@rebasepro/server-core 0.0.1-canary.f81da60 → 0.1.0

package/packages/utils/node_modules/esbuild/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "esbuild",
+  "version": "0.21.5",
+  "description": "An extremely fast JavaScript and CSS bundler and minifier.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evanw/esbuild.git"
+  },
+  "scripts": {
+    "postinstall": "node install.js"
+  },
+  "main": "lib/main.js",
+  "types": "lib/main.d.ts",
+  "engines": {
+    "node": ">=12"
+  },
+  "bin": {
+    "esbuild": "bin/esbuild"
+  },
+  "optionalDependencies": {
+    "@esbuild/aix-ppc64": "0.21.5",
+    "@esbuild/android-arm": "0.21.5",
+    "@esbuild/android-arm64": "0.21.5",
+    "@esbuild/android-x64": "0.21.5",
+    "@esbuild/darwin-arm64": "0.21.5",
+    "@esbuild/darwin-x64": "0.21.5",
+    "@esbuild/freebsd-arm64": "0.21.5",
+    "@esbuild/freebsd-x64": "0.21.5",
+    "@esbuild/linux-arm": "0.21.5",
+    "@esbuild/linux-arm64": "0.21.5",
+    "@esbuild/linux-ia32": "0.21.5",
+    "@esbuild/linux-loong64": "0.21.5",
+    "@esbuild/linux-mips64el": "0.21.5",
+    "@esbuild/linux-ppc64": "0.21.5",
+    "@esbuild/linux-riscv64": "0.21.5",
+    "@esbuild/linux-s390x": "0.21.5",
+    "@esbuild/linux-x64": "0.21.5",
+    "@esbuild/netbsd-x64": "0.21.5",
+    "@esbuild/openbsd-x64": "0.21.5",
+    "@esbuild/sunos-x64": "0.21.5",
+    "@esbuild/win32-arm64": "0.21.5",
+    "@esbuild/win32-ia32": "0.21.5",
+    "@esbuild/win32-x64": "0.21.5"
+  },
+  "license": "MIT"
+}

package/src/api/errors.ts

@@ -120,10 +120,11 @@ export const errorHandler: ErrorHandler = (err, c) => {
         `❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}`
     );
 
-    // Suppress the huge stack trace for known missing schema errors (it's noisy and not a code bug)
+    // Suppress the huge stack trace for known DB errors (it's noisy and leaks SQL)
     const causePg = (error.cause && typeof error.cause === "object") ? (error.cause as PgLikeError) : undefined;
     const pgErrorCode = causePg?.code || error.code;
-    if (pgErrorCode !== "42703" && pgErrorCode !== "42P01") {
+    const suppressStack = pgErrorCode === "42703" || pgErrorCode === "42P01" || (statusCode < 500 && code === "BAD_REQUEST");
+    if (!suppressStack) {
         console.error(error.stack || error);
     }
 

package/src/api/server.ts

@@ -69,8 +69,11 @@ export class RebaseApiServer {
      * Setup Hono middleware
      */
     private setupMiddleware(): void {
-        // Security headers
-        this.router.use("/*", secureHeaders());
+        // Security headers — use same-origin-allow-popups for COOP so that
+        // OAuth popup flows (Google, etc.) can postMessage back to the opener.
+        this.router.use("/*", secureHeaders({
+            crossOriginOpenerPolicy: "same-origin-allow-popups"
+        }));
 
         // CORS — only applied if explicitly configured via `cors` option.
         // If omitted, the user is expected to configure CORS on their own

package/src/auth/google-oauth.ts

@@ -10,26 +10,69 @@ export interface GoogleUserInfo {
     emailVerified: boolean;
 }
 
+export interface GoogleProviderConfig {
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret from Google Cloud Console.
+     *
+     * Required for the **authorization code flow** (Path 3), where the
+     * frontend sends an authorization `code` and the backend exchanges it
+     * server-side for tokens. This is the most secure flow because tokens
+     * never touch the browser.
+     *
+     * When omitted, only ID-token and access-token verification are available
+     * (Paths 1 & 2), which rely on the frontend obtaining tokens directly.
+     */
+    clientSecret?: string;
+}
+
 /**
  * Creates a Google OAuth Provider integration.
- * Supports both ID-token verification (One Tap / renderButton) and
- * access-token verification (popup via initTokenClient).
+ *
+ * Supports three verification paths:
+ *
+ * **Path 1 – ID Token** (One Tap / Sign In With Google button):
+ *   Frontend sends `idToken`. Backend verifies cryptographically using
+ *   Google's public keys. No secret required.
+ *
+ * **Path 2 – Access Token** (popup via `initTokenClient`):
+ *   Frontend sends `accessToken`. Backend validates by calling Google's
+ *   userinfo endpoint. No secret required.
+ *
+ * **Path 3 – Authorization Code** (most secure, requires `clientSecret`):
+ *   Frontend sends `code` + `redirectUri`. Backend exchanges the code
+ *   server-side for an ID token using `clientId` + `clientSecret`, then
+ *   verifies the ID token. Tokens never touch the browser.
  */
-export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken?: string; accessToken?: string }> {
-    const googleClient = new OAuth2Client(clientId);
+export function createGoogleProvider(config: GoogleProviderConfig | string): OAuthProvider<{
+    idToken?: string;
+    accessToken?: string;
+    code?: string;
+    redirectUri?: string;
+}> {
+    const clientId = typeof config === "string" ? config : config.clientId;
+    const clientSecret = typeof config === "string" ? undefined : config.clientSecret;
+    const googleClient = new OAuth2Client(clientId, clientSecret);
 
     return {
         id: "google",
         schema: z.object({
             idToken: z.string().min(1).optional(),
-            accessToken: z.string().min(1).optional()
+            accessToken: z.string().min(1).optional(),
+            code: z.string().min(1).optional(),
+            redirectUri: z.string().min(1).optional()
         }).refine(
-            (data) => data.idToken || data.accessToken,
-            { message: "Either idToken or accessToken is required" }
+            (data) => data.idToken || data.accessToken || (data.code && data.redirectUri),
+            { message: "One of idToken, accessToken, or code+redirectUri is required" }
         ),
-        verify: async (payload: { idToken?: string; accessToken?: string }): Promise<OAuthProviderProfile | null> => {
+        verify: async (payload: {
+            idToken?: string;
+            accessToken?: string;
+            code?: string;
+            redirectUri?: string;
+        }): Promise<OAuthProviderProfile | null> => {
             try {
-                // Path 1: verify an ID token (legacy / One Tap)
+                // Path 1: verify an ID token (One Tap / renderButton)
                 if (payload.idToken) {
                     const ticket = await googleClient.verifyIdToken({
                         idToken: payload.idToken,
@@ -38,7 +81,7 @@ export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken?
 
                     const content = ticket.getPayload();
                     if (!content) {
-                        return null;
+                        throw new Error("Google ID token payload was empty");
                     }
 
                     return {
@@ -56,8 +99,7 @@ export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken?
                         { headers: { Authorization: `Bearer ${payload.accessToken}` } }
                     );
                     if (!res.ok) {
-                        console.error("Google userinfo request failed:", res.status);
-                        return null;
+                        throw new Error(`Google userinfo request failed with status ${res.status}`);
                     }
                     const info = await res.json() as {
                         sub: string;
@@ -66,7 +108,7 @@ export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken?
                         picture?: string;
                     };
                     if (!info.sub || !info.email) {
-                        return null;
+                        throw new Error("Google userinfo response missing sub or email");
                     }
                     return {
                         providerId: info.sub,
@@ -76,12 +118,101 @@ export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken?
                     };
                 }
 
-                return null;
+                // Path 3: authorization code exchange (most secure)
+                // The frontend obtained a one-time authorization code via the
+                // Google OAuth consent screen. We exchange it server-side for
+                // tokens, so the access/id tokens never touch the browser.
+                if (payload.code && payload.redirectUri) {
+                    if (!clientSecret) {
+                        throw new Error(
+                            "Google authorization code flow requires clientSecret. " +
+                            "Configure GOOGLE_CLIENT_SECRET in your environment."
+                        );
+                    }
+
+                    // Exchange the authorization code for tokens
+                    const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+                        method: "POST",
+                        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                        body: new URLSearchParams({
+                            code: payload.code,
+                            client_id: clientId,
+                            client_secret: clientSecret,
+                            redirect_uri: payload.redirectUri,
+                            grant_type: "authorization_code"
+                        })
+                    });
+
+                    if (!tokenResponse.ok) {
+                        const errorBody = await tokenResponse.text();
+                        throw new Error(`Google token exchange failed (${tokenResponse.status}): ${errorBody}`);
+                    }
+
+                    const tokenData = await tokenResponse.json() as {
+                        id_token?: string;
+                        access_token?: string;
+                        error?: string;
+                        error_description?: string;
+                    };
+
+                    if (tokenData.error) {
+                        throw new Error(`Google token exchange error: ${tokenData.error} – ${tokenData.error_description || "no details"}`);
+                    }
+
+                    // Prefer verifying the ID token (cryptographic verification)
+                    if (tokenData.id_token) {
+                        const ticket = await googleClient.verifyIdToken({
+                            idToken: tokenData.id_token,
+                            audience: clientId
+                        });
+
+                        const content = ticket.getPayload();
+                        if (!content) {
+                            throw new Error("Google ID token payload was empty after code exchange");
+                        }
+
+                        return {
+                            providerId: content.sub,
+                            email: content.email || "",
+                            displayName: content.name || null,
+                            photoUrl: content.picture || null
+                        };
+                    }
+
+                    // Fallback: use the access token to fetch userinfo
+                    if (tokenData.access_token) {
+                        const userInfoRes = await fetch(
+                            "https://www.googleapis.com/oauth2/v3/userinfo",
+                            { headers: { Authorization: `Bearer ${tokenData.access_token}` } }
+                        );
+                        if (!userInfoRes.ok) {
+                            throw new Error(`Google userinfo request failed after code exchange (${userInfoRes.status})`);
+                        }
+                        const info = await userInfoRes.json() as {
+                            sub: string;
+                            email?: string;
+                            name?: string;
+                            picture?: string;
+                        };
+                        if (!info.sub || !info.email) {
+                            return null;
+                        }
+                        return {
+                            providerId: info.sub,
+                            email: info.email,
+                            displayName: info.name || null,
+                            photoUrl: info.picture || null
+                        };
+                    }
+
+                    throw new Error("Google token exchange returned neither id_token nor access_token");
+                }
+
+                throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
             } catch (error) {
-                console.error("Failed to verify Google token:", error);
-                return null;
+                console.error("Google OAuth verification failed:", error);
+                throw error;
             }
         }
     };
 }
-

package/src/auth/index.ts

@@ -9,6 +9,7 @@ export type { PasswordValidationResult } from "./password";
 
 // OAuth Providers
 export { createGoogleProvider } from "./google-oauth";
+export type { GoogleProviderConfig } from "./google-oauth";
 export { createLinkedinProvider } from "./linkedin-oauth";
 export { createGitHubProvider } from "./github-oauth";
 export { createMicrosoftProvider } from "./microsoft-oauth";

package/src/auth/routes.ts

@@ -233,8 +233,16 @@ export function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
             displayName: displayName || undefined
         });
 
-        // Assign configured default role (never auto-assign admin via registration)
-        if (config.defaultRole) {
+        // Auto-bootstrap: if this is the very first user in the system, promote to admin.
+        // This avoids the chicken-and-egg problem where the first user has no permissions
+        // and no way to access the bootstrap endpoint from the UI.
+        const existingUsers = await authRepo.listUsers();
+        const isFirstUser = existingUsers.length === 1 && existingUsers[0].id === user.id;
+
+        if (isFirstUser) {
+            await authRepo.setUserRoles(user.id, ["admin"]);
+        } else if (config.defaultRole) {
+            // Assign configured default role (never auto-assign admin via registration)
             await authRepo.assignDefaultRole(user.id, config.defaultRole);
         }
 
@@ -289,7 +297,13 @@ displayName: user.displayName });
             router.post(`/${provider.id}`, defaultAuthLimiter, async (c) => {
                 const payload = parseBody(provider.schema, await c.req.json());
 
-                const externalUser = await provider.verify(payload);
+                let externalUser;
+                try {
+                    externalUser = await provider.verify(payload);
+                } catch (err: unknown) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    throw ApiError.unauthorized(`${provider.id} login failed: ${msg}`, "OAUTH_ERROR");
+                }
                 if (!externalUser) {
                     throw ApiError.unauthorized(`Invalid ${provider.id} credentials`, "INVALID_TOKEN");
                 }
@@ -320,8 +334,14 @@ displayName: user.displayName });
 
                         await authRepo.linkUserIdentity(user.id, provider.id, externalUser.providerId, { email: externalUser.email });
 
-                        // Assign configured default role (never auto-assign admin via registration)
-                        if (config.defaultRole) {
+                        // Auto-bootstrap: first user in the system gets admin
+                        const allUsers = await authRepo.listUsers();
+                        const isFirstUser = allUsers.length === 1 && allUsers[0].id === user.id;
+
+                        if (isFirstUser) {
+                            await authRepo.setUserRoles(user.id, ["admin"]);
+                        } else if (config.defaultRole) {
+                            // Assign configured default role (never auto-assign admin via registration)
                             await authRepo.assignDefaultRole(user.id, config.defaultRole);
                         }
 

package/src/collections/loader.ts

@@ -26,9 +26,9 @@ export async function loadCollectionsFromDirectory(directory: string): Promise<E
                 try {
                     const fileUrl = pathToFileURL(filePath).href;
 
-                    // Use new Function to compile dynamic import natively and bypass tsc converting import() to require()
-                    const dynamicImport = new Function("url", "return import(url)");
-                    const module = await dynamicImport(fileUrl);
+                    // Use standard import() so that tsx/loader hooks can
+                    // resolve .ts files and workspace bare-specifiers.
+                    const module = await import(fileUrl);
 
                     // Expect the collection to be the default export
                     if (module && module.default) {

package/src/init.ts

@@ -43,7 +43,7 @@ export interface RebaseAuthConfig {
      */
     serviceKey?: string;
     email?: EmailConfig;
-    google?: { clientId: string };
+    google?: { clientId: string; clientSecret?: string };
     linkedin?: { clientId: string; clientSecret: string };
     github?: { clientId: string; clientSecret: string };
     microsoft?: { clientId: string; clientSecret: string; tenantId?: string };
@@ -355,7 +355,7 @@ collectionRegistry });
 
         if (config.auth.google?.clientId) {
             const { createGoogleProvider } = await import("./auth");
-            oauthProviders.push(createGoogleProvider(config.auth.google.clientId));
+            oauthProviders.push(createGoogleProvider(config.auth.google));
         }
 
         if (config.auth.linkedin?.clientId && config.auth.linkedin?.clientSecret) {
@@ -582,6 +582,18 @@ collectionRegistry });
     _initRebase(serverClient);
     logger.info("Rebase singleton initialized");
 
+    // Retroactively inject the server client into the driver so that
+    // entity callbacks receive `context.client` at runtime.
+    // The driver is created before the client (which depends on the mounted
+    // Hono app), so we set it here, mirroring the historyService injection above.
+    if (defaultDriverResult.internals) {
+        const internals = defaultDriverResult.internals as Record<string, unknown>;
+        const driver = internals.driver as Record<string, unknown> | undefined;
+        if (driver && "client" in driver) {
+            driver.client = serverClient;
+        }
+    }
+
     // 5. Mount Custom Functions
     if (config.functionsDir) {
         const { loadFunctionsFromDirectory } = await import("./functions/function-loader");