@rangka/core 0.0.1

package/src/auth/__tests__/scope-registry.test.ts

@@ -0,0 +1,297 @@
+import { describe, it, expect } from 'vitest';
+import { ScopeRegistry, ScopeResolutionError } from '../scope-registry.js';
+import { SchemaRegistry } from '../../schema/registry.js';
+import type { ResolvedModel } from '../../schema/types.js';
+import type { ModuleConfig } from '@rangka/shared';
+
+function makeModel(overrides: Partial<ResolvedModel> & { qualifiedName: string }): ResolvedModel {
+  return {
+    app: overrides.module ?? 'test',
+    module: overrides.module ?? 'test',
+    name: overrides.qualifiedName.split('.')[1],
+    auditLog: false,
+    traits: [],
+    fields: [],
+    indexes: [],
+    ...overrides,
+  };
+}
+
+function linkField(name: string, model: string) {
+  return {
+    name,
+    config: { type: 'link' as const, model },
+    provenance: { source: 'base' as const },
+  };
+}
+
+describe('ScopeRegistry', () => {
+  describe('scope registration', () => {
+    it('registers scopes from modules', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: {
+            company: { model: 'core.company', default: 'user.default_company', switchable: true },
+          },
+        },
+      ];
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core', fields: [] }),
+      ]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+
+      const scope = scopeRegistry.getScope('company');
+      expect(scope).toBeDefined();
+      expect(scope!.name).toBe('company');
+      expect(scope!.definition.model).toBe('core.company');
+      expect(scope!.module).toBe('core');
+    });
+
+    it('registers multiple scopes from different modules', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: {
+            company: { model: 'core.company', default: 'user.default_company' },
+          },
+        },
+        {
+          name: 'cms',
+          label: 'CMS',
+          scopes: {
+            workspace: { model: 'cms.workspace', default: 'user.default_workspace' },
+          },
+        },
+      ];
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        makeModel({ qualifiedName: 'cms.workspace', module: 'cms' }),
+      ]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+
+      expect(scopeRegistry.getAllScopes()).toHaveLength(2);
+      expect(scopeRegistry.getScope('company')).toBeDefined();
+      expect(scopeRegistry.getScope('workspace')).toBeDefined();
+    });
+
+    it('throws on duplicate scope name across modules', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+        {
+          name: 'sales',
+          label: 'Sales',
+          scopes: { company: { model: 'sales.company', default: 'user.company' } },
+        },
+      ];
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        makeModel({ qualifiedName: 'sales.company', module: 'sales' }),
+      ]);
+
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(ScopeResolutionError);
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(
+        /Scope "company" declared by module "sales" conflicts/,
+      );
+    });
+
+    it('handles modules without scopes', () => {
+      const modules: ModuleConfig[] = [
+        { name: 'core', label: 'Core' },
+        { name: 'sales', label: 'Sales' },
+      ];
+      const schemaRegistry = new SchemaRegistry([]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+      expect(scopeRegistry.getAllScopes()).toHaveLength(0);
+    });
+  });
+
+  describe('model binding resolution', () => {
+    it('resolves scope column from link field targeting scope model', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+      ];
+      const invoiceModel = makeModel({
+        qualifiedName: 'sales.invoice',
+        module: 'sales',
+        scope: 'company',
+        fields: [linkField('company', 'core.company'), linkField('customer', 'sales.customer')],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        makeModel({ qualifiedName: 'sales.customer', module: 'sales' }),
+        invoiceModel,
+      ]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+
+      const binding = scopeRegistry.getModelBinding('sales.invoice');
+      expect(binding).toBeDefined();
+      expect(binding!.scopeName).toBe('company');
+      expect(binding!.column).toBe('company');
+      expect(binding!.scopeModel).toBe('core.company');
+    });
+
+    it('returns undefined for models without scope', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+      ];
+      const customerModel = makeModel({
+        qualifiedName: 'sales.customer',
+        module: 'sales',
+        fields: [linkField('company', 'core.company')],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        customerModel,
+      ]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+      expect(scopeRegistry.getModelBinding('sales.customer')).toBeUndefined();
+      expect(scopeRegistry.isModelScoped('sales.customer')).toBe(false);
+    });
+
+    it('isModelScoped returns true for scoped models', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+      ];
+      const invoiceModel = makeModel({
+        qualifiedName: 'sales.invoice',
+        module: 'sales',
+        scope: 'company',
+        fields: [linkField('company', 'core.company')],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        invoiceModel,
+      ]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+      expect(scopeRegistry.isModelScoped('sales.invoice')).toBe(true);
+    });
+
+    it('throws when model references undefined scope', () => {
+      const modules: ModuleConfig[] = [{ name: 'core', label: 'Core' }];
+      const invoiceModel = makeModel({
+        qualifiedName: 'sales.invoice',
+        module: 'sales',
+        scope: 'company',
+        fields: [linkField('company', 'core.company')],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        invoiceModel,
+      ]);
+
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(ScopeResolutionError);
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(
+        /references scope "company" which is not defined/,
+      );
+    });
+
+    it('throws when model has no link field to scope model', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+      ];
+      const invoiceModel = makeModel({
+        qualifiedName: 'sales.invoice',
+        module: 'sales',
+        scope: 'company',
+        fields: [
+          { name: 'total', config: { type: 'number' } as any, provenance: { source: 'base' } },
+        ],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        invoiceModel,
+      ]);
+
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(ScopeResolutionError);
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(
+        /has no link field to "core.company"/,
+      );
+    });
+
+    it('throws when model has multiple link fields to scope model without explicit field', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+      ];
+      const transferModel = makeModel({
+        qualifiedName: 'accounting.transfer',
+        module: 'accounting',
+        scope: 'company',
+        fields: [
+          linkField('source_company', 'core.company'),
+          linkField('target_company', 'core.company'),
+        ],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        transferModel,
+      ]);
+
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(ScopeResolutionError);
+      expect(() => new ScopeRegistry(modules, schemaRegistry)).toThrow(
+        /multiple link fields.*source_company, target_company/,
+      );
+    });
+
+    it('uses explicit field override when model has multiple links', () => {
+      const modules: ModuleConfig[] = [
+        {
+          name: 'core',
+          label: 'Core',
+          scopes: { company: { model: 'core.company', default: 'user.default_company' } },
+        },
+      ];
+      const transferModel = makeModel({
+        qualifiedName: 'accounting.transfer',
+        module: 'accounting',
+        scope: { name: 'company', field: 'source_company' },
+        fields: [
+          linkField('source_company', 'core.company'),
+          linkField('target_company', 'core.company'),
+        ],
+      });
+      const schemaRegistry = new SchemaRegistry([
+        makeModel({ qualifiedName: 'core.company', module: 'core' }),
+        transferModel,
+      ]);
+
+      const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+      const binding = scopeRegistry.getModelBinding('accounting.transfer');
+      expect(binding).toBeDefined();
+      expect(binding!.column).toBe('source_company');
+      expect(binding!.scopeName).toBe('company');
+    });
+  });
+});

package/src/auth/__tests__/scopes.test.ts

@@ -0,0 +1,66 @@
+import { describe, it, expect } from 'vitest';
+import { applyScopeFiltersToQuery } from '../scopes.js';
+
+describe('scope system', () => {
+  describe('applyScopeFiltersToQuery', () => {
+    it('applies eq filters to query', () => {
+      const wheres: Array<[string, string, unknown]> = [];
+      const fakeQuery = {
+        where(field: string, op: string, value: unknown) {
+          wheres.push([field, op, value]);
+          return fakeQuery;
+        },
+      };
+
+      const result = applyScopeFiltersToQuery(fakeQuery, [
+        { field: 'company', operator: 'eq', value: 'C-001' },
+      ]);
+
+      expect(wheres).toEqual([['company', '=', 'C-001']]);
+      expect(result).toBe(fakeQuery);
+    });
+
+    it('applies in filters to query', () => {
+      const wheres: Array<[string, string, unknown]> = [];
+      const fakeQuery = {
+        where(field: string, op: string, value: unknown) {
+          wheres.push([field, op, value]);
+          return fakeQuery;
+        },
+      };
+
+      const result = applyScopeFiltersToQuery(fakeQuery, [
+        { field: 'territory', operator: 'in', value: ['North', 'East'] },
+      ]);
+
+      expect(wheres).toEqual([['territory', 'in', ['North', 'East']]]);
+      expect(result).toBe(fakeQuery);
+    });
+
+    it('applies multiple filters sequentially', () => {
+      const wheres: Array<[string, string, unknown]> = [];
+      const fakeQuery = {
+        where(field: string, op: string, value: unknown) {
+          wheres.push([field, op, value]);
+          return fakeQuery;
+        },
+      };
+
+      applyScopeFiltersToQuery(fakeQuery, [
+        { field: 'company', operator: 'eq', value: 'C-001' },
+        { field: 'territory', operator: 'in', value: ['North'] },
+      ]);
+
+      expect(wheres).toEqual([
+        ['company', '=', 'C-001'],
+        ['territory', 'in', ['North']],
+      ]);
+    });
+
+    it('returns query unchanged when no filters', () => {
+      const fakeQuery = { where: () => fakeQuery };
+      const result = applyScopeFiltersToQuery(fakeQuery, []);
+      expect(result).toBe(fakeQuery);
+    });
+  });
+});

package/src/auth/__tests__/session.test.ts

@@ -0,0 +1,214 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { PermissionRegistry } from '../permission-registry.js';
+import { createAuthHook, createSessionHandler, generateToken } from '../session.js';
+import { hashPassword } from '../password.js';
+import { createTestServer } from '../../__tests__/helpers.js';
+
+function createMockDb(data: { users: any[]; sessions: any[]; userRoles: any[]; roles: any[] }) {
+  return {
+    selectFrom(table: string) {
+      return {
+        selectAll() {
+          return this;
+        },
+        select(..._args: any[]) {
+          return this;
+        },
+        where(field: string, op: string, value: any) {
+          const store =
+            table === 'core.session'
+              ? data.sessions
+              : table === 'core.user'
+                ? data.users
+                : table === 'core.user_role'
+                  ? data.userRoles
+                  : data.roles;
+
+          const filtered = store.filter((r: any) => {
+            if (op === '=') return r[field] === value;
+            if (op === 'in') return value.includes(r[field]);
+            return false;
+          });
+          return {
+            executeTakeFirst: async () => filtered[0] ?? undefined,
+            execute: async () => filtered,
+            where(f2: string, o2: string, v2: any) {
+              const f = filtered.filter((r: any) => {
+                if (o2 === '=') return r[f2] === v2;
+                if (o2 === 'in') return v2.includes(r[f2]);
+                return false;
+              });
+              return { executeTakeFirst: async () => f[0], execute: async () => f };
+            },
+          };
+        },
+        executeTakeFirst: async () => undefined,
+        execute: async () => [],
+      };
+    },
+    insertInto(_table: string) {
+      return {
+        values(vals: any) {
+          return {
+            returningAll() {
+              return { executeTakeFirstOrThrow: async () => ({ id: 'new-id', ...vals }) };
+            },
+            execute: async () => {},
+          };
+        },
+      };
+    },
+    deleteFrom(_table: string) {
+      return {
+        where() {
+          return { execute: async () => {} };
+        },
+      };
+    },
+  } as any;
+}
+
+describe('session auth hook', () => {
+  let permissionRegistry: PermissionRegistry;
+
+  beforeEach(() => {
+    permissionRegistry = new PermissionRegistry();
+    permissionRegistry.registerRoles({ Admin: { label: 'Admin', models: {} } }, 'core');
+  });
+
+  it('returns 401 for missing Authorization header', async () => {
+    const db = createMockDb({ users: [], sessions: [], userRoles: [], roles: [] });
+    const server = createTestServer();
+    server.get('/test', {
+      onRequest: createAuthHook(db, permissionRegistry),
+      handler: async () => ({ ok: true }),
+    });
+
+    const res = await server.inject({ method: 'GET', url: '/test' });
+    expect(res.statusCode).toBe(401);
+    expect(res.json().error.code).toBe('UNAUTHORIZED');
+  });
+
+  it('returns 401 for invalid token', async () => {
+    const db = createMockDb({ users: [], sessions: [], userRoles: [], roles: [] });
+    const server = createTestServer();
+    server.get('/test', {
+      onRequest: createAuthHook(db, permissionRegistry),
+      handler: async () => ({ ok: true }),
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/test',
+      headers: { authorization: 'Bearer invalid-token' },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('returns 401 for expired token', async () => {
+    const expired = new Date(Date.now() - 1000).toISOString();
+    const db = createMockDb({
+      users: [{ id: 'u1', email: 'a@b.com', enabled: true }],
+      sessions: [{ id: 's1', token: 'tok', user_id: 'u1', expires_at: expired }],
+      userRoles: [],
+      roles: [],
+    });
+    const server = createTestServer();
+    server.get('/test', {
+      onRequest: createAuthHook(db, permissionRegistry),
+      handler: async () => ({ ok: true }),
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/test',
+      headers: { authorization: 'Bearer tok' },
+    });
+    expect(res.statusCode).toBe(401);
+    expect(res.json().error.message).toContain('expired');
+  });
+
+  it('authenticates valid token and attaches context', async () => {
+    const future = new Date(Date.now() + 60000).toISOString();
+    const db = createMockDb({
+      users: [{ id: 'u1', email: 'a@b.com', full_name: 'Test', enabled: true, password_hash: 'x' }],
+      sessions: [{ id: 's1', token: 'valid-tok', user_id: 'u1', expires_at: future }],
+      userRoles: [{ user_id: 'u1', role_id: 'r1' }],
+      roles: [{ id: 'r1', name: 'Admin' }],
+    });
+    const server = createTestServer();
+    server.get('/test', {
+      onRequest: createAuthHook(db, permissionRegistry),
+      handler: async (request) => {
+        const ctx = (request as any).authContext;
+        return { email: ctx.user.email };
+      },
+    });
+
+    const res = await server.inject({
+      method: 'GET',
+      url: '/test',
+      headers: { authorization: 'Bearer valid-tok' },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().email).toBe('a@b.com');
+  });
+});
+
+describe('session create endpoint', () => {
+  it('returns 401 for invalid credentials', async () => {
+    const db = createMockDb({ users: [], sessions: [], userRoles: [], roles: [] });
+    const server = createTestServer();
+    server.post('/api/core/session', createSessionHandler(db));
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/core/session',
+      payload: { email: 'bad@test.com', password: 'wrong' },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('returns 400 for missing fields', async () => {
+    const db = createMockDb({ users: [], sessions: [], userRoles: [], roles: [] });
+    const server = createTestServer();
+    server.post('/api/core/session', createSessionHandler(db));
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/core/session',
+      payload: {},
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('creates session for valid credentials', async () => {
+    const pw = hashPassword('secret');
+    const db = createMockDb({
+      users: [
+        { id: 'u1', email: 'user@test.com', full_name: 'User', enabled: true, password_hash: pw },
+      ],
+      sessions: [],
+      userRoles: [],
+      roles: [],
+    });
+    const server = createTestServer();
+    server.post('/api/core/session', createSessionHandler(db));
+
+    const res = await server.inject({
+      method: 'POST',
+      url: '/api/core/session',
+      payload: { email: 'user@test.com', password: 'secret' },
+    });
+    expect(res.statusCode).toBe(201);
+    expect(res.json().data.token).toBeDefined();
+  });
+});
+
+describe('generateToken', () => {
+  it('generates a 64-character hex string', () => {
+    const token = generateToken();
+    expect(token).toHaveLength(64);
+    expect(/^[a-f0-9]+$/.test(token)).toBe(true);
+  });
+});

package/src/auth/core-models.ts

@@ -0,0 +1,52 @@
+import { defineModel, field } from '@rangka/shared';
+
+export const userSchema = defineModel({
+  name: 'user',
+  label: 'User',
+  fields: {
+    email: field.string({ required: true }),
+    password_hash: field.string({ required: true }),
+    full_name: field.string({ required: true }),
+    enabled: field.boolean({ default: true }),
+  },
+  indexes: [{ fields: ['email'], unique: true }],
+});
+
+export const roleSchema = defineModel({
+  name: 'role',
+  label: 'Role',
+  fields: {
+    name: field.string({ required: true }),
+    inherits: field.json({}),
+    permissions: field.json({}),
+  },
+  indexes: [{ fields: ['name'], unique: true }],
+});
+
+export const userRoleSchema = defineModel({
+  name: 'user_role',
+  label: 'User Role',
+  fields: {
+    user_id: field.link('core.user', { required: true }),
+    role_id: field.link('core.role', { required: true }),
+  },
+  indexes: [{ fields: ['user_id', 'role_id'], unique: true }],
+});
+
+export const sessionSchema = defineModel({
+  name: 'session',
+  label: 'Session',
+  fields: {
+    token: field.string({ required: true }),
+    user_id: field.link('core.user', { required: true }),
+    expires_at: field.datetime({ required: true }),
+    created_at: field.datetime({ required: true }),
+  },
+  indexes: [
+    { fields: ['token'], unique: true },
+    { fields: ['user_id'] },
+    { fields: ['expires_at'] },
+  ],
+});
+
+export const coreSchemas = [userSchema, roleSchema, userRoleSchema, sessionSchema];

package/src/auth/core-module.ts

@@ -0,0 +1,59 @@
+import type { DiscoveredApp } from '../boot/types.js';
+import type { ResolvedModel, ResolvedField } from '../schema/types.js';
+import { coreSchemas } from './core-models.js';
+import type { FieldConfig } from '@rangka/shared';
+
+function schemaToResolvedModel(schema: {
+  name: string;
+  label?: string;
+  fields: Record<string, FieldConfig>;
+  indexes?: Array<{ fields: string[]; unique?: boolean }>;
+}): ResolvedModel {
+  const fields: ResolvedField[] = [
+    {
+      name: 'id',
+      config: { type: 'string', required: true } as FieldConfig,
+      provenance: { source: 'base' },
+    },
+    ...Object.entries(schema.fields).map(([name, config]) => ({
+      name,
+      config,
+      provenance: { source: 'base' as const },
+    })),
+  ];
+
+  return {
+    qualifiedName: `core.${schema.name}`,
+    app: 'core',
+    module: 'core',
+    name: schema.name,
+    label: schema.label,
+    auditLog: false,
+    traits: [],
+    fields,
+    indexes: schema.indexes,
+  };
+}
+
+export function getCoreModels(): ResolvedModel[] {
+  return coreSchemas.map(schemaToResolvedModel);
+}
+
+export function getCoreApp(): DiscoveredApp {
+  return {
+    packageInfo: {
+      packageName: '@rangka/core',
+      path: '__builtin__',
+      rangka: { type: 'app', entrypoint: 'index.js' },
+    },
+    config: {
+      name: 'core',
+      label: 'Core',
+    },
+    schemas: coreSchemas.map((s) => ({
+      module: 'core',
+      schema: s,
+    })),
+    extensions: [],
+  };
+}