@rebasepro/server-core 0.0.1-canary.000dc36

package/src/api/rest/query-parser.ts

@@ -0,0 +1,155 @@
+import { QueryOptions } from "../types";
+
+/**
+ * Map PostgREST-style operators to Rebase WhereFilterOp
+ */
+export function mapOperator(op: string): string | null {
+    switch (op) {
+        case "eq": return "==";
+        case "neq": return "!=";
+        case "gt": return ">";
+        case "gte": return ">=";
+        case "lt": return "<";
+        case "lte": return "<=";
+        case "in": return "in";
+        case "nin": return "not-in";
+        case "cs": return "array-contains";
+        case "csa": return "array-contains-any";
+        default: return null;
+    }
+}
+
+/**
+ * Parse query parameters into QueryOptions
+ */
+export function parseQueryOptions(query: Record<string, unknown>): QueryOptions {
+    const options: QueryOptions = {};
+
+    // Pagination
+    if (query.limit) options.limit = parseInt(String(query.limit));
+    if (query.offset) options.offset = parseInt(String(query.offset));
+    if (query.page) {
+        const page = parseInt(String(query.page));
+        const limit = options.limit || 20;
+        options.offset = (page - 1) * limit;
+    }
+
+    // Filtering
+    options.where = {};
+
+    // Legacy JSON where clause
+    if (query.where) {
+        try {
+            const parsedWhere = typeof query.where === "string"
+                ? JSON.parse(query.where)
+                : query.where;
+            if (typeof parsedWhere !== "object" || parsedWhere === null || Array.isArray(parsedWhere)) {
+                throw new Error("Filter must be a JSON object");
+            }
+            Object.assign(options.where, parsedWhere);
+        } catch (e) {
+            const message = e instanceof Error ? e.message : "malformed JSON";
+            const err = new Error(`Invalid 'where' filter: ${message}`) as Error & { code?: string; statusCode?: number };
+            err.code = "BAD_REQUEST";
+            err.statusCode = 400;
+            throw err;
+        }
+    }
+
+    // PostgREST style filtering
+    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "where", "include", "fields", "searchString"];
+    for (const [key, rawValue] of Object.entries(query)) {
+        if (reservedQueryKeys.includes(key)) continue;
+
+        const value = Array.isArray(rawValue) ? rawValue[rawValue.length - 1] : rawValue;
+
+        if (typeof value === "string") {
+            const parts = value.split(".");
+            if (parts.length >= 2) {
+                const op = parts[0];
+                const val = parts.slice(1).join(".");
+                const rebaseOp = mapOperator(op);
+
+                if (rebaseOp) {
+                    let parsedVal: string | number | boolean | null | (string | number | boolean | null)[] = val;
+                    // Attempt to parse primitive types or arrays
+                    if (val === "true") parsedVal = true;
+                    else if (val === "false") parsedVal = false;
+                    else if (val === "null") parsedVal = null;
+                    else if (!isNaN(Number(val)) && val.trim() !== "") parsedVal = Number(val);
+                    else if (val.startsWith("(")) {
+                        // Array for 'in' or 'not-in' ops (e.g. (1,2,3) or (a,b,c))
+                        const arrayContent = val.endsWith(")") ? val.slice(1, -1) : val.slice(1);
+                        parsedVal = arrayContent.split(",").map(v => {
+                            const trimmed = v.trim();
+                            if (!isNaN(Number(trimmed)) && trimmed !== "") return Number(trimmed);
+                            if (trimmed === "true") return true;
+                            if (trimmed === "false") return false;
+                            if (trimmed === "null") return null;
+                            return trimmed;
+                        });
+                    }
+
+                    options.where[key] = [rebaseOp, parsedVal];
+                } else {
+                    // Fallback: assume implicit eq if the dot wasn't an operator (e.g. email or float)
+                    let parsedVal: string | number | boolean | null = value;
+                    if (!isNaN(Number(value)) && value.trim() !== "") parsedVal = Number(value);
+                    options.where[key] = ["==", parsedVal];
+                }
+            } else {
+                // Implicit eq
+                let parsedVal: string | number | boolean | null = value;
+                if (value === "true") parsedVal = true;
+                else if (value === "false") parsedVal = false;
+                else if (value === "null") parsedVal = null;
+                else if (!isNaN(Number(value)) && value.trim() !== "") parsedVal = Number(value);
+
+                options.where[key] = ["==", parsedVal];
+            }
+        }
+    }
+
+    if (Object.keys(options.where).length === 0) {
+        delete options.where;
+    }
+
+    // Sorting
+    if (query.orderBy) {
+        try {
+            options.orderBy = typeof query.orderBy === "string"
+                ? JSON.parse(query.orderBy)
+                : query.orderBy;
+        } catch {
+            // Try simple format: "field:direction"
+            if (typeof query.orderBy === "string") {
+                const [field, direction] = query.orderBy.split(":");
+                const dir = (direction === "desc" ? "desc" : "asc") as "asc" | "desc";
+                options.orderBy = [
+                    {
+                        field,
+                        direction: dir
+                    }
+                ];
+            }
+        }
+    }
+
+    // Relation includes
+    if (query.include) {
+        const includeStr = String(query.include).trim();
+        if (includeStr === "*") {
+            options.include = ["*"];
+        } else {
+            options.include = includeStr.split(",").map(s => s.trim()).filter(Boolean);
+        }
+    }
+
+    // Field selection
+    if (query.fields) {
+        const fieldsStr = String(query.fields).trim();
+        options.fields = fieldsStr.split(",").map(s => s.trim()).filter(Boolean);
+    }
+
+    return options;
+}

package/src/api/schema-editor-routes.ts

@@ -0,0 +1,41 @@
+import { Hono } from "hono";
+import { AstSchemaEditor } from "./ast-schema-editor";
+import { errorHandler } from "./errors";
+import { HonoEnv } from "./types";
+
+export function createSchemaEditorRoutes(collectionsDir: string): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    router.onError(errorHandler);
+    const editor = new AstSchemaEditor(collectionsDir);
+
+    router.post("/property/save", async (c) => {
+        const body = await c.req.json();
+        const { collectionId, propertyKey, propertyConfig } = body;
+        await editor.saveProperty(collectionId, propertyKey, propertyConfig);
+        return c.json({ success: true });
+    });
+
+    router.post("/property/delete", async (c) => {
+        const body = await c.req.json();
+        const { collectionId, propertyKey } = body;
+        await editor.deleteProperty(collectionId, propertyKey);
+        return c.json({ success: true });
+    });
+
+    router.post("/collection/save", async (c) => {
+        const body = await c.req.json();
+        const { collectionId, collectionData } = body;
+        await editor.saveCollection(collectionId, collectionData);
+        return c.json({ success: true });
+    });
+
+    router.post("/collection/delete", async (c) => {
+        const body = await c.req.json();
+        const { collectionId } = body;
+        await editor.deleteCollection(collectionId);
+        return c.json({ success: true });
+    });
+
+    return router;
+}
+

package/src/api/server.ts

@@ -0,0 +1,249 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { secureHeaders } from "hono/secure-headers";
+import { graphqlServer } from "@hono/graphql-server";
+import { serve } from "@hono/node-server";
+import { GraphQLSchemaGenerator } from "./graphql/graphql-schema-generator";
+import { RestApiGenerator } from "./rest/api-generator";
+import { DataDriver, EntityCollection, Relation } from "@rebasepro/types";
+import { ApiConfig, HonoEnv } from "./types";
+import { loadCollectionsFromDirectory } from "../collections/loader";
+import { createSchemaEditorRoutes } from "./schema-editor-routes";
+import { createAuthMiddleware, requireAuth, requireAdmin } from "../auth/middleware";
+import { errorHandler } from "./errors";
+import { generateOpenApiSpec } from "./openapi-generator";
+
+/**
+ * Simplified API server that leverages existing Rebase infrastructure
+ * Can be used standalone or mounted on existing Hono app
+ */
+export class RebaseApiServer {
+    private app: Hono<HonoEnv>;
+    private router: Hono<HonoEnv>;
+    private config: ApiConfig;
+    private driver: DataDriver;
+
+    private constructor(config: ApiConfig & { driver: DataDriver }) {
+        this.config = {
+            basePath: "/api",
+            enableGraphQL: true,
+            enableREST: true,
+            pagination: {
+                defaultLimit: 20,
+                maxLimit: 100
+            },
+            ...config
+        };
+
+        this.driver = config.driver;
+
+        this.app = new Hono<HonoEnv>();
+        this.router = new Hono<HonoEnv>();
+
+        this.setupMiddleware();
+    }
+
+    /**
+     * Factory method to create an asynchronously initialized ApiServer instance
+     */
+    public static async create(config: ApiConfig & { driver: DataDriver }): Promise<RebaseApiServer> {
+        if (config.collectionsDir && (!config.collections || config.collections.length === 0)) {
+            config.collections = await loadCollectionsFromDirectory(config.collectionsDir);
+        } else if (!config.collections) {
+            config.collections = [];
+        }
+
+        const server = new RebaseApiServer(config);
+        server.setupRoutes();
+        // Since we mount routes directly to router, we can let consumer attach it
+        server.app.route("/", server.router);
+
+        // Hono global error handler on the root app
+        server.app.onError(errorHandler);
+        server.router.onError(errorHandler);
+
+        return server;
+    }
+
+    /**
+     * Setup Hono middleware
+     */
+    private setupMiddleware(): void {
+        // Security headers
+        this.router.use("/*", secureHeaders());
+
+        // CORS — only applied if explicitly configured via `cors` option.
+        // If omitted, the user is expected to configure CORS on their own
+        // Hono app before mounting the API (recommended approach).
+        if (this.config.cors) {
+            const origin = this.config.cors.origin;
+            this.router.use("/*", cors({
+                origin: typeof origin === "boolean"
+                    ? (origin ? ((o: string) => o) : "")
+                    : (origin ?? "*"),
+                credentials: this.config.cors.credentials ?? false
+            }));
+        }
+
+        // Auth middleware
+        this.router.use("/*", createAuthMiddleware({
+            driver: this.driver,
+            requireAuth: this.config.requireAuth ?? true,
+            validator: this.config.authValidator
+        }));
+    }
+
+    /**
+     * Setup API routes using existing services
+     */
+    private setupRoutes(): void {
+        const basePath = this.config.basePath!;
+
+        // Health check
+        this.router.get(`${basePath}/health`, (c) => {
+            return c.json({
+                status: "healthy",
+                timestamp: new Date().toISOString(),
+                collections: this.config.collections?.map((col: EntityCollection) => col.slug) || [],
+                driver: this.driver.key
+            });
+        });
+
+        // Collections metadata endpoint
+        this.router.get(`${basePath}/collections`, (c) => {
+            const collectionsMetadata = (this.config.collections || []).map((col: EntityCollection) => ({
+                slug: col.slug,
+                name: col.name,
+                singularName: col.singularName,
+                description: col.description,
+                properties: Object.keys(col.properties),
+                relations: (col as EntityCollection & { relations?: Relation[] }).relations?.map((r: Relation) => ({
+                    relationName: r.relationName,
+                    target: typeof r.target === "function" ? r.target().slug : r.target,
+                    cardinality: r.cardinality,
+                    direction: r.direction
+                })) || []
+            }));
+
+            return c.json({ data: collectionsMetadata });
+        });
+
+        // GraphQL endpoint
+        if (this.config.enableGraphQL) {
+            const schemaGenerator = new GraphQLSchemaGenerator(this.config.collections || [], this.driver);
+            const schema = schemaGenerator.generateSchema();
+
+            // Context is automatically passed to resolvers via contextValue containing Hono's 'c'
+            this.router.use(`${basePath}/graphql`, graphqlServer({
+                schema
+            }));
+
+            // Lightweight GraphiQL IDE
+            if (process.env.NODE_ENV !== "production") {
+                this.router.get(`${basePath}/graphiql`, (c) => {
+                    return c.html(`<!DOCTYPE html>
+<html>
+<head>
+  <meta charset=utf-8/>
+  <title>Rebase GraphiQL</title>
+  <link rel="stylesheet" href="https://unpkg.com/graphiql/graphiql.min.css" />
+  <style>body,html,#graphiql{height:100%;margin:0;width:100%;}</style>
+</head>
+<body>
+<div id="graphiql">Loading...</div>
+<script crossorigin src="https://unpkg.com/react/umd/react.production.min.js"></script>
+<script crossorigin src="https://unpkg.com/react-dom/umd/react-dom.production.min.js"></script>
+<script src="https://unpkg.com/graphiql/graphiql.min.js"></script>
+<script>
+  const fetcher = GraphiQL.createFetcher({ url: '${basePath}/graphql' });
+  ReactDOM.render(
+    React.createElement(GraphiQL, { fetcher }),
+    document.getElementById('graphiql'),
+  );
+</script>
+</body>
+</html>`);
+                });
+            }
+        }
+
+        if (this.config.enableREST) {
+            const restGenerator = new RestApiGenerator(this.config.collections || [], this.driver);
+            const restRoutes = restGenerator.generateRoutes();
+            this.router.route(basePath, restRoutes);
+        }
+
+        // Schema Editor endpoints
+        if (this.config.collectionsDir) {
+            if (process.env.NODE_ENV === "production") {
+                console.warn("[RebaseApiServer] Schema Editor is disabled in production environments for security.");
+            } else {
+                // Auth middlewares applied to schema-editor via the router prefix
+                // MUST be declared before .route() so they execute first
+                this.router.use(`${basePath}/schema-editor/*`, requireAuth, requireAdmin);
+                const schemaEditorRoutes = createSchemaEditorRoutes(this.config.collectionsDir);
+                this.router.route(`${basePath}/schema-editor`, schemaEditorRoutes);
+            }
+        }
+
+        // OpenAPI endpoint
+        this.router.get(`${basePath}/docs`, (c) => {
+            const openApiSpec = generateOpenApiSpec(this.config.collections || [], {
+                basePath: this.config.basePath,
+                requireAuth: this.config.requireAuth ?? true
+            });
+            return c.json(openApiSpec);
+        });
+
+        // Simple Swagger UI
+        if (process.env.NODE_ENV !== "production") {
+            this.router.get(`${basePath}/swagger`, (c) => {
+                return c.html(`
+                    <!DOCTYPE html>
+                    <html>
+                    <head>
+                        <title>Rebase API Documentation</title>
+                        <link rel="stylesheet" type="text/css" href="https://unpkg.com/swagger-ui-dist@4.15.5/swagger-ui.css" />
+                    </head>
+                    <body>
+                        <div id="swagger-ui"></div>
+                        <script src="https://unpkg.com/swagger-ui-dist@4.15.5/swagger-ui-bundle.js"></script>
+                        <script>
+                            SwaggerUIBundle({
+                                url: '${basePath}/docs',
+                                dom_id: '#swagger-ui'
+                            });
+                        </script>
+                    </body>
+                    </html>
+                `);
+            });
+        }
+    }
+
+    /**
+     * Get the Hono router with all API routes
+     */
+    getRouter(): Hono<HonoEnv> {
+        return this.router;
+    }
+
+    /**
+     * Get the standalone Hono app
+     */
+    getApp(): Hono<HonoEnv> {
+        return this.app;
+    }
+
+    /**
+     * Start the server (standalone mode) via @hono/node-server
+     */
+    listen(port = 3000, callback?: () => void): void {
+        serve({
+            fetch: this.app.fetch,
+            port
+        }, () => {
+            if (callback) callback();
+        });
+    }
+}

package/src/api/types.ts

@@ -0,0 +1,90 @@
+import { EntityCollection } from "@rebasepro/types";
+import { AuthResult } from "../auth/middleware";
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { DataDriver } from "@rebasepro/types";
+
+/**
+ * Hono Environment Variables
+ * Passed to generic Hono<HonoEnv> to type `c.get()`
+ */
+export type HonoEnv = {
+    Variables: {
+        user?: AuthResult | { userId?: string, roles?: string[] };
+        driver?: DataDriver;
+    }
+};
+
+/**
+ * Configuration for API generation
+ */
+/**
+ * Configuration for API generation
+ */
+export interface ApiConfig {
+    collections?: EntityCollection[];
+    collectionsDir?: string;
+    basePath?: string;
+    enableGraphQL?: boolean;
+    enableREST?: boolean;
+    cors?: {
+        origin?: string | string[] | boolean;
+        credentials?: boolean;
+    };
+    /** Whether auth is required for API endpoints (default: true) */
+    requireAuth?: boolean;
+    /** Optional custom validator for authentication */
+    authValidator?: (c: import("hono").Context<import("./types").HonoEnv>) => Promise<AuthResult>;
+    pagination?: {
+        defaultLimit: number;
+        maxLimit: number;
+    };
+}
+
+/**
+ * Context passed to resolvers and handlers
+ */
+export interface ApiContext {
+    user?: AuthResult;
+    collections: Map<string, EntityCollection>;
+    db: NodePgDatabase; // Drizzle DB instance
+}
+
+/**
+ * Standard API response format
+ */
+export interface ApiResponse<T = unknown> {
+    data?: T;
+    error?: {
+        message: string;
+        code?: string;
+        details?: unknown;
+    };
+    meta?: {
+        total?: number;
+        page?: number;
+        limit?: number;
+        hasMore?: boolean;
+    };
+}
+
+/**
+ * Query options for API endpoints
+ */
+export interface QueryOptions {
+    limit?: number;
+    offset?: number;
+    where?: Record<string, unknown>;
+    orderBy?: Array<{ field: string; direction: "asc" | "desc" }>;
+    include?: string[];
+    /** Columns to return in the response (field-level selection) */
+    fields?: string[];
+}
+
+/**
+ * Relation resolution configuration
+ */
+export interface RelationConfig {
+    relationName: string;
+    depth?: number;
+    include?: string[];
+}