@maravilla-labs/platform 0.3.5 → 0.3.8

package/dist/index.js

@@ -1,3 +1,75 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/request-scope.ts
+var request_scope_exports = {};
+__export(request_scope_exports, {
+  anonymousCaller: () => anonymousCaller,
+  getCurrentRequestStore: () => getCurrentRequestStore,
+  getRequestAuthHeader: () => getRequestAuthHeader,
+  runWithRequest: () => runWithRequest
+});
+async function ensureAls() {
+  if (alsImpl) return alsImpl;
+  try {
+    const { AsyncLocalStorage } = await import("async_hooks");
+    const inner = new AsyncLocalStorage();
+    alsImpl = {
+      run: (s, fn) => inner.run(s, fn),
+      getStore: () => inner.getStore()
+    };
+  } catch {
+    let cached;
+    alsImpl = {
+      run: (s, fn) => {
+        const prev = cached;
+        cached = s;
+        try {
+          return fn();
+        } finally {
+          cached = prev;
+        }
+      },
+      getStore: () => cached
+    };
+  }
+  return alsImpl;
+}
+async function runWithRequest(fn) {
+  const als = await ensureAls();
+  return als.run({ policyEnabled: true }, () => Promise.resolve(fn()));
+}
+function getCurrentRequestStore() {
+  return alsImpl?.getStore();
+}
+function anonymousCaller() {
+  return {
+    user_id: "",
+    email: "",
+    is_admin: false,
+    roles: [],
+    is_anonymous: true
+  };
+}
+function getRequestAuthHeader() {
+  const token = alsImpl?.getStore()?.token;
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+var alsImpl;
+var init_request_scope = __esm({
+  "src/request-scope.ts"() {
+    "use strict";
+    alsImpl = null;
+  }
+});
+
 // src/media.ts
 var RemoteMediaService = class {
   constructor(baseUrl, headers) {
@@ -7,9 +79,10 @@ var RemoteMediaService = class {
   baseUrl;
   headers;
   async fetch(url, options = {}) {
+    const { getRequestAuthHeader: getRequestAuthHeader2 } = await Promise.resolve().then(() => (init_request_scope(), request_scope_exports));
     const response = await fetch(url, {
       ...options,
-      headers: { ...this.headers, ...options.headers }
+      headers: { ...this.headers, ...getRequestAuthHeader2(), ...options.headers }
     });
     if (!response.ok) {
       const error = await response.text();
@@ -51,6 +124,7 @@ var RemoteMediaService = class {
 };
 
 // src/remote-client.ts
+init_request_scope();
 var RemoteKvNamespace = class {
   constructor(baseUrl, namespace, headers) {
     this.baseUrl = baseUrl;
@@ -69,7 +143,7 @@ var RemoteKvNamespace = class {
   async fetch(url, options = {}) {
     const response = await fetch(url, {
       ...options,
-      headers: { ...this.headers, ...options.headers }
+      headers: { ...this.headers, ...getRequestAuthHeader(), ...options.headers }
     });
     if (!response.ok && response.status !== 404) {
       const error = await response.text();
@@ -127,7 +201,7 @@ var RemoteDatabase = class {
   async fetch(url, options = {}) {
     const response = await fetch(url, {
       ...options,
-      headers: { ...this.headers, ...options.headers }
+      headers: { ...this.headers, ...getRequestAuthHeader(), ...options.headers }
     });
     if (!response.ok && response.status !== 404) {
       const error = await response.text();
@@ -238,7 +312,7 @@ var RemoteStorage = class _RemoteStorage {
   async fetch(url, options = {}) {
     const response = await fetch(url, {
       ...options,
-      headers: { ...this.headers, ...options.headers }
+      headers: { ...this.headers, ...getRequestAuthHeader(), ...options.headers }
     });
     if (!response.ok && response.status !== 404) {
       const error = await response.text();
@@ -247,25 +321,29 @@ var RemoteStorage = class _RemoteStorage {
     return response;
   }
   async generateUploadUrl(key, contentType, options) {
+    const res = await this.fetch(`${this.baseUrl}/api/storage/upload-url`, {
+      method: "POST",
+      body: JSON.stringify({ key, content_type: contentType, size_limit: options?.sizeLimit })
+    });
+    const data = await res.json();
     return {
-      url: `${this.baseUrl}/api/storage/${encodeURIComponent(key)}`,
-      method: "PUT",
-      headers: {
-        "Content-Type": contentType,
-        ...this.headers
-        // Include tenant headers
-      },
-      expiresIn: 3600
-      // 1 hour
+      url: data.url.startsWith("http") ? data.url : `${this.baseUrl}${data.url}`,
+      method: data.method,
+      headers: { ...data.headers, ...this.headers },
+      expiresIn: data.expiresIn
     };
   }
   async generateDownloadUrl(key, options) {
+    const res = await this.fetch(`${this.baseUrl}/api/storage/download-url`, {
+      method: "POST",
+      body: JSON.stringify({ key, expires_in: options?.expiresIn })
+    });
+    const data = await res.json();
     return {
-      url: `${this.baseUrl}/api/storage/${encodeURIComponent(key)}`,
-      method: "GET",
-      headers: {},
-      expiresIn: options?.expiresIn || 3600
-      // Default 1 hour
+      url: data.url.startsWith("http") ? data.url : `${this.baseUrl}${data.url}`,
+      method: data.method,
+      headers: data.headers,
+      expiresIn: data.expiresIn
     };
   }
   // Dev-mode: emit the same `/_assets/<key>` shape production does.
@@ -396,7 +474,7 @@ var RemotePresenceService = class {
   async join(channel, userId, metadata) {
     const res = await fetch(`${this.baseUrl}/api/realtime/presence/${encodeURIComponent(channel)}/join`, {
       method: "POST",
-      headers: this.headers,
+      headers: { ...this.headers, ...getRequestAuthHeader() },
       body: JSON.stringify({ userId, metadata })
     });
     const data = await res.json();
@@ -405,7 +483,7 @@ var RemotePresenceService = class {
   async leave(channel, userId) {
     const res = await fetch(`${this.baseUrl}/api/realtime/presence/${encodeURIComponent(channel)}/leave`, {
       method: "POST",
-      headers: this.headers,
+      headers: { ...this.headers, ...getRequestAuthHeader() },
       body: JSON.stringify({ userId })
     });
     const data = await res.json();
@@ -413,7 +491,7 @@ var RemotePresenceService = class {
   }
   async members(channel) {
     const res = await fetch(`${this.baseUrl}/api/realtime/presence/${encodeURIComponent(channel)}`, {
-      headers: this.headers
+      headers: { ...this.headers, ...getRequestAuthHeader() }
     });
     const data = await res.json();
     return data.members ?? [];
@@ -431,19 +509,19 @@ var RemoteRealtimeService = class {
   async publish(channel, data, options) {
     await fetch(`${this.baseUrl}/api/realtime/publish`, {
       method: "POST",
-      headers: this.headers,
+      headers: { ...this.headers, ...getRequestAuthHeader() },
       body: JSON.stringify({ channel, data, userId: options?.userId })
     });
   }
   async channels() {
     const res = await fetch(`${this.baseUrl}/api/realtime/channels`, {
-      headers: this.headers
+      headers: { ...this.headers, ...getRequestAuthHeader() }
     });
     const data = await res.json();
     return data.channels ?? [];
   }
 };
-var RemoteAuthService = class {
+var RemoteAuthService = class _RemoteAuthService {
   constructor(baseUrl, headers) {
     this.baseUrl = baseUrl;
     this.headers = headers;
@@ -453,7 +531,7 @@ var RemoteAuthService = class {
   async post(path, body) {
     const res = await fetch(`${this.baseUrl}/api/platform/auth${path}`, {
       method: "POST",
-      headers: this.headers,
+      headers: { ...this.headers, ...getRequestAuthHeader() },
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     if (!res.ok) {
@@ -514,6 +592,131 @@ var RemoteAuthService = class {
   async handleOAuthCallback(provider, params) {
     return this.post("/oauth/callback", { provider, code: params.code, state: params.state });
   }
+  // ── Groups ──
+  async createGroup(options) {
+    return this.post("/groups/create", options);
+  }
+  async listGroups() {
+    return this.post("/groups/list", {});
+  }
+  async getGroup(groupId) {
+    return this.post("/groups/get", { group_id: groupId });
+  }
+  async updateGroup(groupId, options) {
+    return this.post("/groups/update", { group_id: groupId, ...options });
+  }
+  async deleteGroup(groupId) {
+    await this.post("/groups/delete", { group_id: groupId });
+  }
+  async addUserToGroup(userId, groupId) {
+    await this.post("/groups/add-user", { user_id: userId, group_id: groupId });
+  }
+  async removeUserFromGroup(userId, groupId) {
+    await this.post("/groups/remove-user", { user_id: userId, group_id: groupId });
+  }
+  async getUserGroups(userId) {
+    return this.post("/groups/get-user-groups", { user_id: userId });
+  }
+  async getGroupMembers(groupId) {
+    return this.post("/groups/get-members", { group_id: groupId });
+  }
+  async getGroupPermissions(groupId) {
+    return this.post("/groups/get-permissions", { group_id: groupId });
+  }
+  async setGroupPermissions(groupId, permissions) {
+    await this.post("/groups/set-permissions", { group_id: groupId, permissions });
+  }
+  // ── Circles ──
+  async createCircle(options) {
+    return this.post("/circles/create", options);
+  }
+  async listCircles() {
+    return this.post("/circles/list", {});
+  }
+  async getCircle(circleId) {
+    return this.post("/circles/get", { circle_id: circleId });
+  }
+  async updateCircle(circleId, options) {
+    return this.post("/circles/update", { circle_id: circleId, ...options });
+  }
+  async deleteCircle(circleId) {
+    await this.post("/circles/delete", { circle_id: circleId });
+  }
+  async addCircleMember(circleId, options) {
+    await this.post("/circles/add-member", { circle_id: circleId, ...options });
+  }
+  async removeCircleMember(circleId, userId) {
+    await this.post("/circles/remove-member", { circle_id: circleId, user_id: userId });
+  }
+  async getCircleMembers(circleId) {
+    return this.post("/circles/get-members", { circle_id: circleId });
+  }
+  async getUserCircles(userId) {
+    return this.post("/circles/get-user-circles", { user_id: userId });
+  }
+  // ── Resources ──
+  async createResource(options) {
+    return this.post("/resources/create", options);
+  }
+  async listResources() {
+    return this.post("/resources/list", {});
+  }
+  async updateResource(resourceId, options) {
+    return this.post("/resources/update", { resource_id: resourceId, ...options });
+  }
+  async deleteResource(resourceId) {
+    await this.post("/resources/delete", { resource_id: resourceId });
+  }
+  // ── Relation types ──
+  async createRelationType(options) {
+    return this.post("/relation-types/create", options);
+  }
+  async listRelationTypes() {
+    return this.post("/relation-types/list", {});
+  }
+  async updateRelationType(id, options) {
+    return this.post("/relation-types/update", { id, ...options });
+  }
+  async deleteRelationType(id) {
+    await this.post("/relation-types/delete", { id });
+  }
+  // ── Profile ──
+  async getProfile(userId) {
+    return this.post("/profile/get", { user_id: userId });
+  }
+  async setProfile(userId, data) {
+    await this.post("/profile/set", { user_id: userId, data });
+  }
+  // ── Auth config ──
+  async getAuthConfig() {
+    return this.post("/config/get", {});
+  }
+  async setAuthConfig(config) {
+    await this.post("/config/set", config);
+  }
+  // ── Stewardship sub-namespace ──
+  stewardship = {
+    resolve: (userId) => this.post("/stewardship/resolve", { user_id: userId }),
+    createOverride: (options) => this.post("/stewardship/create-override", options),
+    revoke: async (id) => {
+      await this.post("/stewardship/revoke", { id });
+    },
+    checkPermission: async (stewardId, wardId, resource, action) => {
+      const r = await this.post("/stewardship/check-permission", {
+        steward_id: stewardId,
+        ward_id: wardId,
+        resource,
+        action
+      });
+      return Boolean(r?.allowed);
+    },
+    createActAs: (stewardId, wardId) => this.post("/stewardship/create-act-as", { steward_id: stewardId, ward_id: wardId }),
+    listAudit: (userId, options = {}) => this.post("/stewardship/list-audit", {
+      user_id: userId,
+      limit: options.limit ?? 50,
+      offset: options.offset ?? 0
+    })
+  };
   withAuth(handler) {
     const self = this;
     return async function(request) {
@@ -546,25 +749,66 @@ var RemoteAuthService = class {
   }
   // ── Request-scoped identity + authorization ──
   //
-  // These APIs operate on per-request state inside the platform runtime and
-  // don't have a remote equivalent. Throw so callers get a clear message
-  // instead of silently wrong behavior.
-  setCurrentUser(_token) {
-    return Promise.reject(new Error(
-      "platform.auth.setCurrentUser is only available inside the Maravilla runtime. Remote clients should pass the Authorization header with each request instead."
-    ));
+  // In dev mode the SDK uses Node's AsyncLocalStorage (via
+  // request-scope.ts) to track per-request state — tenants must wrap
+  // their inbound request handler with `runWithRequest(...)`. Without
+  // that wrapper, set/get/can fall back to clear errors / anonymous
+  // results so the misuse is obvious rather than silent.
+  async setCurrentUser(token) {
+    const { getCurrentRequestStore: getCurrentRequestStore2 } = await Promise.resolve().then(() => (init_request_scope(), request_scope_exports));
+    const store = getCurrentRequestStore2();
+    if (!store) {
+      return;
+    }
+    if (!token) {
+      store.token = void 0;
+      store.user = void 0;
+      return;
+    }
+    store.token = token;
+    store.user = await this.validate(token);
   }
   getCurrentUser() {
-    throw new Error(
-      "platform.auth.getCurrentUser is only available inside the Maravilla runtime. Remote clients have no per-request caller context."
-    );
+    const mod = _RemoteAuthService._requestScope;
+    const store = mod?.getCurrentRequestStore?.();
+    const user = store?.user;
+    if (!user) {
+      return mod?.anonymousCaller?.() ?? {
+        user_id: "",
+        email: "",
+        is_admin: false,
+        roles: [],
+        is_anonymous: true
+      };
+    }
+    return {
+      user_id: user.id,
+      email: user.email,
+      is_admin: false,
+      roles: user.groups ?? [],
+      is_anonymous: false
+    };
   }
-  can(_action, _resourceId, _node) {
-    return Promise.reject(new Error(
-      "platform.auth.can is only available inside the Maravilla runtime. Remote clients cannot evaluate per-request policies because there is no bound caller."
-    ));
+  async can(action, resourceId, node) {
+    const { getCurrentRequestStore: getCurrentRequestStore2 } = await Promise.resolve().then(() => (init_request_scope(), request_scope_exports));
+    const store = getCurrentRequestStore2();
+    const token = store?.token;
+    if (!token) {
+      return false;
+    }
+    const r = await this.post("/can", {
+      token,
+      action,
+      resource_id: resourceId,
+      node: node ?? null
+    });
+    return Boolean(r?.allowed);
   }
 };
+Promise.resolve().then(() => (init_request_scope(), request_scope_exports)).then((mod) => {
+  RemoteAuthService._requestScope = mod;
+}).catch(() => {
+});
 var RemotePolicyService = class {
   setEnabled(_enabled) {
     throw new Error(
@@ -587,7 +831,7 @@ var RemoteWorkflows = class {
   async request(path, options = {}) {
     const response = await fetch(`${this.baseUrl}${path}`, {
       ...options,
-      headers: { ...this.headers, ...options.headers }
+      headers: { ...this.headers, ...getRequestAuthHeader(), ...options.headers }
     });
     if (!response.ok && response.status !== 404) {
       const error = await response.text();
@@ -1598,6 +1842,7 @@ var transforms = {
 };
 
 // src/index.ts
+init_request_scope();
 var cachedPlatform = void 0;
 function getPlatform(options) {
   if (cachedPlatform) {
@@ -1640,12 +1885,14 @@ export {
   attachTrack,
   clearPlatformCache,
   detachTrack,
+  getCurrentRequestStore,
   getOrCreateClientId,
   getPlatform,
   keyFor,
   offsetBefore,
   registerPush,
   renFetch,
+  runWithRequest,
   storageDelete,
   storageUpload,
   transforms,