@llmops/app 0.1.8 → 0.1.9-beta.1

package/dist/index.cjs

@@ -51,19 +51,19 @@ let hono_serve_static = require("hono/serve-static");
 let url = require("url");
 let path = require("path");
 let fs_promises = require("fs/promises");
-let hono_basic_auth = require("hono/basic-auth");
+let hono_http_exception = require("hono/http-exception");
 let __hono_zod_validator = require("@hono/zod-validator");
 let hono_pretty_json = require("hono/pretty-json");
-let hono_http_exception = require("hono/http-exception");
 let hono_cors = require("hono/cors");
 let node_crypto = require("node:crypto");
 let __llmops_gateway = require("@llmops/gateway");
 __llmops_gateway = __toESM(__llmops_gateway);
 let node_process = require("node:process");
 let __llmops_core_db = require("@llmops/core/db");
+let better_auth = require("better-auth");
 
 //#region src/client/index.tsx?url
-var client_default = "/assets/index-FrTQ7TcS.js";
+var client_default = "/assets/index-C1Qc7Z7W.js";
 
 //#endregion
 //#region src/client/styles/styles.css?url
@@ -94,7 +94,7 @@ const ReactRefresh = () => {
 const { renderToString } = react_dom_server.default;
 const manifestPath = (0, node_path.join)((0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href)), "./.vite/manifest.json");
 const manifest = (0, node_fs.existsSync)(manifestPath) ? JSON.parse((0, node_fs.readFileSync)(manifestPath, "utf-8")) : {};
-const renderer = ({ basePath = "", dev = false, llmProviders, authType }) => {
+const renderer = ({ basePath = "", dev = false, llmProviders, authType, setupComplete = false }) => {
 	const stylesPath = basePath === "/" ? styles_default : basePath + styles_default;
 	const clientPath = basePath === "/" ? client_default : basePath + client_default;
 	const faviconPath = basePath === "/" ? "/favicon.ico" : basePath + "/assets/favicon.ico";
@@ -103,7 +103,7 @@ const renderer = ({ basePath = "", dev = false, llmProviders, authType }) => {
 	});
 	return renderToString(/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("html", {
 		lang: "en",
-		className: "dark",
+		className: "",
 		children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("head", { children: [
 			/* @__PURE__ */ (0, react_jsx_runtime.jsx)("meta", {
 				name: "viewport",
@@ -358,7 +358,8 @@ const renderer = ({ basePath = "", dev = false, llmProviders, authType }) => {
             window.bootstrapData = {
               basePath: "${basePath}",
               llmProviders: ${JSON.stringify(llmProviders || [])},
-              authType: "${authType || "basic"}"
+              authType: "${authType || "basic"}",
+              setupComplete: ${setupComplete}
             };
           ` }),
 			dev && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ReactRefresh, {})
@@ -12815,7 +12816,7 @@ function parseTags(tagsJson) {
 /**
 * Analytics API routes for cost and usage tracking
 */
-const app$10 = new hono.Hono().get("/requests", zv("query", zod_default.object({
+const app$11 = new hono.Hono().get("/requests", zv("query", zod_default.object({
 	limit: zod_default.string().transform(Number).optional(),
 	offset: zod_default.string().transform(Number).optional(),
 	configId: zod_default.string().uuid().optional(),
@@ -13010,11 +13011,11 @@ const app$10 = new hono.Hono().get("/requests", zv("query", zod_default.object({
 		return c.json(internalServerError("Failed to fetch tags", 500), 500);
 	}
 });
-var analytics_default = app$10;
+var analytics_default = app$11;
 
 //#endregion
 //#region src/server/handlers/configs/index.ts
-const app$9 = new hono.Hono().post("/", zv("json", zod_default.object({ name: zod_default.string().min(1) })), async (c) => {
+const app$10 = new hono.Hono().post("/", zv("json", zod_default.object({ name: zod_default.string().min(1) })), async (c) => {
 	const db = c.get("db");
 	try {
 		const value = await db.createNewConfig({ name: c.req.valid("json").name });
@@ -13118,7 +13119,7 @@ const app$9 = new hono.Hono().post("/", zv("json", zod_default.object({ name: zo
 		return c.json(internalServerError("Failed to delete config", 500), 500);
 	}
 });
-var configs_default = app$9;
+var configs_default = app$10;
 
 //#endregion
 //#region src/server/handlers/environments/index.ts
@@ -13129,7 +13130,7 @@ var configs_default = app$9;
 const generateSecretKey$1 = (slug) => {
 	return `sec_${slug.slice(0, 4).toLowerCase()}_${(0, __llmops_core.generateId)(24)}`;
 };
-const app$8 = new hono.Hono().post("/", zv("json", zod_default.object({
+const app$9 = new hono.Hono().post("/", zv("json", zod_default.object({
 	name: zod_default.string().min(1),
 	slug: zod_default.string().min(1),
 	isProd: zod_default.boolean().optional()
@@ -13214,7 +13215,7 @@ const app$8 = new hono.Hono().post("/", zv("json", zod_default.object({
 		return c.json(internalServerError("Failed to fetch environment secrets", 500), 500);
 	}
 });
-var environments_default = app$8;
+var environments_default = app$9;
 
 //#endregion
 //#region src/server/handlers/providers/index.ts
@@ -13234,7 +13235,7 @@ async function fetchModelsDevData() {
 	cacheTimestamp = now;
 	return modelsCache;
 }
-const app$7 = new hono.Hono().get("/", async (c) => {
+const app$8 = new hono.Hono().get("/", async (c) => {
 	try {
 		const data = await fetchModelsDevData();
 		const providers = Object.values(data).map((provider) => ({
@@ -13342,11 +13343,11 @@ const app$7 = new hono.Hono().get("/", async (c) => {
 		return c.json(internalServerError("Failed to fetch models", 500), 500);
 	}
 });
-var providers_default = app$7;
+var providers_default = app$8;
 
 //#endregion
 //#region src/server/handlers/targeting/index.ts
-const app$6 = new hono.Hono().post("/", zv("json", zod_default.object({
+const app$7 = new hono.Hono().post("/", zv("json", zod_default.object({
 	environmentId: zod_default.string().uuid(),
 	configId: zod_default.string().uuid(),
 	configVariantId: zod_default.string().uuid(),
@@ -13473,11 +13474,11 @@ const app$6 = new hono.Hono().post("/", zv("json", zod_default.object({
 		return c.json(internalServerError("Failed to set targeting for environment", 500), 500);
 	}
 });
-var targeting_default = app$6;
+var targeting_default = app$7;
 
 //#endregion
 //#region src/server/handlers/variants.ts
-const app$5 = new hono.Hono().get("/:id", zv("param", zod_default.object({ id: zod_default.string().uuid() })), async (c) => {
+const app$6 = new hono.Hono().get("/:id", zv("param", zod_default.object({ id: zod_default.string().uuid() })), async (c) => {
 	const db = c.get("db");
 	const { id } = c.req.valid("param");
 	const versionParam = c.req.query("version");
@@ -13624,11 +13625,43 @@ const app$5 = new hono.Hono().get("/:id", zv("param", zod_default.object({ id: z
 		return c.json(internalServerError("Failed to fetch variant version", 500), 500);
 	}
 });
-var variants_default = app$5;
+var variants_default = app$6;
+
+//#endregion
+//#region src/server/middlewares/verifySession.ts
+let cachedSuperAdminId = void 0;
+/**
+* Middleware that verifies the user is the super admin.
+* Must be used after the auth client middleware has set user/session in context.
+*
+* SuperAdminId is cached in memory since it's set once during setup and never changes.
+*
+* @throws HTTPException 401 if no valid session exists
+* @throws HTTPException 403 if user is not the super admin
+*/
+const verifySuperAdmin = async (c, next) => {
+	const user = c.get("user");
+	const session = c.get("session");
+	if (!user || !session) throw new hono_http_exception.HTTPException(401, { message: "Unauthorized - valid session required" });
+	if (cachedSuperAdminId === void 0) cachedSuperAdminId = await c.get("db").getSuperAdminId();
+	if (!cachedSuperAdminId) {
+		await next();
+		return;
+	}
+	if (user.id !== cachedSuperAdminId) throw new hono_http_exception.HTTPException(403, { message: "Forbidden - only the super admin can access this resource" });
+	await next();
+};
+/**
+* Clear the cached superAdminId.
+* Call this after setting the superAdminId during setup.
+*/
+const clearSuperAdminCache = () => {
+	cachedSuperAdminId = void 0;
+};
 
 //#endregion
 //#region src/server/handlers/workspace-settings/index.ts
-const app$4 = new hono.Hono().get("/", async (c) => {
+const app$5 = new hono.Hono().get("/", async (c) => {
 	const db = c.get("db");
 	try {
 		const settings = await db.getWorkspaceSettings();
@@ -13637,40 +13670,28 @@ const app$4 = new hono.Hono().get("/", async (c) => {
 		console.error("Error fetching workspace settings:", error$45);
 		return c.json(internalServerError("Failed to fetch workspace settings", 500), 500);
 	}
-}).patch("/", zv("json", zod_default.object({ name: zod_default.string().nullable().optional() })), async (c) => {
+}).patch("/", zv("json", zod_default.object({
+	name: zod_default.string().nullable().optional(),
+	setupComplete: zod_default.boolean().optional(),
+	superAdminId: zod_default.string().nullable().optional()
+})), async (c) => {
 	const db = c.get("db");
 	const body = c.req.valid("json");
 	try {
 		const settings = await db.updateWorkspaceSettings(body);
+		if (body.superAdminId !== void 0) clearSuperAdminCache();
 		return c.json(successResponse(settings, 200));
 	} catch (error$45) {
 		console.error("Error updating workspace settings:", error$45);
 		return c.json(internalServerError("Failed to update workspace settings", 500), 500);
 	}
 });
-var workspace_settings_default = app$4;
+var workspace_settings_default = app$5;
 
 //#endregion
 //#region src/server/handlers/v1.ts
-/**
-* Type guard to check if auth config is basic auth
-*/
-function isBasicAuth(auth) {
-	return auth.type === "basic";
-}
-const app$3 = new hono.Hono().use("*", async (c, next) => {
-	if (c.get("authHandled")) return next();
-	const config$1 = c.get("llmopsConfig");
-	if (isBasicAuth(config$1.auth)) return (0, hono_basic_auth.basicAuth)({
-		username: config$1.auth.defaultUser,
-		password: config$1.auth.defaultPassword
-	})(c, next);
-	return c.json({
-		error: "Auth middleware not configured",
-		message: `Auth type "${config$1.auth.type}" requires @llmops/enterprise middleware. Either use basicAuth() from @llmops/sdk or install @llmops/enterprise and add the auth middleware.`
-	}, 501);
-}).route("/analytics", analytics_default).route("/configs", configs_default).route("/environments", environments_default).route("/providers", providers_default).route("/targeting", targeting_default).route("/variants", variants_default).route("/workspace-settings", workspace_settings_default);
-var v1_default = app$3;
+const app$4 = new hono.Hono().use("*", verifySuperAdmin).route("/analytics", analytics_default).route("/configs", configs_default).route("/environments", environments_default).route("/providers", providers_default).route("/targeting", targeting_default).route("/variants", variants_default).route("/workspace-settings", workspace_settings_default);
+var v1_default = app$4;
 
 //#endregion
 //#region src/server/handlers/genai/requestValidator.ts
@@ -14369,8 +14390,8 @@ async function processUsageAndLog(params) {
 
 //#endregion
 //#region src/server/handlers/genai/index.ts
-const app$2 = new hono.Hono();
-app$2.use("*", (0, hono_pretty_json.prettyJSON)()).get("/health", async (c) => {
+const app$3 = new hono.Hono();
+app$3.use("*", (0, hono_pretty_json.prettyJSON)()).get("/health", async (c) => {
 	return c.json({ status: "healthy" });
 }).use("*", requestValidator).use("*", createRequestGuardMiddleware()).use("*", createCostTrackingMiddleware()).use("*", createGatewayAdapterMiddleware()).route("/", __llmops_gateway.default).notFound((c) => c.json({ error: {
 	message: "Not Found",
@@ -14382,12 +14403,42 @@ app$2.use("*", (0, hono_pretty_json.prettyJSON)()).get("/health", async (c) => {
 		type: "api_error"
 	} }, 500);
 });
-var genai_default = app$2;
+var genai_default = app$3;
+
+//#endregion
+//#region src/server/handlers/auth/index.ts
+const app$2 = new hono.Hono().post("/complete-setup", async (c) => {
+	const db = c.get("db");
+	try {
+		const settings = await db.markSetupComplete();
+		return c.json(successResponse(settings, 200));
+	} catch (error$45) {
+		console.error("Error completing setup:", error$45);
+		return c.json(internalServerError("Failed to complete setup", 500), 500);
+	}
+});
+var auth_default = app$2;
 
 //#endregion
 //#region src/server/handlers/api.ts
 const app$1 = new hono.Hono();
-const routes = app$1.route("/genai", genai_default).route("/v1", v1_default);
+const routes = app$1.post("/auth/sign-up/*", async (c, next) => {
+	if (c.get("setupComplete")) throw new hono_http_exception.HTTPException(403, { message: "Registration is disabled. Only one user is allowed." });
+	await next();
+}).on(["POST", "GET"], "/auth/*", (c) => {
+	return c.get("authClient").handler(c.req.raw);
+}).route("/auth", auth_default).use("*", async (c, next) => {
+	const session = await c.get("authClient").api.getSession({ headers: c.req.raw.headers });
+	if (!session) {
+		c.set("user", null);
+		c.set("session", null);
+		await next();
+		return;
+	}
+	c.set("user", session.user);
+	c.set("session", session.session);
+	await next();
+}).route("/genai", genai_default).route("/v1", v1_default);
 var api_default = app$1;
 
 //#endregion
@@ -14404,11 +14455,13 @@ app.use("/assets/*", (0, hono_serve_static.serveStatic)({
 		const basePath = c.var.llmopsConfig?.basePath || "";
 		const llmProviders = c.var.llmProviders || [];
 		const authType = c.var.llmopsConfig?.auth?.type || "basic";
+		const setupComplete = c.var.setupComplete ?? false;
 		return c.html(renderer({
 			basePath,
 			dev: node_process.env.LLMOPS_DEV === "true",
 			llmProviders,
-			authType
+			authType,
+			setupComplete
 		}));
 	}
 	await next();
@@ -14481,12 +14534,10 @@ const createSeedMiddleware = () => {
 //#endregion
 //#region src/server/middlewares/migration.ts
 /**
-* Creates a middleware that handles auto-migration based on config
+* Creates a middleware that handles auto-migration on startup
 *
-* This middleware runs once on application startup and handles:
-* - autoMigrate: true - Always run migrations
-* - autoMigrate: false - Never run migrations (default)
-* - autoMigrate: 'development' - Only run when NODE_ENV is 'development'
+* This middleware runs once on application startup and automatically
+* runs database migrations if needed.
 *
 * IMPORTANT: This middleware should run BEFORE the seed middleware
 * but AFTER the database middleware creates the connection.
@@ -14495,16 +14546,15 @@ const createMigrationMiddleware = (config$1) => {
 	let migrationComplete = false;
 	let migrationPromise = null;
 	return async (c, next) => {
-		const autoMigrate = config$1.autoMigrate ?? false;
-		if (migrationComplete || autoMigrate === false) {
+		if (migrationComplete) {
 			await next();
 			return;
 		}
 		if (!migrationPromise) migrationPromise = (async () => {
 			try {
-				const { detectDatabaseType, runAutoMigrations, createDatabaseFromConnection: createDatabaseFromConnection$1 } = await import("@llmops/core/db");
+				const { detectDatabaseType: detectDatabaseType$1, runAutoMigrations, createDatabaseFromConnection: createDatabaseFromConnection$1 } = await import("@llmops/core/db");
 				const rawConnection = config$1.database;
-				const dbType = detectDatabaseType(rawConnection);
+				const dbType = detectDatabaseType$1(rawConnection);
 				if (!dbType) {
 					console.warn("[Migration] Could not detect database type, skipping auto-migration");
 					return;
@@ -14515,7 +14565,10 @@ const createMigrationMiddleware = (config$1) => {
 					console.warn("[Migration] Could not create database connection, skipping auto-migration");
 					return;
 				}
-				const result = await runAutoMigrations(db, dbType, autoMigrate, { schema });
+				const result = await runAutoMigrations(db, dbType, {
+					rawConnection,
+					schema
+				});
 				if (result.ran) console.log(`[Migration] Auto-migration completed: ${result.tables.length} table(s) created, ${result.fields.length} field(s) added`);
 			} catch (error$45) {
 				console.error("[Migration] Auto-migration failed:", error$45);
@@ -14528,6 +14581,24 @@ const createMigrationMiddleware = (config$1) => {
 	};
 };
 
+//#endregion
+//#region src/server/middlewares/auth.ts
+/**
+* Creates auth client middleware that uses the pre-configured Kysely instance
+* from context. This ensures Better Auth uses the same database connection
+* with the correct schema (search_path) configuration.
+*/
+const createAuthClientMiddleware = () => {
+	return async (c, next) => {
+		const authClient = (0, better_auth.betterAuth)((0, __llmops_core.getAuthClientOptions)({
+			db: c.get("kyselyDb"),
+			type: c.get("dbType")
+		}));
+		c.set("authClient", authClient);
+		await next();
+	};
+};
+
 //#endregion
 //#region src/index.ts
 const MODELS_DEV_LOGOS = "https://models.dev/logos";
@@ -14546,10 +14617,16 @@ const setConfigMiddleware = (config$1) => {
 };
 const createDatabaseMiddleware = (validatedConfig) => {
 	return async (c, next) => {
-		const db = await (0, __llmops_core_db.createDatabaseFromConnection)(validatedConfig.database, { schema: validatedConfig.schema });
-		if (!db) throw new Error("Failed to create database connection");
-		const dataLayer = await (0, __llmops_core.createDataLayer)(db);
+		const kyselyDb = await (0, __llmops_core_db.createDatabaseFromConnection)(validatedConfig.database, { schema: validatedConfig.schema });
+		if (!kyselyDb) throw new Error("Failed to create database connection");
+		const dbType = (0, __llmops_core_db.detectDatabaseType)(validatedConfig.database);
+		if (!dbType) throw new Error("Failed to detect database type");
+		const dataLayer = await (0, __llmops_core.createDataLayer)(kyselyDb);
 		c.set("db", dataLayer);
+		c.set("kyselyDb", kyselyDb);
+		c.set("dbType", dbType);
+		const setupComplete = await dataLayer.isSetupComplete();
+		c.set("setupComplete", setupComplete);
 		await next();
 	};
 };
@@ -14571,7 +14648,7 @@ const createLLMProvidersMiddleware = (config$1) => {
 };
 const createApp = (config$1) => {
 	const validatedConfig = (0, __llmops_core.validateLLMOpsConfig)(config$1);
-	return { app: new hono.Hono().use("*", createEnvValidatorMiddleware()).use("*", setConfigMiddleware(validatedConfig)).use("*", createMigrationMiddleware(validatedConfig)).use("*", createDatabaseMiddleware(validatedConfig)).use("*", createSeedMiddleware()).use("*", createLLMProvidersMiddleware(validatedConfig)).route("/", server_default).basePath(validatedConfig.basePath) };
+	return { app: new hono.Hono().use("*", createEnvValidatorMiddleware()).use("*", setConfigMiddleware(validatedConfig)).use("*", createMigrationMiddleware(validatedConfig)).use("*", createDatabaseMiddleware(validatedConfig)).use("*", createSeedMiddleware()).use("*", createLLMProvidersMiddleware(validatedConfig)).use("*", createAuthClientMiddleware()).route("/", server_default).basePath(validatedConfig.basePath) };
 };
 var src_default = server_default;
 

package/dist/index.d.cts

@@ -1,6 +1,8 @@
 import * as hono_types1 from "hono/types";
 import * as hono_hono_base0 from "hono/hono-base";
 import { LLMOpsConfig, ValidatedLLMOpsConfig, createDataLayer } from "@llmops/core";
+import { DatabaseType } from "@llmops/core/db";
+import { Auth, BetterAuthOptions } from "better-auth";
 import { Hono } from "hono";
 
 //#region src/server/types.d.ts
@@ -14,11 +16,12 @@ declare module 'hono' {
     llmopsConfig: ValidatedLLMOpsConfig;
     llmProviders: LLMProvider[];
     db: Awaited<ReturnType<typeof createDataLayer>>;
-    /**
-     * Set to true by enterprise auth middleware to skip basic auth.
-     * Enterprise packages should set this after successful authentication.
-     */
-    authHandled: boolean;
+    /** Raw Kysely instance with correct schema configuration */
+    kyselyDb: any;
+    /** Database type (postgres, mysql, sqlite, mssql) */
+    dbType: DatabaseType;
+    authClient: Auth<BetterAuthOptions>;
+    setupComplete: boolean;
   }
 }
 //#endregion

package/dist/index.d.mts

@@ -1,5 +1,7 @@
 import { Hono } from "hono";
 import { LLMOpsConfig, ValidatedLLMOpsConfig, createDataLayer } from "@llmops/core";
+import { DatabaseType } from "@llmops/core/db";
+import { Auth, BetterAuthOptions } from "better-auth";
 import * as hono_types1 from "hono/types";
 import * as hono_hono_base0 from "hono/hono-base";
 
@@ -14,11 +16,12 @@ declare module 'hono' {
     llmopsConfig: ValidatedLLMOpsConfig;
     llmProviders: LLMProvider[];
     db: Awaited<ReturnType<typeof createDataLayer>>;
-    /**
-     * Set to true by enterprise auth middleware to skip basic auth.
-     * Enterprise packages should set this after successful authentication.
-     */
-    authHandled: boolean;
+    /** Raw Kysely instance with correct schema configuration */
+    kyselyDb: any;
+    /** Database type (postgres, mysql, sqlite, mssql) */
+    dbType: DatabaseType;
+    authClient: Auth<BetterAuthOptions>;
+    setupComplete: boolean;
   }
 }
 //#endregion