@maudecode/kanvil 0.2.1 → 0.4.0

package/apps/server/dist/instance-CCeXRJ6m.mjs

@@ -0,0 +1,133 @@
+import { z } from "zod";
+//#region ../../packages/contracts/src/instance.ts
+const endpoint = z.url({ protocol: /^https?$/ }).refine((value) => !/^https?:\/\/[^/]*@/.test(value) && !/[?#]/.test(value), "Use an HTTP(S) endpoint without embedded credentials");
+const s3SettingsSchema = z.object({
+	endpoint: z.union([endpoint, z.literal("")]).default(""),
+	region: z.string().min(1).max(100).default("us-east-1"),
+	bucket: z.string().min(3).max(255),
+	prefix: z.string().max(200).regex(/^[a-zA-Z0-9/_-]*$/).default("kanvil/"),
+	forcePathStyle: z.boolean().default(true),
+	accessKeyId: z.string().max(500).default(""),
+	secretAccessKey: z.string().max(2e3).optional()
+}).strict();
+const searchAuthenticationSchema = z.enum([
+	"none",
+	"apiKey",
+	"basic"
+]);
+const searchSettingsSchema = z.object({
+	url: endpoint,
+	auth: searchAuthenticationSchema.optional(),
+	index: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,100}$/),
+	apiKey: z.string().max(4e3).optional(),
+	username: z.string().max(500).default(""),
+	password: z.string().max(2e3).optional()
+}).strict();
+const storageSettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("local") }).strict(), s3SettingsSchema.extend({ provider: z.literal("s3") })]);
+const externalSearchSettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("postgres") }).strict(), searchSettingsSchema.extend({ provider: z.literal("elasticsearch") })]);
+const brokerSettingsSchema = z.object({
+	url: z.url({ protocol: /^amqps?$/ }).max(4e3).optional(),
+	exchange: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.-]+$/).refine((value) => !value.startsWith("amq."), "Use an application exchange").default("kanvil.events")
+}).strict();
+const eventDeliverySettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("postgres") }).strict(), brokerSettingsSchema.extend({ provider: z.literal("rabbitmq") })]);
+const authenticationPolicySchema = z.object({
+	emailPasswordEnabled: z.boolean().default(true),
+	ssoAutoProvision: z.boolean().default(false)
+}).strict();
+const instanceUpdateSchema = z.object({
+	expectedVersion: z.number().int().positive(),
+	name: z.string().trim().min(1).max(100),
+	description: z.string().max(500),
+	storage: storageSettingsSchema,
+	search: externalSearchSettingsSchema,
+	broker: eventDeliverySettingsSchema.optional(),
+	authentication: authenticationPolicySchema.optional()
+}).strict();
+z.object({
+	name: z.string(),
+	description: z.string()
+});
+const adminInstanceSchema = z.object({
+	id: z.uuid(),
+	version: z.number().int(),
+	name: z.string(),
+	description: z.string(),
+	authentication: authenticationPolicySchema.default(() => authenticationPolicySchema.parse({})),
+	storage: z.object({
+		provider: z.enum(["local", "s3"]),
+		source: z.enum(["deployment", "admin"]),
+		settings: s3SettingsSchema.omit({ secretAccessKey: true }).nullable(),
+		secretConfigured: z.boolean(),
+		pending: z.number().int(),
+		status: z.enum([
+			"ready",
+			"transferring",
+			"unavailable"
+		]),
+		error: z.string().nullable()
+	}),
+	search: z.object({
+		provider: z.enum(["postgres", "elasticsearch"]),
+		source: z.enum(["deployment", "admin"]),
+		settings: searchSettingsSchema.omit({
+			apiKey: true,
+			password: true
+		}).nullable(),
+		secretConfigured: z.boolean(),
+		status: z.enum([
+			"builtin",
+			"indexing",
+			"ready",
+			"unavailable"
+		]),
+		cursor: z.string(),
+		error: z.string().nullable()
+	}),
+	broker: z.object({
+		provider: z.enum(["postgres", "rabbitmq"]),
+		source: z.enum(["deployment", "admin"]),
+		settings: z.object({
+			endpoint: z.string(),
+			exchange: z.string()
+		}).nullable(),
+		secretConfigured: z.boolean(),
+		status: z.enum([
+			"builtin",
+			"connecting",
+			"ready",
+			"unavailable"
+		]),
+		error: z.string().nullable()
+	}),
+	deployment: z.object({
+		url: z.string(),
+		oidc: z.object({
+			name: z.string(),
+			discoveryUrl: z.string(),
+			clientId: z.string()
+		}).nullable(),
+		push: z.boolean(),
+		version: z.string()
+	}),
+	locations: z.array(z.object({
+		id: z.uuid(),
+		bucket: z.string(),
+		endpoint: z.string(),
+		prefix: z.string(),
+		objects: z.number().int()
+	}))
+});
+const photoInputSchema = z.object({
+	data: z.string().max(7e5),
+	contentType: z.enum([
+		"image/png",
+		"image/jpeg",
+		"image/webp"
+	])
+}).strict();
+const photoResultSchema = z.object({ image: z.string().nullable() });
+function searchAuthentication(settings) {
+	return settings.auth ?? (settings.apiKey ? "apiKey" : settings.username && settings.password ? "basic" : "none");
+}
+//#endregion
+export { photoInputSchema as a, searchAuthentication as c, instanceUpdateSchema as i, searchSettingsSchema as l, authenticationPolicySchema as n, photoResultSchema as o, brokerSettingsSchema as r, s3SettingsSchema as s, adminInstanceSchema as t };

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { d as createDatabase, t as readConfig } from "./config-CbNqtJEj.mjs";
+import { n as createDatabase, t as readConfig } from "./config-DtNfVSnB.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig().DATABASE_URL);

package/apps/server/dist/recover.mjs

@@ -1,6 +1,7 @@
-import { d as createDatabase, f as account, g as user, h as session, t as readConfig } from "./config-CbNqtJEj.mjs";
-import { C as instanceSettings, R as hasAdminRole, a as fail, t as createAuth } from "./auth-I1XEr0d4.mjs";
-import { and, eq, sql } from "drizzle-orm";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DtNfVSnB.mjs";
+import { W as instanceSettings, f as fail, t as createAuth } from "./auth-Cuo7ECLh.mjs";
+import { O as hasAdminRole } from "./src-tQ82UI8k.mjs";
+import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import passwordPrompt from "@inquirer/password";
@@ -13,7 +14,7 @@ async function recoverLocalPassword(database, config, email, password, enablePas
 	const hash = await (await createAuth(database, config).$context).password.hash(password);
 	return database.db.transaction(async (tx) => {
 		await tx.execute(sql`SELECT pg_advisory_xact_lock(7361083)`);
-		const identity = (await tx.select().from(user).where(eq(user.email, normalizedEmail)).for("update"))[0];
+		const identity = (await tx.select().from(user).where(and(eq(user.email, normalizedEmail), isNull(user.deletedAt))).for("update"))[0];
 		if (!identity) fail(404, "not_found", "No account has this email address");
 		if (enablePasswordSignIn) {
 			if (!hasAdminRole(identity.role) || identity.banned) fail(403, "forbidden", "Recover an active administrator to enable password sign-in");