@rebasepro/server-core 0.2.3 → 0.2.4

package/dist/types/src/types/translations.d.ts

@@ -105,6 +105,12 @@ export interface RebaseTranslations {
     navigation_drawer: string;
     collapse: string;
     expand: string;
+    /** Tooltip for the language switcher in the drawer footer */
+    change_language?: string;
+    /** Tooltip for the theme toggle in the drawer footer */
+    toggle_theme?: string;
+    /** Aria label for the user menu trigger in the drawer footer */
+    user_menu?: string;
     error: string;
     error_uploading_file: string;
     error_deleting: string;
@@ -426,18 +432,28 @@ export interface RebaseTranslations {
     deleted: string;
     select_reference: string;
     select_references: string;
-    account_settings: string;
-    profile: string;
-    sessions: string;
-    display_name: string;
-    photo_url: string;
-    save_profile: string;
-    saving: string;
-    no_active_sessions: string;
-    revoking: string;
-    revoke_all_sessions: string;
-    unknown_device: string;
-    current: string;
+    account_settings?: string;
+    profile?: string;
+    sessions?: string;
+    security?: string;
+    change_password?: string;
+    current_password?: string;
+    new_password?: string;
+    confirm_password?: string;
+    password_changed?: string;
+    passwords_dont_match?: string;
+    password_too_short?: string;
+    password_change_not_available?: string;
+    changing_password?: string;
+    display_name?: string;
+    photo_url?: string;
+    save_profile?: string;
+    saving?: string;
+    no_active_sessions?: string;
+    revoking?: string;
+    revoke_all_sessions?: string;
+    unknown_device?: string;
+    current?: string;
     role_id: string;
     role_name: string;
     add_reference: string;

package/dist/types/src/types/user_management_delegate.d.ts

@@ -104,15 +104,17 @@ export interface UserManagementDelegate<USER extends User = User> {
      * If true, the UI will allow the user to create the default roles (admin, editor, viewer).
      */
     allowDefaultRolesCreation?: boolean;
-    /**
-     * Should collection config permissions be included?
-     */
-    includeCollectionConfigPermissions?: boolean;
     /**
      * Optionally define roles for a given user. This is useful when the roles
      * are coming from a separate provider than the one issuing the tokens.
      */
     defineRolesFor?: (user: USER) => Promise<Role[] | undefined> | Role[] | undefined;
+    /**
+     * Whether any admin users exist. Used by the bootstrap banner to decide
+     * whether to prompt.  Populated via a lightweight check (e.g. `limit=1`
+     * query) instead of loading all users.
+     */
+    hasAdminUsers?: boolean;
     /**
      * Optional function to bootstrap an admin user.
      * Often used when the database is empty.

package/dist/types/src/users/roles.d.ts

@@ -11,12 +11,4 @@ export type Role = {
      * If this flag is true, the user can perform any action
      */
     isAdmin?: boolean;
-    /**
-     * Permissions related to editing the collections
-     */
-    config?: {
-        createCollections?: boolean;
-        editCollections?: boolean | "own";
-        deleteCollections?: boolean | "own";
-    };
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-core",
   "type": "module",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Database-Agnostic Backend Core for Rebase",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -50,13 +50,14 @@
     "hono": "^4.12.21",
     "jsonwebtoken": "^9.0.3",
     "nodemailer": "^6.10.1",
+    "sharp": "^0.34.5",
     "ts-morph": "27.0.2",
     "ws": "^8.20.1",
     "zod": "^3.25.76",
-    "@rebasepro/common": "0.2.3",
-    "@rebasepro/client": "0.2.3",
-    "@rebasepro/types": "0.2.3",
-    "@rebasepro/utils": "0.2.3"
+    "@rebasepro/client": "0.2.4",
+    "@rebasepro/types": "0.2.4",
+    "@rebasepro/utils": "0.2.4",
+    "@rebasepro/common": "0.2.4"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
@@ -67,6 +68,7 @@
     "@types/react-dom": "^19.2.3",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^4.7.0",
+    "cross-env": "^7.0.3",
     "jest": "^29.7.0",
     "ts-jest": "29.4.1",
     "typescript": "^5.9.3",
@@ -80,7 +82,7 @@
     "watch": "vite build --watch",
     "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json",
     "test:lint": "eslint \"src/**\" --quiet",
-    "test": "jest --passWithNoTests --forceExit",
+    "test": "cross-env NODE_OPTIONS=\"--experimental-vm-modules\" jest --passWithNoTests --forceExit",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }
 }

package/src/api/ast-schema-editor.ts

@@ -89,7 +89,7 @@ export class AstSchemaEditor {
             return "undefined";
         }
         if (typeof obj === "string") {
-            return `"${obj.replace(/"/g, '\\"')}"`;
+            return JSON.stringify(obj);
         }
         if (typeof obj === "number" || typeof obj === "boolean") {
             return String(obj);
@@ -127,7 +127,7 @@ export class AstSchemaEditor {
 
                                 if (isCode || name === "target" || name === "callbacks" || name === "permissions" || name === "securityRules") {
                                     // Preserve this property exactly as it was
-                                    const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : `"${name}"`;
+                                    const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
                                     preservedProps.push(`${keyStr}: ${init.getText()}`);
                                 }
                             }
@@ -139,7 +139,7 @@ export class AstSchemaEditor {
             if (keys.length === 0 && preservedProps.length === 0) return "{}";
 
             const props = keys.map(key => {
-                const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : `"${key}"`;
+                const keyStr = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
 
                 // If the value is an object, pass the old AST node to recurse
                 let childAstNode: ObjectLiteralExpression | undefined;
@@ -192,7 +192,7 @@ export class AstSchemaEditor {
                 }
             } else {
                 propsObj.addPropertyAssignment({
-                    name: /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyKey) ? propertyKey : `"${propertyKey}"`,
+                    name: /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyKey) ? propertyKey : JSON.stringify(propertyKey),
                     initializer: newInitializer
                 });
             }

package/src/api/errors.ts

@@ -115,15 +115,24 @@ export const errorHandler: ErrorHandler = (err, c) => {
         logMessage = `Database schema mismatch (${issue} missing): ${error.message}. Did you forget to run migrations ('pnpm db:push' or 'pnpm db:migrate')?`;
     }
 
-    // Unexpected errors — log at error level
-    console.error(
-        `❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}`
-    );
-
-    // Suppress the huge stack trace for known DB errors (it's noisy and leaks SQL)
     const causePg = (error.cause && typeof error.cause === "object") ? (error.cause as PgLikeError) : undefined;
     const pgErrorCode = causePg?.code || error.code;
-    const suppressStack = pgErrorCode === "42703" || pgErrorCode === "42P01" || (statusCode < 500 && code === "BAD_REQUEST");
+    const isDbSchemaMismatch = pgErrorCode === "42703" || pgErrorCode === "42P01";
+
+    if (isDbSchemaMismatch) {
+        // Database schema mismatch is logged as a warning instead of a fatal error
+        console.warn(
+            `⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}`
+        );
+    } else {
+        // Unexpected errors — log at error level
+        console.error(
+            `❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}`
+        );
+    }
+
+    // Suppress the huge stack trace for known DB errors (it's noisy and leaks SQL)
+    const suppressStack = isDbSchemaMismatch || (statusCode < 500 && code === "BAD_REQUEST");
     if (!suppressStack) {
         console.error(error.stack || error);
     }

package/src/api/logs-routes.ts

@@ -0,0 +1,129 @@
+import { Hono } from "hono";
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "./types";
+
+export interface LogEntry {
+    id: string;
+    timestamp: string;
+    level: "debug" | "info" | "warn" | "error";
+    source: "api" | "auth" | "storage" | "realtime" | "system";
+    message: string;
+    metadata?: Record<string, unknown>;
+}
+
+class LogRingBuffer {
+    private buffer: LogEntry[] = [];
+    private maxSize: number;
+    private idCounter = 0;
+
+    constructor(maxSize = 10000) {
+        this.maxSize = maxSize;
+    }
+
+    push(entry: Omit<LogEntry, "id">): void {
+        const id = `log_${++this.idCounter}`;
+        this.buffer.push({ ...entry, id });
+        if (this.buffer.length > this.maxSize) {
+            this.buffer.shift();
+        }
+    }
+
+    query(options: {
+        level?: string;
+        source?: string;
+        search?: string;
+        limit?: number;
+        offset?: number;
+        since?: string;
+    }): { entries: LogEntry[]; total: number } {
+        let filtered = this.buffer;
+
+        if (options.level) {
+            filtered = filtered.filter(e => e.level === options.level);
+        }
+        if (options.source) {
+            filtered = filtered.filter(e => e.source === options.source);
+        }
+        if (options.search) {
+            const searchLower = options.search.toLowerCase();
+            filtered = filtered.filter(e => e.message.toLowerCase().includes(searchLower));
+        }
+        if (options.since) {
+            const sinceValue = options.since;
+            filtered = filtered.filter(e => e.timestamp >= sinceValue);
+        }
+
+        // Newest first
+        const sorted = [...filtered].reverse();
+        const total = sorted.length;
+        const limit = options.limit || 100;
+        const offset = options.offset || 0;
+
+        return {
+            entries: sorted.slice(offset, offset + limit),
+            total
+        };
+    }
+
+    getLatest(count = 50): LogEntry[] {
+        return this.buffer.slice(-count).reverse();
+    }
+}
+
+// Global singleton
+export const logBuffer = new LogRingBuffer();
+
+/** Add a log entry */
+export function addLog(
+    level: LogEntry["level"],
+    source: LogEntry["source"],
+    message: string,
+    metadata?: Record<string, unknown>
+): void {
+    logBuffer.push({
+        timestamp: new Date().toISOString(),
+        level,
+        source,
+        message,
+        metadata
+    });
+}
+
+/** Hono middleware to log API requests */
+export function logMiddleware(): MiddlewareHandler<HonoEnv> {
+    return async (c, next) => {
+        const start = Date.now();
+        await next();
+        const duration = Date.now() - start;
+        addLog("info", "api", `${c.req.method} ${c.req.path} ${c.res.status} ${duration}ms`, {
+            method: c.req.method,
+            path: c.req.path,
+            status: c.res.status,
+            duration
+        });
+    };
+}
+
+const app = new Hono<HonoEnv>();
+
+// GET /api/logs — Query logs
+app.get("/", (c) => {
+    const query = c.req.query();
+    const result = logBuffer.query({
+        level: query.level,
+        source: query.source,
+        search: query.search,
+        limit: query.limit ? parseInt(query.limit) : undefined,
+        offset: query.offset ? parseInt(query.offset) : undefined,
+        since: query.since
+    });
+    return c.json(result);
+});
+
+// GET /api/logs/latest — Get latest logs (for real-time)
+app.get("/latest", (c) => {
+    const count = parseInt(c.req.query("count") || "50");
+    return c.json({ entries: logBuffer.getLatest(count) });
+});
+
+export default app;

package/src/api/rest/api-generator.ts

@@ -3,6 +3,8 @@ import { DataDriver, Entity, EntityCollection, FetchCollectionProps, DataHooks,
 import { QueryOptions, HonoEnv } from "../types";
 import { ApiError } from "../errors";
 import { parseQueryOptions } from "./query-parser";
+import { httpMethodToOperation, isOperationAllowed } from "../../auth/api-keys/api-key-permission-guard";
+import type { ApiKeyMasked } from "../../auth/api-keys/api-key-types";
 
 
 /**
@@ -47,6 +49,27 @@ export class RestApiGenerator {
         return this.router;
     }
 
+    /**
+     * Check API key permissions for a collection operation.
+     * Throws 403 if the key doesn't have the required permission.
+     * No-ops if the request is not authenticated via an API key.
+     */
+    private enforceApiKeyPermission(
+        c: { get: (key: string) => unknown; req: { method: string } },
+        collectionSlug: string,
+    ): void {
+        const apiKey = c.get("apiKey") as ApiKeyMasked | undefined;
+        if (!apiKey) return; // Not an API key request — skip
+
+        const operation = httpMethodToOperation(c.req.method);
+        if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) {
+            throw ApiError.forbidden(
+                `API key does not have "${operation}" permission for collection "${collectionSlug}"`,
+                "API_KEY_FORBIDDEN",
+            );
+        }
+    }
+
     /**
      * Get the typed RestFetchService from a driver if it exposes one (for include support).
      */
@@ -63,6 +86,7 @@ export class RestApiGenerator {
 
         // GET /collection/count - Count entities (with optional filters)
         this.router.get(`${basePath}/count`, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
             const searchString = queryDict.searchString as string | undefined;
@@ -74,6 +98,7 @@ export class RestApiGenerator {
 
         // GET /collection - List entities
         this.router.get(basePath, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
             const searchString = queryDict.searchString as string | undefined;
@@ -93,7 +118,8 @@ export class RestApiGenerator {
                         offset: queryOptions.offset,
                         orderBy: queryOptions.orderBy?.[0]?.field,
                         order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-                        searchString
+                        searchString,
+                        vectorSearch: queryOptions.vectorSearch
                     },
                     queryOptions.include
                 );
@@ -133,6 +159,7 @@ export class RestApiGenerator {
 
         // GET /collection/:id - Get single entity
         this.router.get(`${basePath}/:id`, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const id = c.req.param("id");
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
@@ -179,6 +206,7 @@ export class RestApiGenerator {
         // POST /collection - Create entity
         this.router.post(basePath, async (c) => {
             try {
+                this.enforceApiKeyPermission(c, collection.slug);
                 const driver = c.get("driver") || this.driver;
                 const path = collection.slug;
                 const hookCtx = this.buildHookContext(c, "POST");
@@ -215,6 +243,7 @@ export class RestApiGenerator {
         // PUT /collection/:id - Update entity
         this.router.put(`${basePath}/:id`, async (c) => {
             try {
+                this.enforceApiKeyPermission(c, collection.slug);
                 const id = c.req.param("id");
                 const driver = c.get("driver") || this.driver;
                 const hookCtx = this.buildHookContext(c, "PUT");
@@ -261,6 +290,7 @@ export class RestApiGenerator {
 
         // DELETE /collection/:id - Delete entity
         this.router.delete(`${basePath}/:id`, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const id = c.req.param("id");
             const driver = c.get("driver") || this.driver;
             const hookCtx = this.buildHookContext(c, "DELETE");
@@ -354,6 +384,8 @@ entityId };
 
             const driver = c.get("driver") || this.driver;
 
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
+
             if (parsed.entityId === "count") {
                 // GET /parent/:parentId/child/count — count child entities
                 const queryDict = c.req.query();
@@ -407,6 +439,8 @@ entityId };
             if (!parsed || parsed.entityId) return next();
 
             const driver = c.get("driver") || this.driver;
+
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
             const body = await c.req.json().catch(() => ({}));
 
             const entity = await driver.saveEntity({
@@ -427,6 +461,9 @@ entityId };
             if (!parsed || !parsed.entityId) return next();
 
             const driver = c.get("driver") || this.driver;
+
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
+
             const body = await c.req.json().catch(() => ({}));
 
             const entity = await driver.saveEntity({
@@ -449,6 +486,8 @@ entityId };
 
             const driver = c.get("driver") || this.driver;
 
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
+
             const existingEntity = await driver.fetchEntity({
                 path: parsed.collectionPath,
                 entityId: parsed.entityId
@@ -520,7 +559,8 @@ entityId };
             orderBy: queryOptions.orderBy?.[0]?.field,
             order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
             startAfter: queryOptions.offset ? String(queryOptions.offset) : undefined,
-            searchString
+            searchString,
+            vectorSearch: queryOptions.vectorSearch
         });
 
         return entities.map(entity => this.flattenEntity(entity));

package/src/api/rest/query-parser.ts

@@ -1,3 +1,4 @@
+import type { VectorSearchParams } from "@rebasepro/types";
 import { QueryOptions } from "../types";
 
 /**
@@ -39,7 +40,7 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
 
 
     // PostgREST-style filtering: ?field=op.value
-    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString"];
+    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString", "vector_search", "vector", "vector_distance", "vector_threshold"];
     for (const [key, rawValue] of Object.entries(query)) {
         if (reservedQueryKeys.includes(key)) continue;
 
@@ -133,5 +134,40 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
         options.fields = fieldsStr.split(",").map(s => s.trim()).filter(Boolean);
     }
 
+    // Vector similarity search
+    if (query.vector_search && query.vector) {
+        const vectorStr = String(query.vector);
+        let queryVector: number[];
+        try {
+            queryVector = JSON.parse(vectorStr) as number[];
+            if (!Array.isArray(queryVector) || !queryVector.every(v => typeof v === "number")) {
+                throw new Error("Expected array of numbers");
+            }
+        } catch {
+            throw new Error("Invalid vector format. Expected JSON array of numbers, e.g. [0.1,0.2,0.3]");
+        }
+
+        const distanceParam = query.vector_distance ? String(query.vector_distance) : "cosine";
+        if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") {
+            throw new Error(`Invalid vector_distance: ${distanceParam}. Expected: cosine, l2, or inner_product`);
+        }
+
+        const vectorSearch: VectorSearchParams = {
+            property: String(query.vector_search),
+            vector: queryVector,
+            distance: distanceParam,
+        };
+
+        if (query.vector_threshold) {
+            const threshold = parseFloat(String(query.vector_threshold));
+            if (isNaN(threshold)) {
+                throw new Error("Invalid vector_threshold. Expected a number.");
+            }
+            vectorSearch.threshold = threshold;
+        }
+
+        options.vectorSearch = vectorSearch;
+    }
+
     return options;
 }

package/src/api/types.ts

@@ -1,7 +1,8 @@
-import { EntityCollection } from "@rebasepro/types";
+import { EntityCollection, VectorSearchParams } from "@rebasepro/types";
 import { AuthResult } from "../auth/middleware";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { DataDriver } from "@rebasepro/types";
+import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 
 /**
  * Hono Environment Variables
@@ -11,6 +12,8 @@ export type HonoEnv = {
     Variables: {
         user?: AuthResult | { userId?: string, roles?: string[] };
         driver?: DataDriver;
+        /** Set when the request is authenticated via a Service API Key. */
+        apiKey?: ApiKeyMasked;
     }
 };
 
@@ -78,6 +81,8 @@ export interface QueryOptions {
     include?: string[];
     /** Columns to return in the response (field-level selection) */
     fields?: string[];
+    /** Vector similarity search configuration */
+    vectorSearch?: VectorSearchParams;
 }
 
 /**

package/src/auth/adapter-middleware.ts

@@ -6,9 +6,10 @@
  * an `AuthAdapter` to `initializeRebaseBackend()`.
  *
  * The middleware:
- * 1. Calls `adapter.verifyRequest(request)` to resolve the user
- * 2. Scopes the DataDriver via `withAuth()` for RLS
- * 3. Enforces auth (401) when `requireAuth` is true and no user is found
+ * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
+ * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
+ * 3. Scopes the DataDriver via `withAuth()` for RLS
+ * 4. Enforces auth (401) when `requireAuth` is true and no user is found
  *
  * The behavior is identical to `createAuthMiddleware()` — only the
  * token verification strategy is pluggable.
@@ -17,7 +18,9 @@
 import type { MiddlewareHandler } from "hono";
 import type { DataDriver, AuthAdapter } from "@rebasepro/types";
 import type { HonoEnv } from "../api/types";
+import type { ApiKeyStore } from "./api-keys/api-key-store";
 import { scopeDataDriver } from "./rls-scope";
+import { validateApiKey } from "./api-keys/api-key-middleware";
 
 export interface AdapterAuthMiddlewareOptions {
     /** The auth adapter to delegate verification to. */
@@ -29,15 +32,28 @@ export interface AdapterAuthMiddlewareOptions {
      * Defaults to `true` (secure by default).
      */
     requireAuth?: boolean;
+    /** Optional API key store — when provided, `rk_` bearer tokens are accepted. */
+    apiKeyStore?: ApiKeyStore;
 }
 
 /**
  * Create a Hono middleware that uses an `AuthAdapter` for request verification.
  */
 export function createAdapterAuthMiddleware(options: AdapterAuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { adapter, driver, requireAuth: enforceAuth = true } = options;
+    const { adapter, driver, requireAuth: enforceAuth = true, apiKeyStore } = options;
 
     return async (c, next) => {
+        // ── API Key check (Rebase-level, independent of auth adapter) ────
+        if (apiKeyStore) {
+            const authHeader = c.req.header("authorization") || "";
+            const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+            if (token.startsWith("rk_")) {
+                const result = await validateApiKey(c, token, { store: apiKeyStore, driver });
+                if (result === true) return next();
+                return result;
+            }
+        }
+
         let authenticatedUser = null;
 
         try {