@rebasepro/server-core 0.0.1-canary.4d4fb3e → 0.0.1-canary.ca2cb6e

package/src/api/rest/api-generator.ts

@@ -60,6 +60,7 @@ export class RestApiGenerator {
         this.router.get(basePath, async (c) => {
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
+            const searchString = queryDict.searchString as string | undefined;
 
             const driver = c.get("driver") || this.driver;
             const fetchService = this.getFetchService(driver);
@@ -72,14 +73,15 @@ export class RestApiGenerator {
                     {
                         filter: queryOptions.where as FetchCollectionProps["filter"],
                         limit: queryOptions.limit,
+                        offset: queryOptions.offset,
                         orderBy: queryOptions.orderBy?.[0]?.field,
                         order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-                        searchString: queryDict.searchString as string | undefined,
+                        searchString
                     },
                     queryOptions.include
                 );
 
-                const total = await this.countRawEntities(driver, resolvedCollection, queryOptions);
+                const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 
                 return c.json({
                     data: entities,
@@ -92,9 +94,10 @@ export class RestApiGenerator {
                 });
             }
 
-            // Fallback for non-Postgres drivers
-            const entities = await this.fetchRawCollection(driver, resolvedCollection, queryOptions);
-            const total = await this.countRawEntities(driver, resolvedCollection, queryOptions);
+            // Fallback path
+            const entities = await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString);
+
+            const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 
             return c.json({
                 data: entities,
@@ -146,7 +149,7 @@ export class RestApiGenerator {
             try {
                 const driver = c.get("driver") || this.driver;
                 const path = collection.slug;
-                
+
                 const body = await c.req.json().catch(() => ({}));
 
                 const entity = await driver.saveEntity({
@@ -265,7 +268,8 @@ export class RestApiGenerator {
                 return { collectionPath: segments.join("/") };
             } else {
                 const entityId = segments.pop()!;
-                return { collectionPath: segments.join("/"), entityId };
+                return { collectionPath: segments.join("/"),
+entityId };
             }
         };
 
@@ -426,7 +430,7 @@ export class RestApiGenerator {
     /**
      * Fetch raw collection data without Entity wrapper (fallback for non-Postgres)
      */
-    private async fetchRawCollection(driver: DataDriver, collection: EntityCollection, queryOptions: QueryOptions) {
+    private async fetchRawCollection(driver: DataDriver, collection: EntityCollection, queryOptions: QueryOptions, searchString?: string) {
         const entities = await driver.fetchCollection({
             path: collection.slug,
             collection,
@@ -434,7 +438,8 @@ export class RestApiGenerator {
             limit: queryOptions.limit,
             orderBy: queryOptions.orderBy?.[0]?.field,
             order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-            startAfter: queryOptions.offset ? String(queryOptions.offset) : undefined
+            startAfter: queryOptions.offset ? String(queryOptions.offset) : undefined,
+            searchString
         });
 
         return entities.map(entity => this.flattenEntity(entity));
@@ -443,11 +448,12 @@ export class RestApiGenerator {
     /**
      * Count raw entities for a collection
      */
-    private async countRawEntities(driver: DataDriver, collection: EntityCollection, queryOptions: QueryOptions): Promise<number> {
+    private async countRawEntities(driver: DataDriver, collection: EntityCollection, queryOptions: QueryOptions, searchString?: string): Promise<number> {
         return driver.countEntities ? await driver.countEntities({
             path: collection.slug,
             collection,
-            filter: queryOptions.where as FetchCollectionProps["filter"]
+            filter: queryOptions.where as FetchCollectionProps["filter"],
+            searchString
         }) : 0;
     }
 

package/src/api/rest/query-parser.ts

@@ -57,7 +57,7 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
     }
 
     // PostgREST style filtering
-    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "where", "include", "fields"];
+    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "where", "include", "fields", "searchString"];
     for (const [key, rawValue] of Object.entries(query)) {
         if (reservedQueryKeys.includes(key)) continue;
 

package/src/api/schema-editor-routes.ts

@@ -1,9 +1,11 @@
 import { Hono } from "hono";
 import { AstSchemaEditor } from "./ast-schema-editor";
+import { errorHandler } from "./errors";
 import { HonoEnv } from "./types";
 
 export function createSchemaEditorRoutes(collectionsDir: string): Hono<HonoEnv> {
     const router = new Hono<HonoEnv>();
+    router.onError(errorHandler);
     const editor = new AstSchemaEditor(collectionsDir);
 
     router.post("/property/save", async (c) => {

package/src/api/server.ts

@@ -39,7 +39,7 @@ export class RebaseApiServer {
 
         this.app = new Hono<HonoEnv>();
         this.router = new Hono<HonoEnv>();
-        
+
         this.setupMiddleware();
     }
 
@@ -57,7 +57,7 @@ export class RebaseApiServer {
         server.setupRoutes();
         // Since we mount routes directly to router, we can let consumer attach it
         server.app.route("/", server.router);
-        
+
         // Hono global error handler on the root app
         server.app.onError(errorHandler);
         server.router.onError(errorHandler);
@@ -119,7 +119,7 @@ export class RebaseApiServer {
                 properties: Object.keys(col.properties),
                 relations: (col as EntityCollection & { relations?: Relation[] }).relations?.map((r: Relation) => ({
                     relationName: r.relationName,
-                    target: typeof r.target === 'function' ? r.target().slug : r.target,
+                    target: typeof r.target === "function" ? r.target().slug : r.target,
                     cardinality: r.cardinality,
                     direction: r.direction
                 })) || []
@@ -187,7 +187,10 @@ export class RebaseApiServer {
 
         // OpenAPI endpoint
         this.router.get(`${basePath}/docs`, (c) => {
-            const openApiSpec = generateOpenApiSpec(this.config.collections || [], this.config.basePath);
+            const openApiSpec = generateOpenApiSpec(this.config.collections || [], {
+                basePath: this.config.basePath,
+                requireAuth: this.config.requireAuth ?? true
+            });
             return c.json(openApiSpec);
         });
 
@@ -234,7 +237,7 @@ export class RebaseApiServer {
     /**
      * Start the server (standalone mode) via @hono/node-server
      */
-    listen(port: number = 3000, callback?: () => void): void {
+    listen(port = 3000, callback?: () => void): void {
         serve({
             fetch: this.app.fetch,
             port

package/src/api/types.ts

@@ -74,7 +74,7 @@ export interface QueryOptions {
     limit?: number;
     offset?: number;
     where?: Record<string, unknown>;
-    orderBy?: Array<{ field: string; direction: 'asc' | 'desc' }>;
+    orderBy?: Array<{ field: string; direction: "asc" | "desc" }>;
     include?: string[];
     /** Columns to return in the response (field-level selection) */
     fields?: string[];

package/src/auth/admin-routes.ts

@@ -1,9 +1,18 @@
 import { Hono } from "hono";
-import { ApiError } from "../api/errors";
+import { ApiError, errorHandler } from "../api/errors";
 import type { AuthRepository } from "./interfaces";
-import { requireAuth, requireAdmin } from "./middleware";
+import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
 import { hashPassword, validatePasswordStrength } from "./password";
 import { AuthModuleConfig } from "./routes";
+
+interface AdminRouteOptions extends AuthModuleConfig {
+    serviceKey?: string;
+    /**
+     * Callback to persistently mark bootstrap as completed.
+     * Invoked after the first admin user is promoted via POST /admin/bootstrap.
+     */
+    setBootstrapCompleted?: () => Promise<void>;
+}
 import { HonoEnv } from "../api/types";
 import { randomBytes, createHash } from "crypto";
 import { getUserInvitationTemplate, getPasswordResetTemplate } from "../email/templates";
@@ -51,20 +60,45 @@ function hashToken(token: string): string {
 /**
  * Create admin routes for user and role management
  */
-export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
+export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
     const router = new Hono<HonoEnv>();
     const authRepo = config.authRepo;
     const { emailService, emailConfig } = config;
 
-    // Apply auth middleware to all routes
-    router.use("/*", requireAuth);
-
+    // Attach Rebase error handler to ensure exceptions are correctly formatted
+    // instead of caught by Hono's default error handler from the sub-router.
+    router.onError(errorHandler);
+
+    // Apply auth middleware to all routes (service-key-aware when configured)
+    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
+
+    /**
+     * POST /admin/bootstrap
+     *
+     * One-time endpoint to promote the calling user to admin.
+     * Guarded by three layers:
+     *   1. Authentication (handled by middleware above)
+     *   2. Persistent `bootstrap_completed` flag (when `setBootstrapCompleted` is provided)
+     *   3. Database check — no existing admin users
+     *
+     * Once invoked successfully the persistent flag is set, permanently disabling
+     * this endpoint even if all admin users are later deleted.
+     */
     router.post("/bootstrap", async (c) => {
         const user = c.get("user");
         if (!user || typeof user !== "object") {
             throw ApiError.unauthorized("Not authenticated");
         }
 
+        // ── Guard 1: persistent flag ──────────────────────────────────
+        if (config.isBootstrapCompleted) {
+            const alreadyDone = await config.isBootstrapCompleted();
+            if (alreadyDone) {
+                throw ApiError.forbidden("Bootstrap has already been completed.", "BOOTSTRAP_COMPLETED");
+            }
+        }
+
+        // ── Guard 2: no existing admin users ─────────────────────────
         const users = await authRepo.listUsers();
         let hasAdmin = false;
 
@@ -77,15 +111,21 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         }
 
         if (hasAdmin) {
-            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.");
+            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
         }
 
+        // ── Promote caller ───────────────────────────────────────────
         const userId = "userId" in user ? user.userId : undefined;
         if (!userId) {
             throw ApiError.unauthorized("User ID not found in auth context");
         }
         await authRepo.setUserRoles(userId, ["admin"]);
 
+        // ── Set persistent flag ──────────────────────────────────────
+        if (config.setBootstrapCompleted) {
+            await config.setBootstrapCompleted();
+        }
+
         return c.json({
             success: true,
             message: "You are now an admin",
@@ -113,7 +153,8 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
                 offset,
                 search: search || undefined,
                 orderBy: orderBy || undefined,
-                orderDir: orderDir || undefined
+                orderDir: orderDir || undefined,
+                roleId: c.req.query("role") || undefined
             });
 
             const usersWithRoles = await Promise.all(
@@ -124,7 +165,6 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
                         email: u.email,
                         displayName: u.displayName,
                         photoURL: u.photoUrl,
-                        provider: u.provider,
                         roles,
                         createdAt: u.createdAt,
                         updatedAt: u.updatedAt
@@ -150,7 +190,6 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
                     email: u.email,
                     displayName: u.displayName,
                     photoURL: u.photoUrl,
-                    provider: u.provider,
                     roles,
                     createdAt: u.createdAt,
                     updatedAt: u.updatedAt
@@ -174,7 +213,6 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
                 email: result.user.email,
                 displayName: result.user.displayName,
                 photoURL: result.user.photoUrl,
-                provider: result.user.provider,
                 roles: result.roles.map(r => r.id),
                 createdAt: result.user.createdAt,
                 updatedAt: result.user.updatedAt
@@ -207,8 +245,7 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
         const user = await authRepo.createUser({
             email: email.toLowerCase(),
             displayName: displayName || null,
-            passwordHash,
-            provider: "email"
+            passwordHash
         });
 
         if (roles && Array.isArray(roles) && roles.length > 0) {
@@ -239,8 +276,10 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
                 const appName = emailConfig?.appName || "Rebase";
                 const templateFn = emailConfig?.templates?.userInvitation;
                 const emailContent = templateFn
-                    ? templateFn(setPasswordUrl, { email: user.email, displayName: user.displayName })
-                    : getUserInvitationTemplate(setPasswordUrl, { email: user.email, displayName: user.displayName }, appName);
+                    ? templateFn(setPasswordUrl, { email: user.email,
+displayName: user.displayName })
+                    : getUserInvitationTemplate(setPasswordUrl, { email: user.email,
+displayName: user.displayName }, appName);
 
                 await emailService!.send({
                     to: user.email,
@@ -297,8 +336,10 @@ export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
                 const appName = emailConfig?.appName || "Rebase";
                 const templateFn = emailConfig?.templates?.passwordReset;
                 const emailContent = templateFn
-                    ? templateFn(setPasswordUrl, { email: existing.email, displayName: existing.displayName })
-                    : getPasswordResetTemplate(setPasswordUrl, { email: existing.email, displayName: existing.displayName }, appName);
+                    ? templateFn(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName })
+                    : getPasswordResetTemplate(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName }, appName);
 
                 await emailService!.send({
                     to: existing.email,

package/src/auth/apple-oauth.ts

@@ -0,0 +1,130 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+import { createPrivateKey } from "crypto";
+import { SignJWT } from "jose";
+
+/**
+ * Creates an Apple Sign In OAuth Provider integration.
+ *
+ * Apple requires a client secret that is a signed JWT, regenerated on each
+ * token exchange (valid up to 6 months). This provider handles that automatically.
+ *
+ * Required Apple Developer configuration:
+ * - Services ID (clientId)
+ * - Key ID from the private key registered with Apple
+ * - Team ID from Apple Developer account
+ * - Private key (.p8 file contents) downloaded from Apple Developer portal
+ */
+export function createAppleProvider(config: {
+    clientId: string;
+    teamId: string;
+    keyId: string;
+    /** The raw PEM contents of the .p8 private key file */
+    privateKey: string;
+}): OAuthProvider<{
+            code: string;
+            redirectUri: string;
+            user?: { name?: { firstName?: string; lastName?: string }; email?: string };
+        }> {
+    /**
+     * Generate a client_secret JWT signed with the Apple private key.
+     * Apple requires this instead of a static client_secret.
+     */
+    async function generateClientSecret(): Promise<string> {
+        const key = createPrivateKey({
+            key: config.privateKey,
+            format: "pem"
+        });
+
+        const now = Math.floor(Date.now() / 1000);
+
+        return new SignJWT({})
+            .setProtectedHeader({ alg: "ES256",
+kid: config.keyId })
+            .setIssuer(config.teamId)
+            .setIssuedAt(now)
+            .setExpirationTime(now + 86400 * 180) // 6 months max
+            .setAudience("https://appleid.apple.com")
+            .setSubject(config.clientId)
+            .sign(key);
+    }
+
+    return {
+        id: "apple",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required"),
+            /** Apple sends user info only on first authorization; the frontend must forward it. */
+            user: z.object({
+                name: z.object({
+                    firstName: z.string().optional(),
+                    lastName: z.string().optional()
+                }).optional(),
+                email: z.string().email().optional()
+            }).optional()
+        }),
+        verify: async (payload: {
+            code: string;
+            redirectUri: string;
+            user?: { name?: { firstName?: string; lastName?: string }; email?: string };
+        }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const clientSecret = await generateClientSecret();
+
+                // Exchange code for tokens
+                const tokenResponse = await fetch("https://appleid.apple.com/auth/token", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: new URLSearchParams({
+                        client_id: config.clientId,
+                        client_secret: clientSecret,
+                        code: payload.code,
+                        grant_type: "authorization_code",
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Apple access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { id_token: string };
+
+                // Decode the id_token (JWT) to get user info.
+                // Apple's id_token is a standard JWT — we only need the payload.
+                const [, payloadB64] = tokenData.id_token.split(".");
+                const decoded = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8")) as {
+                    sub: string;
+                    email?: string;
+                    email_verified?: string | boolean;
+                };
+
+                // Apple only sends the user's name on the FIRST authorization.
+                // Subsequent logins only have the id_token. The frontend should pass
+                // the user object from the first auth for us to capture the name.
+                const email = decoded.email || payload.user?.email;
+                if (!email) {
+                    console.error("Apple user has no email");
+                    return null;
+                }
+
+                let displayName: string | null = null;
+                if (payload.user?.name) {
+                    const parts = [payload.user.name.firstName, payload.user.name.lastName].filter(Boolean);
+                    displayName = parts.length > 0 ? parts.join(" ") : null;
+                }
+
+                return {
+                    providerId: decoded.sub,
+                    email,
+                    displayName,
+                    photoUrl: null // Apple does not provide a profile photo
+                };
+            } catch (error) {
+                console.error("Apple OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/bitbucket-oauth.ts

@@ -0,0 +1,82 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
+ */
+export function createBitbucketProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "bitbucket",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
+
+                const tokenResponse = await fetch("https://bitbucket.org/site/oauth2/access_token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Authorization": `Basic ${basicAuth}`
+                    },
+                    body: new URLSearchParams({
+                        grant_type: "authorization_code",
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Bitbucket access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+                const accessToken = tokenData.access_token;
+
+                const profileResponse = await fetch("https://api.bitbucket.org/2.0/user", {
+                    headers: { "Authorization": `Bearer ${accessToken}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Bitbucket user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const p = await profileResponse.json() as {
+                    uuid: string; display_name?: string; username?: string;
+                    links?: { avatar?: { href?: string } };
+                };
+
+                // Bitbucket doesn't return email in user profile — fetch from /emails endpoint
+                const emailsResponse = await fetch("https://api.bitbucket.org/2.0/user/emails", {
+                    headers: { "Authorization": `Bearer ${accessToken}` }
+                });
+
+                let email: string | null = null;
+                if (emailsResponse.ok) {
+                    const emailData = await emailsResponse.json() as {
+                        values: Array<{ email: string; is_primary: boolean; is_confirmed: boolean }>;
+                    };
+                    const primary = emailData.values.find(e => e.is_primary && e.is_confirmed)
+                        || emailData.values.find(e => e.is_confirmed);
+                    email = primary?.email || null;
+                }
+
+                if (!email) { console.error("Bitbucket user has no verified email"); return null; }
+
+                return {
+                    providerId: p.uuid,
+                    email,
+                    displayName: p.display_name || p.username || null,
+                    photoUrl: p.links?.avatar?.href || null
+                };
+            } catch (error) {
+                console.error("Bitbucket OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/discord-oauth.ts

@@ -0,0 +1,83 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Discord OAuth2 Provider integration.
+ *
+ * Uses the authorization code flow. Requires the "identify" and "email"
+ * scopes to retrieve the user's email and profile information.
+ */
+export function createDiscordProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "discord",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenResponse = await fetch("https://discord.com/api/v10/oauth2/token", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: new URLSearchParams({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        grant_type: "authorization_code",
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Discord access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+                const accessToken = tokenData.access_token;
+
+                // Fetch user profile
+                const profileResponse = await fetch("https://discord.com/api/v10/users/@me", {
+                    headers: { "Authorization": `Bearer ${accessToken}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Discord user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    id: string;
+                    username: string;
+                    global_name?: string | null;
+                    avatar?: string | null;
+                    email?: string | null;
+                    verified?: boolean;
+                };
+
+                if (!profileData.email) {
+                    console.error("Discord user has no email (email scope may not have been granted)");
+                    return null;
+                }
+
+                // Build avatar URL
+                let photoUrl: string | null = null;
+                if (profileData.avatar) {
+                    const ext = profileData.avatar.startsWith("a_") ? "gif" : "png";
+                    photoUrl = `https://cdn.discordapp.com/avatars/${profileData.id}/${profileData.avatar}.${ext}?size=256`;
+                }
+
+                return {
+                    providerId: profileData.id,
+                    email: profileData.email,
+                    displayName: profileData.global_name || profileData.username || null,
+                    photoUrl
+                };
+            } catch (error) {
+                console.error("Discord OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}