@rebasepro/server-core 0.2.3 → 0.2.5

package/src/cron/cron-scheduler.ts

@@ -8,6 +8,7 @@ import type {
 import type { RebaseClient } from "@rebasepro/client";
 import type { LoadedCronJob } from "./cron-loader";
 import type { CronStore } from "./cron-store";
+import { logger } from "../utils/logger.js";
 
 // ─── Cron expression parser (minimal, no external dependency) ────────
 // Supports standard 5-field cron (minute hour dom month dow).
@@ -207,15 +208,13 @@ export class CronScheduler {
             // Validate schedule up-front — reject invalid schedules
             const validation = validateCronExpression(loaded.definition.schedule);
             if (!validation.valid) {
-                console.error(
-                    `[cron] Rejecting job "${loaded.id}": invalid schedule "${loaded.definition.schedule}" — ${validation.reason}`
-                );
+                logger.error(`[cron] Rejecting job "${loaded.id}": invalid schedule "${loaded.definition.schedule}" — ${validation.reason}`);
                 continue;
             }
 
             const existing = this.jobs.get(loaded.id);
             if (existing) {
-                console.warn(`[cron] Duplicate cron job id: "${loaded.id}". Overwriting.`);
+                logger.warn(`[cron] Duplicate cron job id: "${loaded.id}". Overwriting.`);
                 this.stopJob(loaded.id);
             }
 
@@ -260,7 +259,7 @@ export class CronScheduler {
                     }
                 }
             }).catch((err) => {
-                console.warn("[cron] Failed to seed job stats from database:", err);
+                logger.warn("[cron] Failed to seed job stats from database", { error: err });
             });
         }
 
@@ -269,7 +268,7 @@ export class CronScheduler {
                 this.scheduleNext(id);
             }
         }
-        console.log(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
+        logger.info(`⏰ Cron scheduler started with ${this.jobs.size} job(s)`);
     }
 
     /**
@@ -356,7 +355,7 @@ export class CronScheduler {
 
         // Concurrency guard — don't run two instances simultaneously
         if (job.executing) {
-            console.warn(`[cron] Skipping manual trigger of "${id}" — already executing`);
+            logger.warn(`[cron] Skipping manual trigger of "${id}" — already executing`);
             const logEntry: CronJobLogEntry = {
                 jobId: id,
                 startedAt: new Date().toISOString(),
@@ -411,7 +410,7 @@ export class CronScheduler {
 
                 // Concurrency guard: if somehow we're already executing, skip
                 if (job.executing) {
-                    console.warn(`[cron] Skipping scheduled run of "${id}" — still executing from previous run`);
+                    logger.warn(`[cron] Skipping scheduled run of "${id}" — still executing from previous run`);
                     // Re-schedule to try again later
                     this.scheduleNext(id);
                     return;
@@ -433,7 +432,7 @@ export class CronScheduler {
 
             job.timerId = timer;
         } catch (err: unknown) {
-            console.error(`[cron] Failed to schedule "${id}":`, err);
+            logger.error(`[cron] Failed to schedule "${id}"`, { error: err });
             job.state = "error";
             job.lastError = err instanceof Error ? err.message : String(err);
         }
@@ -544,14 +543,14 @@ export class CronScheduler {
         // Persist to database (non-blocking)
         if (this.store) {
             this.store.insertLog(logEntry).catch((persistErr) => {
-                console.error(`[cron] Failed to persist log for "${job.id}":`, persistErr);
+                logger.error(`[cron] Failed to persist log for "${job.id}"`, { error: persistErr });
             });
         }
 
         if (success) {
-            console.log(`✅ [cron] "${job.id}" completed in ${durationMs}ms`);
+            logger.info(`✅ [cron] "${job.id}" completed in ${durationMs}ms`);
         } else {
-            console.error(`❌ [cron] "${job.id}" failed in ${durationMs}ms: ${error}`);
+            logger.error(`❌ [cron] "${job.id}" failed in ${durationMs}ms: ${error}`);
         }
 
         return logEntry;

package/src/cron/cron-store.ts

@@ -1,6 +1,7 @@
 import type { CronJobLogEntry } from "@rebasepro/types";
 import type { DataDriver } from "@rebasepro/types";
 import { isSQLAdmin } from "@rebasepro/types";
+import { logger } from "../utils/logger.js";
 
 /**
  * Persistence layer for cron job execution logs.
@@ -38,7 +39,7 @@ const TABLE = "rebase.cron_logs";
 export function createCronStore(driver: DataDriver): CronStore | undefined {
     const admin = driver.admin;
     if (!isSQLAdmin(admin)) {
-        console.warn("⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.");
+        logger.warn("⚠️ [cron-store] DataDriver does not support SQL admin — cron logs will not be persisted.");
         return undefined;
     }
 
@@ -68,10 +69,10 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
                     ON ${TABLE}(job_id, started_at DESC)
                 `);
 
-                console.log("✅ Cron logs table ready");
+                logger.info("✅ Cron logs table ready");
             } catch (err) {
-                console.error("❌ Failed to create cron logs table:", err);
-                console.warn("⚠️ Continuing without cron log persistence.");
+                logger.error("❌ Failed to create cron logs table", { error: err });
+                logger.warn("⚠️ Continuing without cron log persistence.");
             }
         },
 
@@ -97,7 +98,7 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
                 `);
             } catch (err) {
                 // Non-blocking — log persistence should never crash the scheduler
-                console.error(`[cron-store] Failed to persist log for "${entry.jobId}":`, err);
+                logger.error(`[cron-store] Failed to persist log for "${entry.jobId}"`, { error: err });
             }
         },
 
@@ -113,7 +114,7 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
 
                 return rows.map(rowToLogEntry);
             } catch (err) {
-                console.error(`[cron-store] Failed to fetch logs for "${jobId}":`, err);
+                logger.error(`[cron-store] Failed to fetch logs for "${jobId}"`, { error: err });
                 return [];
             }
         },
@@ -139,7 +140,7 @@ export function createCronStore(driver: DataDriver): CronStore | undefined {
                     });
                 }
             } catch (err) {
-                console.error("[cron-store] Failed to fetch job stats:", err);
+                logger.error("[cron-store] Failed to fetch job stats", { error: err });
             }
             return stats;
         }

package/src/env.ts

@@ -102,6 +102,8 @@ const rebaseEnvSchema = z.object({
     DB_POOL_MAX: z.string().default("20").transform(Number),
     DB_POOL_IDLE_TIMEOUT: z.string().default("30000").transform(Number),
     DB_POOL_CONNECT_TIMEOUT: z.string().default("10000").transform(Number),
+    DATABASE_DIRECT_URL: z.string().url().optional(),
+    DATABASE_READ_URL: z.string().url().optional(),
     FORCE_LOCAL_STORAGE: optionalBoolString,
     STORAGE_TYPE: z.enum(["local", "s3"]).default("local"),
     STORAGE_PATH: z.string().optional(),

package/src/functions/function-loader.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { pathToFileURL } from "url";
 import { Hono } from "hono";
+import { logger } from "../utils/logger.js";
 
 export interface LoadedFunction {
     /** Endpoint name derived from filename (e.g., "send-invoice") */
@@ -49,9 +50,7 @@ export async function loadFunctionsFromDirectory(
                 const exported = mod.default;
 
                 if (!exported) {
-                    console.warn(
-                        `[functions] ${file}: no default export. Skipping.`
-                    );
+                    logger.warn(`[functions] ${file}: no default export. Skipping.`);
                     continue;
                 }
 
@@ -61,7 +60,7 @@ export async function loadFunctionsFromDirectory(
                     const name = path.basename(file, path.extname(file));
                     functions.push({ name,
 app: exported as Hono });
-                    console.log(`⚡ Loaded function route: ${name}`);
+                    logger.info(`⚡ Loaded function route: ${name}`);
                     continue;
                 }
 
@@ -72,7 +71,7 @@ app: exported as Hono });
                         const name = path.basename(file, path.extname(file));
                         functions.push({ name,
 app: result as Hono });
-                        console.log(`⚡ Loaded function route: ${name}`);
+                        logger.info(`⚡ Loaded function route: ${name}`);
                         continue;
                     }
                 }
@@ -82,7 +81,7 @@ app: result as Hono });
                 const keys = exported && typeof exported === "object"
                     ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(", ")
                     : "N/A";
-                console.warn(
+                logger.warn(
                     `[functions] ${file}: default export is not a Hono app or factory. Skipping.\n` +
                     `  export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : ""}\n` +
                     `  prototype methods: ${keys}\n` +
@@ -92,9 +91,7 @@ app: result as Hono });
             } catch (err: unknown) {
                 const message =
                     err instanceof Error ? err.message : String(err);
-                console.error(
-                    `[functions] Failed to load ${file}: ${message}`
-                );
+                logger.error(`[functions] Failed to load ${file}: ${message}`);
             }
         }
     }

package/src/index.ts

@@ -65,6 +65,5 @@ export * from "./utils/dev-port";
 // Environment validation
 export { loadEnv } from "./env";
 export type { RebaseEnv } from "./env";
-
-// Backend bootstrappers (pluggable driver initialization)
+export { z } from "zod";
 

package/src/init.ts

@@ -18,12 +18,17 @@ import { logger } from "./utils/logger";
 import { requestLogger } from "./utils/request-logger";
 import { createAdminRoutes, createAuthRoutes, requireAuth, requireAdmin, configureJwt } from "./auth";
 import { createStorageController, createStorageRoutes, DEFAULT_STORAGE_ID, DefaultStorageRegistry, BackendStorageConfig, StorageController, StorageRegistry } from "./storage";
+import { createApiKeyStore } from "./auth/api-keys/api-key-store";
+import { createApiKeyRoutes } from "./auth/api-keys/api-key-routes";
+import type { ApiKeyStore } from "./auth/api-keys/api-key-store";
+import { createApiKeyRateLimiter } from "./auth/rate-limiter";
 import { createRebaseClient } from "@rebasepro/client";
+import { defaultUsersCollection } from "@rebasepro/common";
 import { createHistoryRoutes } from "./history";
 import { EmailConfig, createEmailService } from "./email";
 import type { EmailService } from "./email";
 import type { OAuthProvider } from "./auth/interfaces";
-import type { AuthOverrides } from "./auth/auth-overrides";
+import type { AuthHooks } from "./auth/auth-hooks";
 import { _initRebase } from "./singleton";
 
 export interface RebaseAuthConfig {
@@ -72,13 +77,13 @@ export interface RebaseAuthConfig {
      * ```ts
      * import bcrypt from "bcrypt";
      *
-     * overrides: {
+     * hooks: {
      *     hashPassword: (pw) => bcrypt.hash(pw, 12),
      *     verifyPassword: (pw, hash) => bcrypt.compare(pw, hash),
      * }
      * ```
      */
-    overrides?: AuthOverrides;
+    hooks?: AuthHooks;
     [key: string]: unknown;
 }
 
@@ -288,6 +293,13 @@ async function _initializeRebaseBackend(config: RebaseBackendConfig): Promise<Re
 dir: config.collectionsDir });
     }
 
+    if (config.auth) {
+        // Prepend defaultUsersCollection if not overridden by the developer's collections
+        activeCollections = Array.from(
+            new Map([defaultUsersCollection, ...activeCollections].map(c => [c.slug, c])).values()
+        );
+    }
+
     const realtimeServices: Record<string, RealtimeProvider> = {};
     const delegates: Record<string, DataDriver> = {};
 
@@ -374,7 +386,6 @@ collectionRegistry });
             // (the return type still exposes `auth?: BootstrappedAuth`)
             authConfigResult = {
                 userService: authAdapter.userManagement ?? {},
-                roleService: authAdapter.roleManagement ?? {},
             };
         } else {
             // ── RebaseAuthConfig — wrap in built-in adapter ──
@@ -417,7 +428,7 @@ collectionRegistry });
                         oauthProviders,
                         serviceKey,
                         hooks: config.hooks,
-                        overrides: safeAuthConfig.overrides,
+                        authHooks: safeAuthConfig.hooks,
                     });
                 }
 
@@ -579,7 +590,7 @@ collectionRegistry });
                 oauthProviders,
                 serviceKey,
                 hooks: config.hooks,
-                overrides: safeAuthConfig.overrides,
+                authHooks: safeAuthConfig.hooks,
             });
         }
 
@@ -601,6 +612,23 @@ collectionRegistry });
         }
     }
 
+    // ─── API Key Store Bootstrap ──────────────────────────────────────────
+    let apiKeyStore: ApiKeyStore | undefined;
+    const apiKeyStoreResult = createApiKeyStore(defaultDriver);
+    if (apiKeyStoreResult) {
+        apiKeyStore = apiKeyStoreResult;
+        await apiKeyStore.ensureTable();
+        logger.info("Service API Keys initialized");
+
+        // Mount API key admin routes
+        const apiKeyRoutes = createApiKeyRoutes({
+            store: apiKeyStore,
+            serviceKey,
+        });
+        config.app.route(`${basePath}/admin/api-keys`, apiKeyRoutes);
+        logger.info("API key admin routes mounted", { path: `${basePath}/admin/api-keys` });
+    }
+
     if (config.collectionsDir) {
         if (process.env.NODE_ENV !== "production") {
             const { createSchemaEditorRoutes } = await import("./api/schema-editor-routes");
@@ -676,15 +704,22 @@ collectionRegistry });
                 adapter: authAdapter,
                 driver: defaultDriver,
                 requireAuth: dataRequireAuth,
+                apiKeyStore,
             }));
         } else {
             dataRouter.use("/*", createAuthMiddleware({
                 driver: defaultDriver,
                 requireAuth: dataRequireAuth,
-                serviceKey
+                serviceKey,
+                apiKeyStore,
             }));
         }
 
+        // Per-API-key rate limiting (no-op for non-API-key requests)
+        if (apiKeyStore) {
+            dataRouter.use("/*", createApiKeyRateLimiter());
+        }
+
         // Mount history routes BEFORE the REST API subcollection catch-all so
         // that /:slug/:entityId/history is matched by the dedicated handler first.
         if (historyConfigResult && historyConfigResult.historyService) {
@@ -764,6 +799,17 @@ collectionRegistry });
         logger.info("Email service attached to singleton", { configured: emailService.isConfigured() });
     }
 
+    // Attach raw SQL capability when the driver supports it (Postgres, MySQL).
+    // Document databases (MongoDB, Firestore) won't have this.
+    const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
+    if (isSQLAdmin(driverAdmin)) {
+        Object.assign(serverClient, {
+            sql: (query: string, options?: { database?: string; role?: string }) =>
+                driverAdmin.executeSql(query, options)
+        });
+        logger.info("SQL capability attached to singleton");
+    }
+
     _initRebase(serverClient);
     logger.info("Rebase singleton initialized");
 
@@ -800,12 +846,14 @@ collectionRegistry });
                     adapter: authAdapter,
                     driver: defaultDriver,
                     requireAuth: functionsRequireAuth,
+                    apiKeyStore,
                 }));
             } else {
                 functionsRouter.use("/*", createAuthMiddleware({
                     driver: defaultDriver,
                     requireAuth: functionsRequireAuth,
-                    serviceKey
+                    serviceKey,
+                    apiKeyStore,
                 }));
             }
 

package/src/serve-spa.ts

@@ -2,6 +2,7 @@ import { Hono } from "hono";
 import { serveStatic } from "@hono/node-server/serve-static";
 import * as path from "path";
 import * as fs from "fs";
+import { logger } from "./utils/logger.js";
 
 /**
  * Configuration for serving a Single Page Application
@@ -45,8 +46,8 @@ export function serveSPA<E extends import("hono").Env>(app: Hono<E>, config: Ser
 
     // Validate frontend path exists
     if (!fs.existsSync(frontendPath)) {
-        console.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
-        console.warn("   SPA serving is disabled. Build your frontend first.");
+        logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
+        logger.warn("   SPA serving is disabled. Build your frontend first.");
         return;
     }
 
@@ -68,7 +69,7 @@ export function serveSPA<E extends import("hono").Env>(app: Hono<E>, config: Ser
         const indexPath = path.join(frontendPath, indexFile);
 
         if (!fs.existsSync(indexPath)) {
-            console.warn(`⚠️ Index file not found: ${indexPath}`);
+            logger.warn(`⚠️ Index file not found: ${indexPath}`);
             return next();
         }
 
@@ -76,6 +77,6 @@ export function serveSPA<E extends import("hono").Env>(app: Hono<E>, config: Ser
         return c.html(html);
     });
 
-    console.log(`✅ SPA serving enabled from: ${frontendPath}`);
+    logger.info(`✅ SPA serving enabled from: ${frontendPath}`);
 }
 

package/src/services/webhook-service.ts

@@ -0,0 +1,155 @@
+import { createHmac, randomUUID } from "crypto";
+
+export interface WebhookConfig {
+    id: string;
+    url: string;
+    secret?: string;
+    headers?: Record<string, string>;
+    events: string[];
+    table: string;
+    enabled: boolean;
+}
+
+export interface WebhookDeliveryResult {
+    webhookId: string;
+    event: string;
+    payload: Record<string, unknown>;
+    statusCode: number;
+    responseBody: string;
+    success: boolean;
+    attemptNumber: number;
+}
+
+export class WebhookDispatcher {
+    private webhooks: WebhookConfig[] = [];
+    private maxRetries = 3;
+    private retryDelays = [1000, 5000, 15000]; // Exponential backoff
+
+    /** Register webhooks to watch */
+    setWebhooks(webhooks: WebhookConfig[]): void {
+        this.webhooks = webhooks.filter(w => w.enabled);
+    }
+
+    /** Called when an entity changes — checks if any webhook matches */
+    async onEntityChange(
+        table: string,
+        event: "INSERT" | "UPDATE" | "DELETE",
+        entityId: string,
+        entity: Record<string, unknown> | null,
+        previousEntity?: Record<string, unknown> | null
+    ): Promise<WebhookDeliveryResult[]> {
+        const matchingWebhooks = this.webhooks.filter(
+            w => w.table === table && w.events.includes(event)
+        );
+
+        if (matchingWebhooks.length === 0) return [];
+
+        const results: WebhookDeliveryResult[] = [];
+
+        for (const webhook of matchingWebhooks) {
+            const payload: Record<string, unknown> = {
+                type: event,
+                table,
+                record: entity,
+                old_record: event === "UPDATE" ? previousEntity : undefined,
+                schema: "public",
+                timestamp: new Date().toISOString()
+            };
+
+            const result = await this.deliverWithRetry(webhook, event, payload);
+            results.push(result);
+        }
+
+        return results;
+    }
+
+    private async deliverWithRetry(
+        webhook: WebhookConfig,
+        event: string,
+        payload: Record<string, unknown>
+    ): Promise<WebhookDeliveryResult> {
+        for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
+            const result = await this.deliver(webhook, event, payload, attempt);
+            if (result.success) return result;
+
+            if (attempt < this.maxRetries) {
+                await new Promise(r => setTimeout(r, this.retryDelays[attempt - 1]));
+            } else {
+                return result; // Final failure
+            }
+        }
+
+        // Should never reach here, but satisfies TypeScript
+        return {
+            webhookId: webhook.id,
+            event,
+            payload,
+            statusCode: 0,
+            responseBody: "Max retries exceeded",
+            success: false,
+            attemptNumber: this.maxRetries
+        };
+    }
+
+    private async deliver(
+        webhook: WebhookConfig,
+        event: string,
+        payload: Record<string, unknown>,
+        attemptNumber: number
+    ): Promise<WebhookDeliveryResult> {
+        const body = JSON.stringify(payload);
+
+        const headers: Record<string, string> = {
+            "Content-Type": "application/json",
+            "X-Webhook-Id": webhook.id,
+            "X-Webhook-Event": event,
+            "X-Webhook-Delivery": randomUUID(),
+            "X-Webhook-Attempt": String(attemptNumber),
+            ...(webhook.headers || {})
+        };
+
+        // HMAC signature
+        if (webhook.secret) {
+            const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
+            headers["X-Webhook-Signature"] = `sha256=${signature}`;
+        }
+
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 10000); // 10s timeout
+
+            const response = await fetch(webhook.url, {
+                method: "POST",
+                headers,
+                body,
+                signal: controller.signal
+            });
+
+            clearTimeout(timeout);
+
+            const responseBody = await response.text().catch(() => "");
+            const success = response.status >= 200 && response.status < 300;
+
+            return {
+                webhookId: webhook.id,
+                event,
+                payload,
+                statusCode: response.status,
+                responseBody: responseBody.slice(0, 1000), // Truncate
+                success,
+                attemptNumber
+            };
+        } catch (error: unknown) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                webhookId: webhook.id,
+                event,
+                payload,
+                statusCode: 0,
+                responseBody: message.slice(0, 1000),
+                success: false,
+                attemptNumber
+            };
+        }
+    }
+}