@qwickapps/server 1.3.1 → 1.5.0

package/src/plugins/auth/index.ts

@@ -16,7 +16,20 @@ export {
 } from './auth-plugin.js';
 
 // Environment-based configuration
-export { createAuthPluginFromEnv, getAuthStatus } from './env-config.js';
+export {
+  createAuthPluginFromEnv,
+  getAuthStatus,
+  setAuthConfigStore,
+  getAdapterWrapper,
+} from './env-config.js';
+export type { AuthEnvPluginOptionsExtended } from './env-config.js';
+
+// Config store
+export { postgresAuthConfigStore } from './config-store.js';
+
+// Adapter wrapper
+export { createAdapterWrapper } from './adapter-wrapper.js';
+export type { AdapterWrapper } from './adapter-wrapper.js';
 
 // Types
 export type {
@@ -32,6 +45,14 @@ export type {
   AuthPluginState,
   AuthEnvPluginOptions,
   AuthConfigStatus,
+  // Runtime config types
+  AuthAdapterType,
+  RuntimeAuthConfig,
+  UpdateAuthConfigRequest,
+  TestProviderRequest,
+  TestProviderResponse,
+  AuthConfigStore,
+  PostgresAuthConfigStoreConfig,
 } from './types.js';
 export { isAuthenticatedRequest } from './types.js';
 

package/src/plugins/auth/types.ts

@@ -243,3 +243,141 @@ export interface AuthConfigStatus {
   /** Current configuration with secrets masked */
   config?: Record<string, string>;
 }
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Runtime Configuration Types
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Supported adapter types for runtime configuration
+ */
+export type AuthAdapterType = 'auth0' | 'supabase' | 'supertokens' | 'basic';
+
+/**
+ * Runtime auth configuration (persisted to database)
+ */
+export interface RuntimeAuthConfig {
+  /** Which adapter to use */
+  adapter: AuthAdapterType | null;
+
+  /** Adapter-specific configuration */
+  config: {
+    auth0?: Auth0AdapterConfig;
+    supabase?: SupabaseAdapterConfig;
+    supertokens?: SupertokensAdapterConfig;
+    basic?: BasicAdapterConfig;
+  };
+
+  /** General auth settings */
+  settings: {
+    authRequired?: boolean;
+    excludePaths?: string[];
+    debug?: boolean;
+  };
+
+  /** When the config was last updated */
+  updatedAt: string;
+
+  /** Who updated the config (optional) */
+  updatedBy?: string;
+}
+
+/**
+ * Request body for PUT /api/auth/config
+ */
+export interface UpdateAuthConfigRequest {
+  /** Which adapter to use */
+  adapter: AuthAdapterType;
+
+  /** Adapter-specific configuration */
+  config: Record<string, unknown>;
+
+  /** General settings (optional) */
+  settings?: {
+    authRequired?: boolean;
+    excludePaths?: string[];
+  };
+}
+
+/**
+ * Request body for POST /api/auth/test-provider
+ */
+export interface TestProviderRequest {
+  /** Which adapter to test */
+  adapter: AuthAdapterType;
+
+  /** Adapter configuration to test */
+  config: Record<string, unknown>;
+
+  /** For social provider test (optional) */
+  provider?: 'google' | 'github' | 'apple';
+}
+
+/**
+ * Response for POST /api/auth/test-provider
+ */
+export interface TestProviderResponse {
+  /** Whether the test was successful */
+  success: boolean;
+
+  /** Human-readable message */
+  message: string;
+
+  /** Additional details */
+  details?: {
+    latency?: number;
+    version?: string;
+  };
+}
+
+/**
+ * Auth configuration store interface
+ */
+export interface AuthConfigStore {
+  /** Store name for identification */
+  name: string;
+
+  /** Initialize the store (create tables if needed) */
+  initialize(): Promise<void>;
+
+  /** Load configuration from store */
+  load(): Promise<RuntimeAuthConfig | null>;
+
+  /** Save configuration to store */
+  save(config: RuntimeAuthConfig): Promise<void>;
+
+  /** Delete configuration (revert to env vars) */
+  delete(): Promise<boolean>;
+
+  /**
+   * Subscribe to configuration changes
+   * Returns unsubscribe function
+   */
+  onChange(callback: (config: RuntimeAuthConfig | null) => void): () => void;
+
+  /** Shutdown and cleanup */
+  shutdown(): Promise<void>;
+}
+
+/**
+ * PostgreSQL auth config store configuration
+ */
+export interface PostgresAuthConfigStoreConfig {
+  /** PostgreSQL pool instance or factory function for lazy initialization */
+  pool: unknown | (() => unknown);
+
+  /** Table name (default: 'auth_config') */
+  tableName?: string;
+
+  /** Schema name (default: 'public') */
+  schema?: string;
+
+  /** Auto-create table on initialization (default: true) */
+  autoCreateTable?: boolean;
+
+  /** Enable pg_notify for cross-instance config updates (default: true) */
+  enableNotify?: boolean;
+
+  /** Channel name for pg_notify (default: 'auth_config_changed') */
+  notifyChannel?: string;
+}

package/src/plugins/bans/bans-plugin.ts

@@ -21,7 +21,7 @@ import type {
   RemoveBanInput,
 } from './types.js';
 import type { AuthenticatedRequest } from '../auth/types.js';
-import { getUserByEmail, getUserById } from '../users/users-plugin.js';
+import { getUserByEmail, getUserById, getUsersByIds } from '../users/users-plugin.js';
 
 // Store instance for helper access
 let currentStore: BanStore | null = null;
@@ -95,7 +95,7 @@ export function createBansPlugin(config: BansPluginConfig): Plugin {
 
       // Add API routes if enabled
       if (apiEnabled) {
-        // List active bans
+        // List active bans (enriched with user email)
         registry.addRoute({
           method: 'get',
           path: apiPrefix,
@@ -106,7 +106,19 @@ export function createBansPlugin(config: BansPluginConfig): Plugin {
               const offset = parseInt(req.query.offset as string) || 0;
 
               const result = await config.store.listActiveBans({ limit, offset });
-              res.json(result);
+
+              // Batch fetch users for all bans (single query instead of N queries)
+              const userIds = [...new Set(result.bans.map((ban) => ban.user_id))];
+              const users = await getUsersByIds(userIds);
+              const userMap = new Map(users.map((u) => [u.id, u]));
+
+              // Enrich bans with user email
+              const enrichedBans = result.bans.map((ban) => ({
+                ...ban,
+                email: userMap.get(ban.user_id)?.email || 'Unknown',
+              }));
+
+              res.json({ bans: enrichedBans, total: result.total });
             } catch (error) {
               console.error('[BansPlugin] List bans error:', error);
               res.status(500).json({ error: 'Failed to list bans' });