@objectstack/runtime 3.2.0 → 3.2.2

package/src/http-dispatcher.ts

@@ -3,6 +3,18 @@
 import { ObjectKernel, getEnv } from '@objectstack/core';
 import { CoreServiceName } from '@objectstack/spec/system';
 
+/** Browser-safe UUID generator — prefers Web Crypto, falls back to RFC 4122 v4 */
+function randomUUID(): string {
+    if (globalThis.crypto && typeof globalThis.crypto.randomUUID === 'function') {
+        return globalThis.crypto.randomUUID();
+    }
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+        const r = (Math.random() * 16) | 0;
+        const v = c === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}
+
 export interface HttpProtocolContext {
     request: any;
     response?: any;
@@ -179,12 +191,80 @@ export class HttpDispatcher {
             return { handled: true, result: response };
         }
 
-        // 2. Legacy Login
+        // 2. Legacy Login via broker
         const normalizedPath = path.replace(/^\/+/, '');
         if (normalizedPath === 'login' && method.toUpperCase() === 'POST') {
-             const broker = this.ensureBroker();
-             const data = await broker.call('auth.login', body, { request: context.request });
-             return { handled: true, response: { status: 200, body: data } };
+            try {
+                const broker = this.ensureBroker();
+                const data = await broker.call('auth.login', body, { request: context.request });
+                return { handled: true, response: { status: 200, body: data } };
+            } catch (error: any) {
+                // Only fall through to mock when the broker is truly unavailable
+                // (ensureBroker throws statusCode 500 when kernel.broker is null)
+                const statusCode = error?.statusCode ?? error?.status;
+                if (statusCode !== 500 || !error?.message?.includes('Broker not available')) {
+                    throw error;
+                }
+            }
+        }
+
+        // 3. Mock fallback for MSW/test environments when no auth service is registered
+        return this.mockAuthFallback(normalizedPath, method, body);
+    }
+
+    /**
+     * Provides mock auth responses for core better-auth endpoints when
+     * AuthPlugin is not loaded (e.g. MSW/browser-only environments).
+     * This ensures registration/sign-in flows do not 404 in mock mode.
+     */
+    private mockAuthFallback(path: string, method: string, body: any): HttpDispatcherResult {
+        const m = method.toUpperCase();
+        const MOCK_SESSION_EXPIRY_MS = 86_400_000; // 24 hours
+
+        // POST sign-up/email
+        if ((path === 'sign-up/email' || path === 'register') && m === 'POST') {
+            const id = `mock_${randomUUID()}`;
+            return {
+                handled: true,
+                response: {
+                    status: 200,
+                    body: {
+                        user: { id, name: body?.name || 'Mock User', email: body?.email || 'mock@test.local', emailVerified: false, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() },
+                        session: { id: `session_${id}`, userId: id, token: `mock_token_${id}`, expiresAt: new Date(Date.now() + MOCK_SESSION_EXPIRY_MS).toISOString() },
+                    },
+                },
+            };
+        }
+
+        // POST sign-in/email or login
+        if ((path === 'sign-in/email' || path === 'login') && m === 'POST') {
+            const id = `mock_${randomUUID()}`;
+            return {
+                handled: true,
+                response: {
+                    status: 200,
+                    body: {
+                        user: { id, name: 'Mock User', email: body?.email || 'mock@test.local', emailVerified: true, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() },
+                        session: { id: `session_${id}`, userId: id, token: `mock_token_${id}`, expiresAt: new Date(Date.now() + MOCK_SESSION_EXPIRY_MS).toISOString() },
+                    },
+                },
+            };
+        }
+
+        // GET get-session
+        if (path === 'get-session' && m === 'GET') {
+            return {
+                handled: true,
+                response: { status: 200, body: { session: null, user: null } },
+            };
+        }
+
+        // POST sign-out
+        if (path === 'sign-out' && m === 'POST') {
+            return {
+                handled: true,
+                response: { status: 200, body: { success: true } },
+            };
         }
 
         return { handled: false };
@@ -202,7 +282,7 @@ export class HttpDispatcher {
         // GET /metadata/types
         if (parts[0] === 'types') {
             // Try protocol service for dynamic types
-            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
+            const protocol = await this.resolveService('protocol');
             if (protocol && typeof protocol.getMetaTypes === 'function') {
                 const result = await protocol.getMetaTypes({});
                 return { handled: true, response: this.success(result) };
@@ -242,7 +322,7 @@ export class HttpDispatcher {
             // PUT /metadata/:type/:name (Save)
             if (method === 'PUT' && body) {
                 // Try to get the protocol service directly
-                const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
+                const protocol = await this.resolveService('protocol');
                 
                 if (protocol && typeof protocol.saveMetaItem === 'function') {
                     try {
@@ -275,7 +355,7 @@ export class HttpDispatcher {
                 const singularType = type.endsWith('s') ? type.slice(0, -1) : type;
                 
                 // Try Protocol Service First (Preferred)
-                const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
+                const protocol = await this.resolveService('protocol');
                 if (protocol && typeof protocol.getMetaItem === 'function') {
                      try {
                         const data = await protocol.getMetaItem({ type: singularType, name });
@@ -304,7 +384,7 @@ export class HttpDispatcher {
             const packageId = query?.package || undefined;
             
             // Try protocol service first for any type
-            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
+            const protocol = await this.resolveService('protocol');
             if (protocol && typeof protocol.getMetaItems === 'function') {
                 try {
                     const data = await protocol.getMetaItems({ type: typeOrName, packageId });
@@ -343,7 +423,7 @@ export class HttpDispatcher {
         // GET /metadata — return available metadata types
         if (parts.length === 0) {
             // Try protocol service for dynamic types
-            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
+            const protocol = await this.resolveService('protocol');
             if (protocol && typeof protocol.getMetaTypes === 'function') {
                 const result = await protocol.getMetaTypes({});
                 return { handled: true, response: this.success(result) };
@@ -446,7 +526,7 @@ export class HttpDispatcher {
      * Handles Analytics requests
      * path: sub-path after /analytics/
      */
-    async handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult> {
+    async handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {
         const analyticsService = await this.getService(CoreServiceName.enum.analytics);
         if (!analyticsService) return { handled: false }; // 404 handled by caller if unhandled
 
@@ -455,26 +535,84 @@ export class HttpDispatcher {
 
         // POST /analytics/query
         if (subPath === 'query' && m === 'POST') {
-            const result = await analyticsService.query(body, { request: context.request });
+            const result = await analyticsService.query(body);
             return { handled: true, response: this.success(result) };
         }
 
         // GET /analytics/meta
         if (subPath === 'meta' && m === 'GET') {
-            const result = await analyticsService.getMetadata({ request: context.request });
+            const result = await analyticsService.getMeta();
              return { handled: true, response: this.success(result) };
         }
 
         // POST /analytics/sql (Dry-run or debug)
         if (subPath === 'sql' && m === 'POST') {
              // Assuming service has generateSql method
-             const result = await analyticsService.generateSql(body, { request: context.request });
+             const result = await analyticsService.generateSql(body);
              return { handled: true, response: this.success(result) };
         }
 
         return { handled: false };
     }
 
+    /**
+     * Handles i18n requests
+     * path: sub-path after /i18n/
+     *
+     * Routes:
+     *   GET /locales                    → getLocales
+     *   GET /translations/:locale       → getTranslations (locale from path)
+     *   GET /translations?locale=xx     → getTranslations (locale from query)
+     *   GET /labels/:object/:locale     → getFieldLabels  (both from path)
+     *   GET /labels/:object?locale=xx   → getFieldLabels  (locale from query)
+     */
+    async handleI18n(path: string, method: string, query: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult> {
+        const i18nService = await this.getService(CoreServiceName.enum.i18n);
+        if (!i18nService) return { handled: true, response: this.error('i18n service not available', 501) };
+
+        const m = method.toUpperCase();
+        const parts = path.replace(/^\/+/, '').split('/').filter(Boolean);
+
+        if (m !== 'GET') return { handled: false };
+
+        // GET /i18n/locales
+        if (parts[0] === 'locales' && parts.length === 1) {
+            const locales = i18nService.getLocales();
+            return { handled: true, response: this.success({ locales }) };
+        }
+
+        // GET /i18n/translations/:locale  OR  /i18n/translations?locale=xx
+        if (parts[0] === 'translations') {
+            const locale = parts[1] ? decodeURIComponent(parts[1]) : query?.locale;
+            if (!locale) return { handled: true, response: this.error('Missing locale parameter', 400) };
+            const translations = i18nService.getTranslations(locale);
+            return { handled: true, response: this.success({ locale, translations }) };
+        }
+
+        // GET /i18n/labels/:object/:locale  OR  /i18n/labels/:object?locale=xx
+        if (parts[0] === 'labels' && parts.length >= 2) {
+            const objectName = decodeURIComponent(parts[1]);
+            const locale = parts[2] ? decodeURIComponent(parts[2]) : query?.locale;
+            if (!locale) return { handled: true, response: this.error('Missing locale parameter', 400) };
+            if (typeof i18nService.getFieldLabels === 'function') {
+                const labels = i18nService.getFieldLabels(objectName, locale);
+                return { handled: true, response: this.success({ object: objectName, locale, labels }) };
+            }
+            // Fallback: derive field labels from full translation bundle
+            const translations = i18nService.getTranslations(locale);
+            const prefix = `o.${objectName}.fields.`;
+            const labels: Record<string, string> = {};
+            for (const [key, value] of Object.entries(translations)) {
+                if (key.startsWith(prefix)) {
+                    labels[key.substring(prefix.length)] = value as string;
+                }
+            }
+            return { handled: true, response: this.success({ object: objectName, locale, labels }) };
+        }
+
+        return { handled: false };
+    }
+
     /**
      * Handles Package Management requests
      * 
@@ -708,7 +846,7 @@ export class HttpDispatcher {
             // Support both path param /view/obj/list AND query param /view/obj?type=list
             const type = parts[2] || query?.type || 'list';
 
-            const protocol = this.kernel?.context?.getService ? await this.kernel.context.getService('protocol') : null;
+            const protocol = await this.resolveService('protocol');
             
             if (protocol && typeof protocol.getUiView === 'function') {
                 try {
@@ -852,35 +990,54 @@ export class HttpDispatcher {
     }
 
     private async getService(name: CoreServiceName) {
-        if (typeof this.kernel.getService === 'function') {
-            return await this.kernel.getService(name);
-        }
-        const services = this.getServicesMap();
-        return services[name];
+        return this.resolveService(name);
     }
 
     /**
-     * Get the ObjectQL service which provides access to SchemaRegistry.
-     * Tries multiple access patterns since kernel structure varies.
+     * Resolve any service by name, supporting async factories.
+     * Fallback chain: getServiceAsync → getService (sync) → context.getService → services map.
+     * Only returns when a non-null service is found; otherwise falls through to the next step.
      */
-    private async getObjectQLService(): Promise<any> {
-        // 1. Try via kernel.getService
+    private async resolveService(name: string) {
+        // Prefer async resolution to support factory-based services (e.g. auth, analytics, protocol)
+        if (typeof this.kernel.getServiceAsync === 'function') {
+            try {
+                const svc = await this.kernel.getServiceAsync(name);
+                if (svc != null) return svc;
+            } catch {
+                // Service not registered or async resolution failed — fall through
+            }
+        }
         if (typeof this.kernel.getService === 'function') {
             try {
-                const svc = await this.kernel.getService('objectql');
-                if (svc?.registry) return svc;
-            } catch { /* ignore */ }
+                const svc = await this.kernel.getService(name);
+                if (svc != null) return svc;
+            } catch {
+                // Service not registered or sync resolution threw "is async" — fall through
+            }
         }
-        // 2. Try via kernel context
         if (this.kernel?.context?.getService) {
             try {
-                const svc = await this.kernel.context.getService('objectql');
-                if (svc?.registry) return svc;
-            } catch { /* ignore */ }
+                const svc = await this.kernel.context.getService(name);
+                if (svc != null) return svc;
+            } catch {
+                // Service not registered — fall through
+            }
         }
-        // 3. Try via services map
         const services = this.getServicesMap();
-        if (services['objectql']?.registry) return services['objectql'];
+        return services[name];
+    }
+
+    /**
+     * Get the ObjectQL service which provides access to SchemaRegistry.
+     * Tries multiple access patterns since kernel structure varies.
+     */
+    private async getObjectQLService(): Promise<any> {
+        // 1. Try via resolveService (handles async factories, sync, context, and map)
+        try {
+            const svc = await this.resolveService('objectql');
+            if (svc?.registry) return svc;
+        } catch { /* service not available */ }
         return null;
     }
 
@@ -944,6 +1101,10 @@ export class HttpDispatcher {
              return this.handlePackages(cleanPath.substring(9), method, body, query, context);
         }
 
+        if (cleanPath.startsWith('/i18n')) {
+             return this.handleI18n(cleanPath.substring(5), method, query, context);
+        }
+
         // OpenAPI Specification
         if (cleanPath === '/openapi.json' && method === 'GET') {
              const broker = this.ensureBroker();