@rebasepro/server-core 0.2.3 → 0.2.5

package/src/api/logs-routes.ts

@@ -0,0 +1,129 @@
+import { Hono } from "hono";
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "./types";
+
+export interface LogEntry {
+    id: string;
+    timestamp: string;
+    level: "debug" | "info" | "warn" | "error";
+    source: "api" | "auth" | "storage" | "realtime" | "system";
+    message: string;
+    metadata?: Record<string, unknown>;
+}
+
+class LogRingBuffer {
+    private buffer: LogEntry[] = [];
+    private maxSize: number;
+    private idCounter = 0;
+
+    constructor(maxSize = 10000) {
+        this.maxSize = maxSize;
+    }
+
+    push(entry: Omit<LogEntry, "id">): void {
+        const id = `log_${++this.idCounter}`;
+        this.buffer.push({ ...entry, id });
+        if (this.buffer.length > this.maxSize) {
+            this.buffer.shift();
+        }
+    }
+
+    query(options: {
+        level?: string;
+        source?: string;
+        search?: string;
+        limit?: number;
+        offset?: number;
+        since?: string;
+    }): { entries: LogEntry[]; total: number } {
+        let filtered = this.buffer;
+
+        if (options.level) {
+            filtered = filtered.filter(e => e.level === options.level);
+        }
+        if (options.source) {
+            filtered = filtered.filter(e => e.source === options.source);
+        }
+        if (options.search) {
+            const searchLower = options.search.toLowerCase();
+            filtered = filtered.filter(e => e.message.toLowerCase().includes(searchLower));
+        }
+        if (options.since) {
+            const sinceValue = options.since;
+            filtered = filtered.filter(e => e.timestamp >= sinceValue);
+        }
+
+        // Newest first
+        const sorted = [...filtered].reverse();
+        const total = sorted.length;
+        const limit = options.limit || 100;
+        const offset = options.offset || 0;
+
+        return {
+            entries: sorted.slice(offset, offset + limit),
+            total
+        };
+    }
+
+    getLatest(count = 50): LogEntry[] {
+        return this.buffer.slice(-count).reverse();
+    }
+}
+
+// Global singleton
+export const logBuffer = new LogRingBuffer();
+
+/** Add a log entry */
+export function addLog(
+    level: LogEntry["level"],
+    source: LogEntry["source"],
+    message: string,
+    metadata?: Record<string, unknown>
+): void {
+    logBuffer.push({
+        timestamp: new Date().toISOString(),
+        level,
+        source,
+        message,
+        metadata
+    });
+}
+
+/** Hono middleware to log API requests */
+export function logMiddleware(): MiddlewareHandler<HonoEnv> {
+    return async (c, next) => {
+        const start = Date.now();
+        await next();
+        const duration = Date.now() - start;
+        addLog("info", "api", `${c.req.method} ${c.req.path} ${c.res.status} ${duration}ms`, {
+            method: c.req.method,
+            path: c.req.path,
+            status: c.res.status,
+            duration
+        });
+    };
+}
+
+const app = new Hono<HonoEnv>();
+
+// GET /api/logs — Query logs
+app.get("/", (c) => {
+    const query = c.req.query();
+    const result = logBuffer.query({
+        level: query.level,
+        source: query.source,
+        search: query.search,
+        limit: query.limit ? parseInt(query.limit) : undefined,
+        offset: query.offset ? parseInt(query.offset) : undefined,
+        since: query.since
+    });
+    return c.json(result);
+});
+
+// GET /api/logs/latest — Get latest logs (for real-time)
+app.get("/latest", (c) => {
+    const count = parseInt(c.req.query("count") || "50");
+    return c.json({ entries: logBuffer.getLatest(count) });
+});
+
+export default app;

package/src/api/rest/api-generator.ts

@@ -3,6 +3,8 @@ import { DataDriver, Entity, EntityCollection, FetchCollectionProps, DataHooks,
 import { QueryOptions, HonoEnv } from "../types";
 import { ApiError } from "../errors";
 import { parseQueryOptions } from "./query-parser";
+import { httpMethodToOperation, isOperationAllowed } from "../../auth/api-keys/api-key-permission-guard";
+import type { ApiKeyMasked } from "../../auth/api-keys/api-key-types";
 
 
 /**
@@ -47,6 +49,27 @@ export class RestApiGenerator {
         return this.router;
     }
 
+    /**
+     * Check API key permissions for a collection operation.
+     * Throws 403 if the key doesn't have the required permission.
+     * No-ops if the request is not authenticated via an API key.
+     */
+    private enforceApiKeyPermission(
+        c: { get: (key: string) => unknown; req: { method: string } },
+        collectionSlug: string,
+    ): void {
+        const apiKey = c.get("apiKey") as ApiKeyMasked | undefined;
+        if (!apiKey) return; // Not an API key request — skip
+
+        const operation = httpMethodToOperation(c.req.method);
+        if (!isOperationAllowed(apiKey.permissions, collectionSlug, operation)) {
+            throw ApiError.forbidden(
+                `API key does not have "${operation}" permission for collection "${collectionSlug}"`,
+                "API_KEY_FORBIDDEN",
+            );
+        }
+    }
+
     /**
      * Get the typed RestFetchService from a driver if it exposes one (for include support).
      */
@@ -63,6 +86,7 @@ export class RestApiGenerator {
 
         // GET /collection/count - Count entities (with optional filters)
         this.router.get(`${basePath}/count`, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
             const searchString = queryDict.searchString as string | undefined;
@@ -74,6 +98,7 @@ export class RestApiGenerator {
 
         // GET /collection - List entities
         this.router.get(basePath, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
             const searchString = queryDict.searchString as string | undefined;
@@ -93,7 +118,8 @@ export class RestApiGenerator {
                         offset: queryOptions.offset,
                         orderBy: queryOptions.orderBy?.[0]?.field,
                         order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
-                        searchString
+                        searchString,
+                        vectorSearch: queryOptions.vectorSearch
                     },
                     queryOptions.include
                 );
@@ -133,6 +159,7 @@ export class RestApiGenerator {
 
         // GET /collection/:id - Get single entity
         this.router.get(`${basePath}/:id`, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const id = c.req.param("id");
             const queryDict = c.req.query();
             const queryOptions = parseQueryOptions(queryDict);
@@ -179,6 +206,7 @@ export class RestApiGenerator {
         // POST /collection - Create entity
         this.router.post(basePath, async (c) => {
             try {
+                this.enforceApiKeyPermission(c, collection.slug);
                 const driver = c.get("driver") || this.driver;
                 const path = collection.slug;
                 const hookCtx = this.buildHookContext(c, "POST");
@@ -215,6 +243,7 @@ export class RestApiGenerator {
         // PUT /collection/:id - Update entity
         this.router.put(`${basePath}/:id`, async (c) => {
             try {
+                this.enforceApiKeyPermission(c, collection.slug);
                 const id = c.req.param("id");
                 const driver = c.get("driver") || this.driver;
                 const hookCtx = this.buildHookContext(c, "PUT");
@@ -261,6 +290,7 @@ export class RestApiGenerator {
 
         // DELETE /collection/:id - Delete entity
         this.router.delete(`${basePath}/:id`, async (c) => {
+            this.enforceApiKeyPermission(c, collection.slug);
             const id = c.req.param("id");
             const driver = c.get("driver") || this.driver;
             const hookCtx = this.buildHookContext(c, "DELETE");
@@ -354,6 +384,8 @@ entityId };
 
             const driver = c.get("driver") || this.driver;
 
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
+
             if (parsed.entityId === "count") {
                 // GET /parent/:parentId/child/count — count child entities
                 const queryDict = c.req.query();
@@ -407,6 +439,8 @@ entityId };
             if (!parsed || parsed.entityId) return next();
 
             const driver = c.get("driver") || this.driver;
+
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
             const body = await c.req.json().catch(() => ({}));
 
             const entity = await driver.saveEntity({
@@ -427,6 +461,9 @@ entityId };
             if (!parsed || !parsed.entityId) return next();
 
             const driver = c.get("driver") || this.driver;
+
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
+
             const body = await c.req.json().catch(() => ({}));
 
             const entity = await driver.saveEntity({
@@ -449,6 +486,8 @@ entityId };
 
             const driver = c.get("driver") || this.driver;
 
+            this.enforceApiKeyPermission(c, c.req.param("parent"));
+
             const existingEntity = await driver.fetchEntity({
                 path: parsed.collectionPath,
                 entityId: parsed.entityId
@@ -520,7 +559,8 @@ entityId };
             orderBy: queryOptions.orderBy?.[0]?.field,
             order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
             startAfter: queryOptions.offset ? String(queryOptions.offset) : undefined,
-            searchString
+            searchString,
+            vectorSearch: queryOptions.vectorSearch
         });
 
         return entities.map(entity => this.flattenEntity(entity));

package/src/api/rest/query-parser.ts

@@ -1,3 +1,4 @@
+import type { VectorSearchParams } from "@rebasepro/types";
 import { QueryOptions } from "../types";
 
 /**
@@ -39,7 +40,7 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
 
 
     // PostgREST-style filtering: ?field=op.value
-    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString"];
+    const reservedQueryKeys = ["limit", "offset", "page", "orderBy", "include", "fields", "searchString", "vector_search", "vector", "vector_distance", "vector_threshold"];
     for (const [key, rawValue] of Object.entries(query)) {
         if (reservedQueryKeys.includes(key)) continue;
 
@@ -133,5 +134,40 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
         options.fields = fieldsStr.split(",").map(s => s.trim()).filter(Boolean);
     }
 
+    // Vector similarity search
+    if (query.vector_search && query.vector) {
+        const vectorStr = String(query.vector);
+        let queryVector: number[];
+        try {
+            queryVector = JSON.parse(vectorStr) as number[];
+            if (!Array.isArray(queryVector) || !queryVector.every(v => typeof v === "number")) {
+                throw new Error("Expected array of numbers");
+            }
+        } catch {
+            throw new Error("Invalid vector format. Expected JSON array of numbers, e.g. [0.1,0.2,0.3]");
+        }
+
+        const distanceParam = query.vector_distance ? String(query.vector_distance) : "cosine";
+        if (distanceParam !== "cosine" && distanceParam !== "l2" && distanceParam !== "inner_product") {
+            throw new Error(`Invalid vector_distance: ${distanceParam}. Expected: cosine, l2, or inner_product`);
+        }
+
+        const vectorSearch: VectorSearchParams = {
+            property: String(query.vector_search),
+            vector: queryVector,
+            distance: distanceParam,
+        };
+
+        if (query.vector_threshold) {
+            const threshold = parseFloat(String(query.vector_threshold));
+            if (isNaN(threshold)) {
+                throw new Error("Invalid vector_threshold. Expected a number.");
+            }
+            vectorSearch.threshold = threshold;
+        }
+
+        options.vectorSearch = vectorSearch;
+    }
+
     return options;
 }

package/src/api/types.ts

@@ -1,7 +1,8 @@
-import { EntityCollection } from "@rebasepro/types";
+import { EntityCollection, VectorSearchParams } from "@rebasepro/types";
 import { AuthResult } from "../auth/middleware";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { DataDriver } from "@rebasepro/types";
+import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 
 /**
  * Hono Environment Variables
@@ -11,6 +12,8 @@ export type HonoEnv = {
     Variables: {
         user?: AuthResult | { userId?: string, roles?: string[] };
         driver?: DataDriver;
+        /** Set when the request is authenticated via a Service API Key. */
+        apiKey?: ApiKeyMasked;
     }
 };
 
@@ -78,6 +81,8 @@ export interface QueryOptions {
     include?: string[];
     /** Columns to return in the response (field-level selection) */
     fields?: string[];
+    /** Vector similarity search configuration */
+    vectorSearch?: VectorSearchParams;
 }
 
 /**

package/src/auth/adapter-middleware.ts

@@ -6,9 +6,10 @@
  * an `AuthAdapter` to `initializeRebaseBackend()`.
  *
  * The middleware:
- * 1. Calls `adapter.verifyRequest(request)` to resolve the user
- * 2. Scopes the DataDriver via `withAuth()` for RLS
- * 3. Enforces auth (401) when `requireAuth` is true and no user is found
+ * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
+ * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
+ * 3. Scopes the DataDriver via `withAuth()` for RLS
+ * 4. Enforces auth (401) when `requireAuth` is true and no user is found
  *
  * The behavior is identical to `createAuthMiddleware()` — only the
  * token verification strategy is pluggable.
@@ -17,7 +18,9 @@
 import type { MiddlewareHandler } from "hono";
 import type { DataDriver, AuthAdapter } from "@rebasepro/types";
 import type { HonoEnv } from "../api/types";
+import type { ApiKeyStore } from "./api-keys/api-key-store";
 import { scopeDataDriver } from "./rls-scope";
+import { validateApiKey } from "./api-keys/api-key-middleware";
 
 export interface AdapterAuthMiddlewareOptions {
     /** The auth adapter to delegate verification to. */
@@ -29,15 +32,28 @@ export interface AdapterAuthMiddlewareOptions {
      * Defaults to `true` (secure by default).
      */
     requireAuth?: boolean;
+    /** Optional API key store — when provided, `rk_` bearer tokens are accepted. */
+    apiKeyStore?: ApiKeyStore;
 }
 
 /**
  * Create a Hono middleware that uses an `AuthAdapter` for request verification.
  */
 export function createAdapterAuthMiddleware(options: AdapterAuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { adapter, driver, requireAuth: enforceAuth = true } = options;
+    const { adapter, driver, requireAuth: enforceAuth = true, apiKeyStore } = options;
 
     return async (c, next) => {
+        // ── API Key check (Rebase-level, independent of auth adapter) ────
+        if (apiKeyStore) {
+            const authHeader = c.req.header("authorization") || "";
+            const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+            if (token.startsWith("rk_")) {
+                const result = await validateApiKey(c, token, { store: apiKeyStore, driver });
+                if (result === true) return next();
+                return result;
+            }
+        }
+
         let authenticatedUser = null;
 
         try {

package/src/auth/admin-routes.ts

@@ -2,10 +2,10 @@ import { Hono } from "hono";
 import { ApiError, errorHandler } from "../api/errors";
 import type { AuthRepository } from "./interfaces";
 import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
-import type { AuthOverrides } from "./auth-overrides";
-import { resolveAuthOverrides } from "./auth-overrides";
+import type { AuthHooks } from "./auth-hooks";
+import { resolveAuthHooks } from "./auth-hooks";
 import { AuthModuleConfig } from "./routes";
-import type { BackendHooks, AdminUser, AdminRole, BackendHookContext } from "@rebasepro/types";
+import type { BackendHooks, AdminUser, BackendHookContext } from "@rebasepro/types";
 
 interface AdminRouteOptions extends AuthModuleConfig {
     serviceKey?: string;
@@ -19,10 +19,10 @@ interface AdminRouteOptions extends AuthModuleConfig {
      */
     hooks?: BackendHooks;
     /**
-     * Auth overrides for customizing password hashing, credential
+     * Auth hooks for customizing password hashing, credential
      * verification, lifecycle hooks, etc.
      */
-    overrides?: AuthOverrides;
+    authHooks?: AuthHooks;
 }
 import { HonoEnv } from "../api/types";
 import { randomBytes, createHash } from "crypto";
@@ -74,8 +74,8 @@ function hashToken(token: string): string {
 export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
     const router = new Hono<HonoEnv>();
     const authRepo = config.authRepo;
-    const { emailService, emailConfig, hooks, overrides } = config;
-    const ops = resolveAuthOverrides(overrides);
+    const { emailService, emailConfig, hooks, authHooks } = config;
+    const ops = resolveAuthHooks(authHooks);
 
     /** Build a BackendHookContext from Hono's context object */
     function buildHookContext(c: { get: (key: string) => unknown }, method: BackendHookContext["method"]): BackendHookContext {
@@ -99,12 +99,7 @@ export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
         return results.filter((u): u is AdminUser => u !== null);
     }
 
-    /** Apply roles.afterRead hook to an array and filter nulls */
-    async function applyRoleAfterReadBatch(roles: AdminRole[], ctx: BackendHookContext): Promise<AdminRole[]> {
-        if (!hooks?.roles?.afterRead) return roles;
-        const results = await Promise.all(roles.map(r => hooks!.roles!.afterRead!(r, ctx)));
-        return results.filter((r): r is AdminRole => r !== null);
-    }
+
 
     /** Convert a DB user record + role IDs into the AdminUser API shape */
     function toAdminUser(u: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; createdAt?: Date | string; updatedAt?: Date | string }, roles: string[]): AdminUser {
@@ -174,6 +169,10 @@ export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
         if (!userId) {
             throw ApiError.unauthorized("User ID not found in auth context");
         }
+        const caller = await authRepo.getUserById(userId);
+        if (!caller) {
+            throw ApiError.notFound("Authenticated user does not exist in the database. Please sign out and sign in/register again.", "USER_NOT_FOUND");
+        }
         await authRepo.setUserRoles(userId, ["admin"]);
 
         // ── Set persistent flag ──────────────────────────────────────
@@ -456,6 +455,19 @@ displayName: existing.displayName }, appName);
         }
 
         if (roles !== undefined && Array.isArray(roles)) {
+            const currentRoles = await authRepo.getUserRoleIds(userId);
+            const wasAdmin = currentRoles.includes("admin");
+            const willBeAdmin = roles.includes("admin");
+            
+            if (wasAdmin && !willBeAdmin) {
+                const adminUsers = await authRepo.listUsersPaginated({
+                    roleId: "admin",
+                    limit: 1
+                });
+                if (adminUsers.total <= 1) {
+                    throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
+                }
+            }
             await authRepo.setUserRoles(userId, roles);
         }
 
@@ -487,6 +499,17 @@ displayName: existing.displayName }, appName);
             throw ApiError.notFound("User not found");
         }
 
+        const roles = await authRepo.getUserRoleIds(userId);
+        if (roles.includes("admin")) {
+            const adminUsers = await authRepo.listUsersPaginated({
+                roleId: "admin",
+                limit: 1
+            });
+            if (adminUsers.total <= 1) {
+                throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
+            }
+        }
+
         // Apply beforeDelete hook (throw to abort)
         const hookCtx = buildHookContext(c, "DELETE");
         if (hooks?.users?.beforeDelete) {
@@ -505,94 +528,7 @@ displayName: existing.displayName }, appName);
         return c.json({ success: true });
     });
 
-    router.get("/roles", requireAdmin, async (c) => {
-        const roles = await authRepo.listRoles();
-        const hookCtx = buildHookContext(c, "GET");
-
-        let adminRoles: AdminRole[] = roles.map(r => ({
-            id: r.id,
-            name: r.name,
-            isAdmin: r.isAdmin,
-            defaultPermissions: r.defaultPermissions,
-            config: r.config
-        }));
-
-        adminRoles = await applyRoleAfterReadBatch(adminRoles, hookCtx);
-
-        return c.json({ roles: adminRoles });
-    });
-
-    router.get("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-        const role = await authRepo.getRoleById(roleId);
-
-        if (!role) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        return c.json({ role });
-    });
-
-    router.post("/roles", requireAdmin, async (c) => {
-        const body = await c.req.json();
-        const { id, name, isAdmin, defaultPermissions, config } = body;
-
-        if (!id || !name) {
-            throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
-        }
-
-        const existing = await authRepo.getRoleById(id);
-        if (existing) {
-            throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
-        }
-
-        const role = await authRepo.createRole({
-            id,
-            name,
-            isAdmin: isAdmin ?? false,
-            defaultPermissions: defaultPermissions ?? null,
-            config: config ?? null
-        });
-
-        return c.json({ role }, 201);
-    });
-
-    router.put("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-        const body = await c.req.json();
-        const { name, isAdmin, defaultPermissions, config } = body;
-
-        const existing = await authRepo.getRoleById(roleId);
-        if (!existing) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        const role = await authRepo.updateRole(roleId, {
-            name,
-            isAdmin,
-            defaultPermissions,
-            config
-        });
-
-        return c.json({ role });
-    });
-
-    router.delete("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-
-        if (["admin", "editor", "viewer"].includes(roleId)) {
-            throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
-        }
-
-        const existing = await authRepo.getRoleById(roleId);
-        if (!existing) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        await authRepo.deleteRole(roleId);
 
-        return c.json({ success: true });
-    });
 
     return router;
 }