@lowdefy/api 0.0.0-experimental-20260720072521 → 0.0.0-experimental-20260720135014

package/dist/routes/auth/callbacks/createSignInCallback.js

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createCallbackPlugins from './createCallbackPlugins.js';
+function createSignInCallback({ authConfig, plugins }) {
+    const signInCallbackPlugins = createCallbackPlugins({
+        authConfig,
+        plugins,
+        type: 'signIn'
+    });
+    if (signInCallbackPlugins.length === 0) return undefined;
+    async function signInCallback({ account, credentials, email, profile, user }) {
+        let allowSignIn = true;
+        for (const plugin of signInCallbackPlugins){
+            allowSignIn = await plugin.fn({
+                properties: plugin.properties ?? {},
+                account,
+                credentials,
+                email,
+                profile,
+                user
+            });
+            if (allowSignIn === false) break;
+        }
+        return allowSignIn;
+    }
+    return signInCallback;
+}
+export default createSignInCallback;

package/dist/routes/auth/callbacks/validateSessionRoles.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ConfigError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+function validateSessionRoles({ session }) {
+    const roles = session?.user?.roles;
+    if (type.isNone(roles)) return;
+    if (!Array.isArray(roles)) {
+        throw new ConfigError('session.user.roles must be an array of strings. Check auth.userFields configuration and custom session callback plugins.', {
+            received: roles
+        });
+    }
+    for (const role of roles){
+        if (!type.isString(role)) {
+            throw new ConfigError('session.user.roles must be an array of strings. Check auth.userFields configuration and custom session callback plugins.', {
+                received: roles
+            });
+        }
+    }
+}
+export default validateSessionRoles;

package/dist/routes/{websocket/getWebsocketConfig.js → auth/createAdapter.js}

@@ -12,19 +12,13 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { ConfigError } from '@lowdefy/errors';
-async function getWebsocketConfig({ logger, readConfigFile }, { websocketId }) {
-    const websocketConfig = await readConfigFile(`websockets/${websocketId}.json`);
-    if (!websocketConfig) {
-        const err = new ConfigError(`Websocket "${websocketId}" does not exist.`);
-        logger.debug({
-            params: {
-                websocketId
-            },
-            err
-        }, err.message);
-        throw err;
+*/ function createAdapter({ authConfig, plugins }) {
+    const adapterConfig = authConfig.adapter;
+    if (!adapterConfig) {
+        return undefined;
     }
-    return websocketConfig;
+    return plugins.adapters[adapterConfig.type]({
+        properties: adapterConfig.properties
+    });
 }
-export default getWebsocketConfig;
+export default createAdapter;

package/dist/routes/auth/createLogger.js

@@ -0,0 +1,38 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ const authWarnings = {
+    NEXTAUTH_URL: 'NEXTAUTH_URL - Environment variable NEXTAUTH_URL is missing. Set it in your .env file. On Vercel, VERCEL_URL is used automatically.',
+    NO_SECRET: 'NO_SECRET - No `secret` configured. In development a temporary secret is generated, but production requires an explicit secret.',
+    DEBUG_ENABLED: 'DEBUG_ENABLED - NextAuth debug mode is enabled. This is meant for development only — remove it before deploying to production.',
+    EXPERIMENTAL_API: 'EXPERIMENTAL_API - An experimental NextAuth API is in use. It may change or be removed in a future version.'
+};
+function createLogger({ logger }) {
+    return {
+        error: (code, metadata)=>{
+            const error = metadata instanceof Error ? metadata : metadata?.error;
+            if (error) {
+                error.code = code;
+            }
+            logger.error(error);
+        },
+        warn: (code)=>{
+            logger.warn(authWarnings[code] ?? code);
+        },
+        debug: (code, metadata)=>{
+            logger.debug(metadata, code);
+        }
+    };
+}
+export default createLogger;

package/dist/routes/auth/createProviders.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // TODO: docs:
+// Callback url to configure with provider will be: {{ protocol }}{{ host }}/api/auth/callback/{{ providerId }}
+// This depends on providerId, which might cause some issues if users copy an example and change the id.
+// We need to allow users to configure ids, since they might have more than one of the same type.
+function createProviders({ authConfig, plugins }) {
+    return authConfig.providers.map((providerConfig)=>plugins.providers[providerConfig.type]({
+            ...providerConfig.properties,
+            id: providerConfig.id
+        }));
+}
+export default createProviders;

package/dist/routes/auth/events/createCreateUserEvent.js

@@ -0,0 +1,41 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createEventPlugins from './createEventPlugins.js';
+function createCreateUserEvent({ authConfig, logger, plugins }) {
+    const createUserPlugins = createEventPlugins({
+        authConfig,
+        plugins,
+        type: 'createUser'
+    });
+    async function createUserEvent({ user }) {
+        logger.info({
+            event: 'auth_create_user',
+            user: {
+                id: user.id,
+                roles: user.roles,
+                sub: user.sub,
+                session_id: user.session_id
+            }
+        });
+        for (const plugin of createUserPlugins){
+            await plugin.fn({
+                properties: plugin.properties ?? {},
+                user
+            });
+        }
+    }
+    return createUserEvent;
+}
+export default createCreateUserEvent;

package/dist/routes/auth/{organizations/getHookRequestHeaders.js → events/createEventPlugins.js}

@@ -12,13 +12,10 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ // The engine's baseURL is dynamic (resolved per request from the request
-// host), so a nested auth.api call made from inside a hook must carry the
-// firing request as its source - a headerless direct call cannot resolve a
-// base URL and BetterAuth rejects it. Database hooks receive the endpoint
-// context when the write runs inside a request lifecycle; the headers come
-// from there.
-function getHookRequestHeaders(ctx) {
-    return ctx?.headers ?? ctx?.request?.headers ?? ctx?.context?.headers;
+*/ function createEventPlugins({ authConfig, plugins, type }) {
+    return authConfig.events.map((eventConfig)=>({
+            fn: plugins.events[eventConfig.type],
+            properties: eventConfig.properties
+        })).filter((event)=>event.fn.meta.type === type);
 }
-export default getHookRequestHeaders;
+export default createEventPlugins;

package/dist/routes/auth/events/createEvents.js

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createCreateUserEvent from './createCreateUserEvent.js';
+import createLinkAccountEvent from './createLinkAccountEvent.js';
+import createSessionEvent from './createSessionEvent.js';
+import createSignInEvent from './createSignInEvent.js';
+import createSignOutEvent from './createSignOutEvent.js';
+import createUpdateUserEvent from './createUpdateUserEvent.js';
+function createEvents({ authConfig, logger, plugins }) {
+    const events = {
+        createUser: createCreateUserEvent({
+            authConfig,
+            logger,
+            plugins
+        }),
+        linkAccount: createLinkAccountEvent({
+            authConfig,
+            logger,
+            plugins
+        }),
+        signIn: createSignInEvent({
+            authConfig,
+            logger,
+            plugins
+        }),
+        signOut: createSignOutEvent({
+            authConfig,
+            logger,
+            plugins
+        }),
+        updateUser: createUpdateUserEvent({
+            authConfig,
+            logger,
+            plugins
+        })
+    };
+    const session = createSessionEvent({
+        authConfig,
+        plugins
+    });
+    if (session) events.session = session;
+    return events;
+}
+export default createEvents;

package/dist/routes/auth/events/createLinkAccountEvent.js

@@ -0,0 +1,43 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createEventPlugins from './createEventPlugins.js';
+function createLinkAccountEvent({ authConfig, logger, plugins }) {
+    const linkAccountPlugins = createEventPlugins({
+        authConfig,
+        plugins,
+        type: 'linkAccount'
+    });
+    async function linkAccountEvent({ account, profile, user }) {
+        logger.info({
+            event: 'auth_link_account',
+            user: {
+                id: user.id,
+                roles: user.roles,
+                sub: user.sub,
+                session_id: user.session_id
+            }
+        });
+        for (const plugin of linkAccountPlugins){
+            await plugin.fn({
+                properties: plugin.properties ?? {},
+                account,
+                profile,
+                user
+            });
+        }
+    }
+    return linkAccountEvent;
+}
+export default createLinkAccountEvent;

package/dist/routes/auth/{strategies/getAuthStrategies.js → events/createSessionEvent.js}

@@ -12,20 +12,23 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import createAuthStrategies from './createAuthStrategies.js';
-let strategies;
-// The strategy verifiers are constructed once per process at first use -
-// resolveAuthentication tries them in config order on every request that
-// resolves no session.
-function getAuthStrategies({ appMeta, authJson, logger, plugins, secrets }) {
-    if (strategies) return strategies;
-    strategies = createAuthStrategies({
-        appMeta,
-        authJson,
-        logger,
+*/ import createEventPlugins from './createEventPlugins.js';
+function createSessionEvent({ authConfig, plugins }) {
+    const sessionPlugins = createEventPlugins({
+        authConfig,
         plugins,
-        secrets
+        type: 'session'
     });
-    return strategies;
+    if (sessionPlugins.length === 0) return undefined;
+    async function sessionEvent({ session, token }) {
+        for (const plugin of sessionPlugins){
+            await plugin.fn({
+                properties: plugin.properties ?? {},
+                session,
+                token
+            });
+        }
+    }
+    return sessionEvent;
 }
-export default getAuthStrategies;
+export default createSessionEvent;

package/dist/routes/auth/events/createSignInEvent.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createEventPlugins from './createEventPlugins.js';
+function createSignInEvent({ authConfig, logger, plugins }) {
+    const signInPlugins = createEventPlugins({
+        authConfig,
+        plugins,
+        type: 'signIn'
+    });
+    async function signInEvent({ account, isNewUser, profile, user }) {
+        logger.info({
+            event: 'auth_sign_in',
+            isNewUser,
+            provider: account?.provider,
+            user: {
+                id: user.id,
+                roles: user.roles,
+                sub: user.sub,
+                session_id: user.session_id
+            }
+        });
+        for (const plugin of signInPlugins){
+            await plugin.fn({
+                properties: plugin.properties ?? {},
+                account,
+                isNewUser,
+                profile,
+                user
+            });
+        }
+    }
+    return signInEvent;
+}
+export default createSignInEvent;

package/dist/routes/auth/events/createSignOutEvent.js

@@ -0,0 +1,43 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createEventPlugins from './createEventPlugins.js';
+function createSignOutEvent({ authConfig, logger, plugins }) {
+    const signOutPlugins = createEventPlugins({
+        authConfig,
+        plugins,
+        type: 'signOut'
+    });
+    async function signOutEvent({ session, token }) {
+        const user = session?.user ?? token;
+        logger.info({
+            event: 'auth_sign_out',
+            user: {
+                id: user.id,
+                roles: user.roles,
+                sub: user.sub,
+                session_id: user.session_id
+            }
+        });
+        for (const plugin of signOutPlugins){
+            await plugin.fn({
+                properties: plugin.properties ?? {},
+                session,
+                token
+            });
+        }
+    }
+    return signOutEvent;
+}
+export default createSignOutEvent;

package/dist/routes/auth/events/createUpdateUserEvent.js

@@ -0,0 +1,41 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createEventPlugins from './createEventPlugins.js';
+function createUpdateUserEvent({ authConfig, logger, plugins }) {
+    const updateUserPlugins = createEventPlugins({
+        authConfig,
+        plugins,
+        type: 'updateUser'
+    });
+    async function updateUserEvent({ user }) {
+        logger.info({
+            event: 'auth_update_user',
+            user: {
+                id: user.id,
+                roles: user.roles,
+                sub: user.sub,
+                session_id: user.session_id
+            }
+        });
+        for (const plugin of updateUserPlugins){
+            await plugin.fn({
+                properties: plugin.properties ?? {},
+                user
+            });
+        }
+    }
+    return updateUserEvent;
+}
+export default createUpdateUserEvent;

package/dist/routes/auth/getNextAuthConfig.js

@@ -0,0 +1,75 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ServerParser } from '@lowdefy/operators';
+import { _app, _secret } from '@lowdefy/operators-js/operators/server';
+import createAdapter from './createAdapter.js';
+import createCallbacks from './callbacks/createCallbacks.js';
+import createEvents from './events/createEvents.js';
+import createLogger from './createLogger.js';
+import createProviders from './createProviders.js';
+const nextAuthConfig = {};
+let initialized = false;
+function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
+    if (initialized) return nextAuthConfig;
+    const operatorsParser = new ServerParser({
+        lowdefyApp: appMeta,
+        operators: {
+            _app,
+            _secret
+        },
+        secrets,
+        user: {}
+    });
+    const { output: authConfig, errors: operatorErrors } = operatorsParser.parse({
+        input: authJson,
+        location: 'auth',
+        payload: {}
+    });
+    if (operatorErrors.length > 0) {
+        throw operatorErrors[0];
+    }
+    nextAuthConfig.adapter = createAdapter({
+        authConfig,
+        logger,
+        plugins
+    });
+    nextAuthConfig.callbacks = createCallbacks({
+        authConfig,
+        logger,
+        plugins
+    });
+    nextAuthConfig.events = createEvents({
+        authConfig,
+        logger,
+        plugins
+    });
+    nextAuthConfig.logger = createLogger({
+        logger
+    });
+    nextAuthConfig.providers = createProviders({
+        authConfig,
+        logger,
+        plugins
+    });
+    nextAuthConfig.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
+    nextAuthConfig.pages = authConfig.authPages;
+    nextAuthConfig.session = authConfig.session;
+    nextAuthConfig.theme = authConfig.theme;
+    nextAuthConfig.cookies = authConfig?.advanced?.cookies;
+    nextAuthConfig.originalRedirectCallback = nextAuthConfig.callbacks.redirect;
+    initialized = true;
+    return nextAuthConfig;
+}
+export default getNextAuthConfig;

package/dist/routes/endpoints/authorizeApiEndpoint.js

@@ -12,20 +12,14 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { AuthenticationError, ConfigError } from '@lowdefy/errors';
-import { type } from '@lowdefy/helpers';
-function authorizeApiEndpoint({ authorize, logger, user }, { endpointConfig }) {
+*/ import { ConfigError } from '@lowdefy/errors';
+function authorizeApiEndpoint({ authorize, logger }, { endpointConfig }) {
     if (!authorize(endpointConfig)) {
         logger.debug({
             event: 'debug_api_authorize',
             authorized: false,
             auth_config: endpointConfig.auth
         });
-        // Unauthenticated on a protected endpoint - 401 tells the caller to fix
-        // its credentials. Wrong roles stay opaque below.
-        if (type.isNone(user)) {
-            throw new AuthenticationError(`Authentication required for API endpoint "${endpointConfig.endpointId}".`);
-        }
         throw new ConfigError(`API Endpoint "${endpointConfig.endpointId}" does not exist.`);
     }
     logger.debug({

package/dist/routes/endpoints/callEndpoint.js

@@ -18,7 +18,6 @@ import authorizeApiEndpoint from './authorizeApiEndpoint.js';
 import createEvaluateOperators from '../../context/createEvaluateOperators.js';
 import getEndpointConfig from './getEndpointConfig.js';
 import runRoutine from './runRoutine.js';
-import scheduleBackground from './scheduleBackground.js';
 async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
     const { logger } = context;
     context.blockId = blockId;
@@ -57,25 +56,6 @@ async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
         state: {},
         endpointDepth: 0
     };
-    // async: true — acknowledge now, run the routine in the background.
-    // Auth was already checked above; the outcome lands in logs (scheduleBackground)
-    // and in whatever the routine itself records.
-    if (endpointConfig.async === true) {
-        scheduleBackground(context, {
-            event: 'background_endpoint',
-            endpointId
-        }, ()=>runRoutine(context, routineContext, {
-                routine: endpointConfig.routine
-            }));
-        return {
-            error: null,
-            response: serializer.serialize({
-                accepted: true
-            }),
-            status: 'accepted',
-            success: true
-        };
-    }
     const { error, response, status } = await runRoutine(context, routineContext, {
         routine: endpointConfig.routine
     });

package/dist/routes/endpoints/control/controlReject.js

@@ -37,11 +37,9 @@ async function controlReject(context, routineContext, { control }) {
         cause,
         isReject: true
     });
-    // Log under `err` — see controlThrow: only the `err` key runs the pino error
-    // serializer, so `error` would drop the message from the log line.
     context.logger.warn({
         event: 'warn_control_reject',
-        err: error
+        error
     });
     return {
         status: 'reject',

package/dist/routes/endpoints/control/controlThrow.js

@@ -36,12 +36,9 @@ async function controlThrow(context, routineContext, { control }) {
     const error = new UserError(message, {
         cause
     });
-    // Log under `err` — the pino error serializer (createNodeLogger) is registered
-    // for the `err` key only; an Error passed as `error` is JSON-dumped without its
-    // non-enumerable `message`/`stack`, producing a log line with no message.
     context.logger.error({
         event: 'error_control_throw',
-        err: error
+        error
     });
     return {
         status: 'error',