter.getGrantsForSubject(subjectId, subjectType);
+        // Non-global callers: filter to their tenant only
+        if (principalTenant !== null) {
+            grants = grants.filter(g => g.tenantId === principalTenant);
+        }
+        return c.json({
+            grants: grants.map(g => ({
+                ...g,
+                grantedAt: g.grantedAt.toISOString(),
+                expiresAt: g.expiresAt?.toISOString(),
+                revokedAt: g.revokedAt?.toISOString(),
+            })),
+        }, 200);
+    });
+    // GET /resources/:type/:id/grants
+    registerRoute(router, createRoute({
+        method: 'get',
+        path: '/resources/:type/:id/grants',
+        summary: 'List grants on a resource',
+        tags,
+        request: {
+            params: z.object({ type: z.string(), id: z.string() }),
+            query: z.object({ tenantId: z.string().optional() }),
+        },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: GrantListResponse } },
+                description: 'Grant list.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+        },
+    }), async (c) => {
+        if (!(await checkPerm(c, evaluator, 'read')))
+            return c.json({ error: 'Forbidden' }, 403);
+        const principal = c.get('adminPrincipal');
+        const type = c.req.param('type');
+        const id = c.req.param('id');
+        const tenantIdQuery = c.req.query('tenantId');
+        const principalTenant = principal.tenantId ?? null;
+        // tenantId=undefined or 'global' means global grants
+        const targetTenantId = tenantIdQuery === 'global' || tenantIdQuery === undefined ? null : tenantIdQuery;
+        // Global grant queries require global admin
+        if (targetTenantId === null && principalTenant !== null) {
+            return c.json({ error: 'Only global admins may query global grants' }, 403);
+        }
+        // Tenant-scoped caller cannot query other tenants
+        if (targetTenantId !== null &&
+            principalTenant !== null &&
+            targetTenantId !== principalTenant) {
+            return c.json({ error: 'Cross-tenant permission access denied' }, 403);
+        }
+        const grants = await adapter.listGrantsOnResource(type, id, targetTenantId);
+        return c.json({
+            grants: grants.map(g => ({
+                ...g,
+                grantedAt: g.grantedAt.toISOString(),
+                expiresAt: g.expiresAt?.toISOString(),
+                revokedAt: g.revokedAt?.toISOString(),
+            })),
+        }, 200);
+    });
+    // GET /resources — list registered resource types
+    registerRoute(router, createRoute({
+        method: 'get',
+        path: '/resources',
+        summary: 'List registered resource types',
+        tags,
+        responses: {
+            200: {
+                content: { 'application/json': { schema: ResourceTypeListResponse } },
+                description: 'Resource types.',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized.',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden.',
+            },
+        },
+    }), async (c) => {
+        if (!(await checkPerm(c, evaluator, 'read')))
+            return c.json({ error: 'Forbidden' }, 403);
+        const resourceTypes = registry.listResourceTypes();
+        return c.json({ resourceTypes }, 200);
+    });
+    return router;
+}

package/dist/packages/bunshot-admin/src/types/config.d.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import type { AuditLogProvider, MailRenderer, PermissionEvaluator, PermissionRegistry, PermissionsAdapter } from '../../../bunshot-core/src/index.js';
+import type { AdminAccessProvider, ManagedUserProvider } from './provider';
+export declare const adminPluginConfigSchema: z.ZodObject<{
+    mountPath: z.ZodOptional<z.ZodString>;
+    accessProvider: z.ZodCustom<AdminAccessProvider, AdminAccessProvider>;
+    managedUserProvider: z.ZodCustom<ManagedUserProvider, ManagedUserProvider>;
+    mailRenderer: z.ZodOptional<z.ZodCustom<MailRenderer, MailRenderer>>;
+    auditLog: z.ZodOptional<z.ZodCustom<AuditLogProvider, AuditLogProvider>>;
+    permissions: z.ZodObject<{
+        evaluator: z.ZodCustom<PermissionEvaluator, PermissionEvaluator>;
+        registry: z.ZodCustom<PermissionRegistry, PermissionRegistry>;
+        adapter: z.ZodCustom<PermissionsAdapter, PermissionsAdapter>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AdminPluginConfig = z.infer<typeof adminPluginConfigSchema>;

package/dist/packages/bunshot-admin/src/types/config.js

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+export const adminPluginConfigSchema = z.object({
+    /** Mount path for admin routes. Default: '/admin' */
+    mountPath: z.string().optional(),
+    /** Provider for admin access verification */
+    accessProvider: z.custom(v => v != null && typeof v === 'object', {
+        message: 'Expected an AdminAccessProvider instance',
+    }),
+    /** Provider for managed user operations */
+    managedUserProvider: z.custom(v => v != null && typeof v === 'object', {
+        message: 'Expected a ManagedUserProvider instance',
+    }),
+    /** Mail template renderer for admin emails */
+    mailRenderer: z
+        .custom(v => v != null && typeof v === 'object', {
+        message: 'Expected a MailRenderer instance',
+    })
+        .optional(),
+    /** Audit log provider for tracking admin actions */
+    auditLog: z
+        .custom(v => v != null && typeof v === 'object', {
+        message: 'Expected an AuditLogProvider instance',
+    })
+        .optional(),
+    /** Required permissions system */
+    permissions: z.object({
+        evaluator: z.custom(v => v != null && typeof v === 'object', {
+            message: 'Expected a PermissionEvaluator instance',
+        }),
+        registry: z.custom(v => v != null && typeof v === 'object', {
+            message: 'Expected a PermissionRegistry instance',
+        }),
+        adapter: z.custom(v => v != null && typeof v === 'object', {
+            message: 'Expected a PermissionsAdapter instance',
+        }),
+    }),
+});

package/dist/packages/bunshot-admin/src/types/env.d.ts

@@ -0,0 +1,14 @@
+import type { AppEnv } from '../../../bunshot-core/src/index.js';
+import type { AdminPrincipal } from './provider';
+export type AdminVariables = {
+    adminPrincipal: AdminPrincipal;
+};
+/**
+ * Hono environment type for admin routes. Extends AppEnv with adminPrincipal.
+ * Uses intersection to add the admin variable while keeping AppEnv compatibility.
+ * The defaultHook cast (Hook<AppEnv> → Hook<AdminEnv>) is safe because AdminEnv
+ * only adds variables; existing AppEnv variables remain accessible.
+ */
+export type AdminEnv = {
+    Variables: AppEnv['Variables'] & AdminVariables;
+};

package/dist/packages/bunshot-admin/src/types/provider.d.ts

@@ -0,0 +1 @@
+export type { AdminPrincipal, AdminAccessProvider, ManagedUserRecord, ListUsersInput, ListUsersResult, SuspendUserInput, UnsuspendUserInput, UpdateUserInput, SessionRecord, ManagedUserCapabilities, ManagedUserProvider, } from '../../../bunshot-core/src/index.js';

package/dist/packages/bunshot-admin/src/types/provider.js

@@ -0,0 +1,4 @@
+// Re-export admin provider contracts from core.
+// The canonical definitions live in @lastshotlabs/bunshot-core/adminProvider
+// so that both bunshot-admin and bunshot-auth can depend on them without a plugin→plugin edge.
+export {};

package/dist/packages/bunshot-auth/src/adapters/memoryAuth.d.ts

@@ -0,0 +1,66 @@
+import type { AuthResolvedConfig } from '../config/authConfig';
+import type { AuthAdapter } from '../lib/authAdapter';
+import type { OAuthCodePayload } from '../types/oauthCode';
+import type { OAuthReauthConfirmation, OAuthReauthState } from '../types/oauthReauth';
+import type { RefreshResult, SessionInfo, SessionMetadata } from '../types/session';
+export interface MemoryAuthStores {
+    memoryAtomicCreateSession(userId: string, token: string, sessionId: string, maxSessions: number, metadata?: SessionMetadata): void;
+    memoryCreateSession(userId: string, token: string, sessionId: string, metadata?: SessionMetadata): void;
+    memoryGetSession(sessionId: string): string | null;
+    memoryGetSessionRecord(sessionId: string): {
+        token: string;
+        lastActiveAt: number;
+    } | null;
+    memoryDeleteSession(sessionId: string): void;
+    memoryGetUserSessions(userId: string): SessionInfo[];
+    memoryGetActiveSessionCount(userId: string): number;
+    memoryEvictOldestSession(userId: string): void;
+    memoryUpdateSessionLastActive(sessionId: string): void;
+    memorySetSessionLastActive(sessionId: string, ts: number): void;
+    memoryGetSessionFingerprint(sessionId: string): string | null;
+    memorySetSessionFingerprint(sessionId: string, fingerprint: string): void;
+    memoryGetMfaVerifiedAt(sessionId: string): number | null;
+    memorySetMfaVerifiedAt(sessionId: string, ts: number): void;
+    memorySetRefreshToken(sessionId: string, refreshToken: string): void;
+    memoryGetSessionByRefreshToken(refreshToken: string): RefreshResult | null;
+    memoryRotateRefreshToken(sessionId: string, newRefreshToken: string, newAccessToken: string): void;
+    memoryStoreOAuthState(state: string, codeVerifier?: string, linkUserId?: string): void;
+    memoryConsumeOAuthState(state: string): {
+        codeVerifier?: string;
+        linkUserId?: string;
+    } | null;
+    memoryGetCache(key: string): string | null;
+    memorySetCache(key: string, value: string, ttlSeconds?: number): void;
+    memoryDelCache(key: string): void;
+    memoryDelCachePattern(pattern: string): void;
+    memoryCreateVerificationToken(token: string, userId: string, email: string, ttlSeconds: number): void;
+    memoryGetVerificationToken(token: string): {
+        userId: string;
+        email: string;
+    } | null;
+    memoryDeleteVerificationToken(token: string): void;
+    memoryConsumeVerificationToken(token: string): {
+        userId: string;
+        email: string;
+    } | null;
+    memoryCreateResetToken(token: string, userId: string, email: string, ttlSeconds: number): void;
+    memoryConsumeResetToken(hash: string): {
+        userId: string;
+        email: string;
+    } | null;
+    memoryStoreOAuthCode(hash: string, payload: OAuthCodePayload, ttlSeconds: number): void;
+    memoryConsumeOAuthCode(hash: string): OAuthCodePayload | null;
+    memoryCreateDeletionCancelToken(token: string, userId: string, jobId: string, ttlSeconds: number): void;
+    memoryConsumeDeletionCancelToken(hash: string): {
+        userId: string;
+        jobId: string;
+    } | null;
+    memoryCreateMagicLinkToken(token: string, userId: string, ttlSeconds: number): void;
+    memoryConsumeMagicLinkToken(hash: string): string | null;
+    memoryStoreOAuthReauth(hash: string, data: OAuthReauthState, ttlSeconds: number): void;
+    memoryConsumeOAuthReauth(hash: string): OAuthReauthState | null;
+    memoryStoreOAuthReauthConfirmation(hash: string, data: OAuthReauthConfirmation, ttlSeconds: number): void;
+    memoryConsumeOAuthReauthConfirmation(hash: string): OAuthReauthConfirmation | null;
+    memoryDeleteUserSessions(userId: string): void;
+}
+export declare function createMemoryAuthAdapter(getConfig?: () => AuthResolvedConfig): AuthAdapter & MemoryAuthStores;