@rebasepro/server-core 0.0.1-canary.09e5ec5

package/src/auth/admin-routes.ts

@@ -0,0 +1,529 @@
+import { Hono } from "hono";
+import { ApiError, errorHandler } from "../api/errors";
+import type { AuthRepository } from "./interfaces";
+import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
+import { hashPassword, validatePasswordStrength } from "./password";
+import { AuthModuleConfig } from "./routes";
+
+interface AdminRouteOptions extends AuthModuleConfig {
+    serviceKey?: string;
+    /**
+     * Callback to persistently mark bootstrap as completed.
+     * Invoked after the first admin user is promoted via POST /admin/bootstrap.
+     */
+    setBootstrapCompleted?: () => Promise<void>;
+}
+import { HonoEnv } from "../api/types";
+import { randomBytes, createHash } from "crypto";
+import { getUserInvitationTemplate, getPasswordResetTemplate } from "../email/templates";
+
+/**
+ * Generate a cryptographically secure random password that meets strength requirements.
+ */
+function generateSecurePassword(): string {
+    const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+    const lower = "abcdefghjkmnpqrstuvwxyz";
+    const digits = "23456789";
+    const all = upper + lower + digits;
+
+    // Guarantee at least one of each required class
+    const pick = (chars: string) => chars[Math.floor(Math.random() * chars.length)];
+    const parts = [pick(upper), pick(lower), pick(digits)];
+
+    // Fill remaining with random chars (16 total)
+    for (let i = parts.length; i < 16; i++) {
+        parts.push(pick(all));
+    }
+
+    // Shuffle
+    for (let i = parts.length - 1; i > 0; i--) {
+        const j = Math.floor(Math.random() * (i + 1));
+        [parts[i], parts[j]] = [parts[j], parts[i]];
+    }
+    return parts.join("");
+}
+
+/**
+ * Generate a secure random token
+ */
+function generateSecureToken(): string {
+    return randomBytes(40).toString("hex");
+}
+
+/**
+ * Hash a token for database storage
+ */
+function hashToken(token: string): string {
+    return createHash("sha256").update(token).digest("hex");
+}
+
+/**
+ * Create admin routes for user and role management
+ */
+export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    const authRepo = config.authRepo;
+    const { emailService, emailConfig } = config;
+
+    // Attach Rebase error handler to ensure exceptions are correctly formatted
+    // instead of caught by Hono's default error handler from the sub-router.
+    router.onError(errorHandler);
+
+    // Apply auth middleware to all routes (service-key-aware when configured)
+    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
+
+    /**
+     * POST /admin/bootstrap
+     *
+     * One-time endpoint to promote the calling user to admin.
+     * Guarded by three layers:
+     *   1. Authentication (handled by middleware above)
+     *   2. Persistent `bootstrap_completed` flag (when `setBootstrapCompleted` is provided)
+     *   3. Database check — no existing admin users
+     *
+     * Once invoked successfully the persistent flag is set, permanently disabling
+     * this endpoint even if all admin users are later deleted.
+     */
+    router.post("/bootstrap", async (c) => {
+        const user = c.get("user");
+        if (!user || typeof user !== "object") {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        // ── Guard 1: persistent flag ──────────────────────────────────
+        if (config.isBootstrapCompleted) {
+            const alreadyDone = await config.isBootstrapCompleted();
+            if (alreadyDone) {
+                throw ApiError.forbidden("Bootstrap has already been completed.", "BOOTSTRAP_COMPLETED");
+            }
+        }
+
+        // ── Guard 2: no existing admin users ─────────────────────────
+        const users = await authRepo.listUsers();
+        let hasAdmin = false;
+
+        for (const u of users) {
+            const roles = await authRepo.getUserRoleIds(u.id);
+            if (roles.includes("admin")) {
+                hasAdmin = true;
+                break;
+            }
+        }
+
+        if (hasAdmin) {
+            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
+        }
+
+        // ── Promote caller ───────────────────────────────────────────
+        const userId = "userId" in user ? user.userId : undefined;
+        if (!userId) {
+            throw ApiError.unauthorized("User ID not found in auth context");
+        }
+        await authRepo.setUserRoles(userId, ["admin"]);
+
+        // ── Set persistent flag ──────────────────────────────────────
+        if (config.setBootstrapCompleted) {
+            await config.setBootstrapCompleted();
+        }
+
+        return c.json({
+            success: true,
+            message: "You are now an admin",
+            user: {
+                uid: userId,
+                roles: ["admin"]
+            }
+        });
+    });
+
+    router.get("/users", requireAdmin, async (c) => {
+        const limitParam = c.req.query("limit");
+        const offsetParam = c.req.query("offset");
+        const search = c.req.query("search");
+        const orderBy = c.req.query("orderBy");
+        const orderDir = c.req.query("orderDir") as "asc" | "desc" | undefined;
+
+        // If pagination params are provided, use the paginated path
+        if (limitParam !== undefined || search) {
+            const limit = limitParam ? parseInt(limitParam, 10) : 25;
+            const offset = offsetParam ? parseInt(offsetParam, 10) : 0;
+
+            const result = await authRepo.listUsersPaginated({
+                limit,
+                offset,
+                search: search || undefined,
+                orderBy: orderBy || undefined,
+                orderDir: orderDir || undefined,
+                roleId: c.req.query("role") || undefined
+            });
+
+            const usersWithRoles = await Promise.all(
+                result.users.map(async (u) => {
+                    const roles = await authRepo.getUserRoleIds(u.id);
+                    return {
+                        uid: u.id,
+                        email: u.email,
+                        displayName: u.displayName,
+                        photoURL: u.photoUrl,
+                        roles,
+                        createdAt: u.createdAt,
+                        updatedAt: u.updatedAt
+                    };
+                })
+            );
+
+            return c.json({
+                users: usersWithRoles,
+                total: result.total,
+                limit: result.limit,
+                offset: result.offset
+            });
+        }
+
+        // Legacy: return all users (no pagination)
+        const users = await authRepo.listUsers();
+        const usersWithRoles = await Promise.all(
+            users.map(async (u) => {
+                const roles = await authRepo.getUserRoleIds(u.id);
+                return {
+                    uid: u.id,
+                    email: u.email,
+                    displayName: u.displayName,
+                    photoURL: u.photoUrl,
+                    roles,
+                    createdAt: u.createdAt,
+                    updatedAt: u.updatedAt
+                };
+            })
+        );
+        return c.json({ users: usersWithRoles });
+    });
+
+    router.get("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const result = await authRepo.getUserWithRoles(userId);
+
+        if (!result) {
+            throw ApiError.notFound("User not found");
+        }
+
+        return c.json({
+            user: {
+                uid: result.user.id,
+                email: result.user.email,
+                displayName: result.user.displayName,
+                photoURL: result.user.photoUrl,
+                roles: result.roles.map(r => r.id),
+                createdAt: result.user.createdAt,
+                updatedAt: result.user.updatedAt
+            }
+        });
+    });
+
+    router.post("/users", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        const { email, displayName, password, roles } = body;
+
+        if (!email) {
+            throw ApiError.badRequest("Email is required", "INVALID_INPUT");
+        }
+
+        const existing = await authRepo.getUserByEmail(email);
+        if (existing) {
+            throw ApiError.conflict("Email already exists", "EMAIL_EXISTS");
+        }
+
+        // Use provided password or auto-generate one
+        const clearPassword = password || generateSecurePassword();
+
+        const validation = validatePasswordStrength(clearPassword);
+        if (!validation.valid) {
+            throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
+        }
+        const passwordHash = await hashPassword(clearPassword);
+
+        const user = await authRepo.createUser({
+            email: email.toLowerCase(),
+            displayName: displayName || null,
+            passwordHash
+        });
+
+        if (roles && Array.isArray(roles) && roles.length > 0) {
+            await authRepo.setUserRoles(user.id, roles);
+        } else if (config.defaultRole) {
+            await authRepo.assignDefaultRole(user.id, config.defaultRole);
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(user.id);
+
+        // Determine if we can send an invitation email
+        const isEmailConfigured = !!(emailService && emailService.isConfigured());
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        if (isEmailConfigured && !password) {
+            // Send invitation email via password-reset token flow
+            try {
+                const token = generateSecureToken();
+                const tokenHash = hashToken(token);
+                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                await authRepo.createPasswordResetToken(user.id, tokenHash, expiresAt);
+
+                const baseUrl = emailConfig?.resetPasswordUrl || "";
+                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                const appName = emailConfig?.appName || "Rebase";
+                const templateFn = emailConfig?.templates?.userInvitation;
+                const emailContent = templateFn
+                    ? templateFn(setPasswordUrl, { email: user.email,
+displayName: user.displayName })
+                    : getUserInvitationTemplate(setPasswordUrl, { email: user.email,
+displayName: user.displayName }, appName);
+
+                await emailService!.send({
+                    to: user.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+                invitationSent = true;
+            } catch (emailError: unknown) {
+                console.error("Failed to send invitation email:", emailError instanceof Error ? emailError.message : emailError);
+                // Fall back to returning the temporary password
+                temporaryPassword = clearPassword;
+            }
+        } else if (!password) {
+            // No email service — return the auto-generated password one-time
+            temporaryPassword = clearPassword;
+        }
+        // If admin provided a password explicitly, don't return it or send email
+
+        return c.json({
+            user: {
+                uid: user.id,
+                email: user.email,
+                displayName: user.displayName,
+                roles: userRoles
+            },
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 201);
+    });
+
+    router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const isEmailConfigured = !!(emailService && emailService.isConfigured());
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        if (isEmailConfigured) {
+            try {
+                const token = generateSecureToken();
+                const tokenHash = hashToken(token);
+                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
+
+                const baseUrl = emailConfig?.resetPasswordUrl || "";
+                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                const appName = emailConfig?.appName || "Rebase";
+                const templateFn = emailConfig?.templates?.passwordReset;
+                const emailContent = templateFn
+                    ? templateFn(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName })
+                    : getPasswordResetTemplate(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName }, appName);
+
+                await emailService!.send({
+                    to: existing.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+                invitationSent = true;
+            } catch (emailError: unknown) {
+                console.error("Failed to send reset email:", emailError instanceof Error ? emailError.message : emailError);
+                // Fall back to returning the temporary password
+                const clearPassword = generateSecurePassword();
+                const passwordHash = await hashPassword(clearPassword);
+                await authRepo.updatePassword(existing.id, passwordHash);
+                temporaryPassword = clearPassword;
+            }
+        } else {
+            // No email service — generate password, set it, and return one-time
+            const clearPassword = generateSecurePassword();
+            const passwordHash = await hashPassword(clearPassword);
+            await authRepo.updatePassword(existing.id, passwordHash);
+            temporaryPassword = clearPassword;
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(existing.id);
+
+        return c.json({
+            user: {
+                uid: existing.id,
+                email: existing.email,
+                displayName: existing.displayName,
+                roles: userRoles
+            },
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 200);
+    });
+
+    router.put("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const body = await c.req.json();
+        const { email, displayName, password, roles } = body;
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const updates: Record<string, unknown> = {};
+        if (email !== undefined) updates.email = email.toLowerCase();
+        if (displayName !== undefined) updates.displayName = displayName;
+
+        if (password) {
+            const validation = validatePasswordStrength(password);
+            if (!validation.valid) {
+                throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
+            }
+            updates.passwordHash = await hashPassword(password);
+        }
+
+        if (Object.keys(updates).length > 0) {
+            await authRepo.updateUser(userId, updates);
+        }
+
+        if (roles !== undefined && Array.isArray(roles)) {
+            await authRepo.setUserRoles(userId, roles);
+        }
+
+        const result = await authRepo.getUserWithRoles(userId);
+
+        return c.json({
+            user: {
+                uid: result!.user.id,
+                email: result!.user.email,
+                displayName: result!.user.displayName,
+                roles: result!.roles.map(r => r.id)
+            }
+        });
+    });
+
+    router.delete("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const user = c.get("user");
+
+        const currentUserId = user && typeof user === "object" && "userId" in user ? user.userId : undefined;
+        if (currentUserId === userId) {
+            throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
+        }
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        await authRepo.deleteUser(userId);
+
+        return c.json({ success: true });
+    });
+
+    router.get("/roles", requireAdmin, async (c) => {
+        const roles = await authRepo.listRoles();
+
+        return c.json({
+            roles: roles.map(r => ({
+                id: r.id,
+                name: r.name,
+                isAdmin: r.isAdmin,
+                defaultPermissions: r.defaultPermissions,
+                config: r.config
+            }))
+        });
+    });
+
+    router.get("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+        const role = await authRepo.getRoleById(roleId);
+
+        if (!role) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        return c.json({ role });
+    });
+
+    router.post("/roles", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        const { id, name, isAdmin, defaultPermissions, config } = body;
+
+        if (!id || !name) {
+            throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
+        }
+
+        const existing = await authRepo.getRoleById(id);
+        if (existing) {
+            throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
+        }
+
+        const role = await authRepo.createRole({
+            id,
+            name,
+            isAdmin: isAdmin ?? false,
+            defaultPermissions: defaultPermissions ?? null,
+            config: config ?? null
+        });
+
+        return c.json({ role }, 201);
+    });
+
+    router.put("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+        const body = await c.req.json();
+        const { name, isAdmin, defaultPermissions, config } = body;
+
+        const existing = await authRepo.getRoleById(roleId);
+        if (!existing) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        const role = await authRepo.updateRole(roleId, {
+            name,
+            isAdmin,
+            defaultPermissions,
+            config
+        });
+
+        return c.json({ role });
+    });
+
+    router.delete("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+
+        if (["admin", "editor", "viewer"].includes(roleId)) {
+            throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
+        }
+
+        const existing = await authRepo.getRoleById(roleId);
+        if (!existing) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        await authRepo.deleteRole(roleId);
+
+        return c.json({ success: true });
+    });
+
+    return router;
+}

package/src/auth/apple-oauth.ts

@@ -0,0 +1,130 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+import { createPrivateKey } from "crypto";
+import { SignJWT } from "jose";
+
+/**
+ * Creates an Apple Sign In OAuth Provider integration.
+ *
+ * Apple requires a client secret that is a signed JWT, regenerated on each
+ * token exchange (valid up to 6 months). This provider handles that automatically.
+ *
+ * Required Apple Developer configuration:
+ * - Services ID (clientId)
+ * - Key ID from the private key registered with Apple
+ * - Team ID from Apple Developer account
+ * - Private key (.p8 file contents) downloaded from Apple Developer portal
+ */
+export function createAppleProvider(config: {
+    clientId: string;
+    teamId: string;
+    keyId: string;
+    /** The raw PEM contents of the .p8 private key file */
+    privateKey: string;
+}): OAuthProvider<{
+            code: string;
+            redirectUri: string;
+            user?: { name?: { firstName?: string; lastName?: string }; email?: string };
+        }> {
+    /**
+     * Generate a client_secret JWT signed with the Apple private key.
+     * Apple requires this instead of a static client_secret.
+     */
+    async function generateClientSecret(): Promise<string> {
+        const key = createPrivateKey({
+            key: config.privateKey,
+            format: "pem"
+        });
+
+        const now = Math.floor(Date.now() / 1000);
+
+        return new SignJWT({})
+            .setProtectedHeader({ alg: "ES256",
+kid: config.keyId })
+            .setIssuer(config.teamId)
+            .setIssuedAt(now)
+            .setExpirationTime(now + 86400 * 180) // 6 months max
+            .setAudience("https://appleid.apple.com")
+            .setSubject(config.clientId)
+            .sign(key);
+    }
+
+    return {
+        id: "apple",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required"),
+            /** Apple sends user info only on first authorization; the frontend must forward it. */
+            user: z.object({
+                name: z.object({
+                    firstName: z.string().optional(),
+                    lastName: z.string().optional()
+                }).optional(),
+                email: z.string().email().optional()
+            }).optional()
+        }),
+        verify: async (payload: {
+            code: string;
+            redirectUri: string;
+            user?: { name?: { firstName?: string; lastName?: string }; email?: string };
+        }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const clientSecret = await generateClientSecret();
+
+                // Exchange code for tokens
+                const tokenResponse = await fetch("https://appleid.apple.com/auth/token", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: new URLSearchParams({
+                        client_id: config.clientId,
+                        client_secret: clientSecret,
+                        code: payload.code,
+                        grant_type: "authorization_code",
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Apple access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { id_token: string };
+
+                // Decode the id_token (JWT) to get user info.
+                // Apple's id_token is a standard JWT — we only need the payload.
+                const [, payloadB64] = tokenData.id_token.split(".");
+                const decoded = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8")) as {
+                    sub: string;
+                    email?: string;
+                    email_verified?: string | boolean;
+                };
+
+                // Apple only sends the user's name on the FIRST authorization.
+                // Subsequent logins only have the id_token. The frontend should pass
+                // the user object from the first auth for us to capture the name.
+                const email = decoded.email || payload.user?.email;
+                if (!email) {
+                    console.error("Apple user has no email");
+                    return null;
+                }
+
+                let displayName: string | null = null;
+                if (payload.user?.name) {
+                    const parts = [payload.user.name.firstName, payload.user.name.lastName].filter(Boolean);
+                    displayName = parts.length > 0 ? parts.join(" ") : null;
+                }
+
+                return {
+                    providerId: decoded.sub,
+                    email,
+                    displayName,
+                    photoUrl: null // Apple does not provide a profile photo
+                };
+            } catch (error) {
+                console.error("Apple OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}