@rebasepro/server-core 0.2.4 → 0.2.5

package/src/auth/builtin-auth-adapter.ts

@@ -15,13 +15,10 @@ import type {
     AuthenticatedUser,
     AuthAdapterCapabilities,
     UserManagementAdapter,
-    RoleManagementAdapter,
     AuthUserListOptions,
     AuthUserListResult,
     AuthUserData,
     AuthCreateUserData,
-    AuthRoleData,
-    AuthCreateRoleData,
     BootstrappedAuth,
     BackendHooks,
 } from "@rebasepro/types";
@@ -131,8 +128,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
             // Resolve roles from the repository
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -174,8 +170,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -194,7 +189,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
         userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
 
-        roleManagement: createRoleManagementFromRepo(authRepository),
+
 
         createAuthRoutes(): Hono<HonoEnv> | undefined {
             return createAuthRoutes({
@@ -327,9 +322,8 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
             }
         },
 
-        async getUserRoles(userId: string): Promise<AuthRoleData[]> {
-            const roles = await repo.getUserRoles(userId);
-            return roles.map(toAuthRoleData);
+        async getUserRoles(userId: string): Promise<string[]> {
+            return repo.getUserRoleIds(userId);
         },
 
         async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
@@ -338,40 +332,6 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
     };
 }
 
-function createRoleManagementFromRepo(repo: AuthRepository): RoleManagementAdapter {
-    return {
-        async listRoles(): Promise<AuthRoleData[]> {
-            const roles = await repo.listRoles();
-            return roles.map(toAuthRoleData);
-        },
-
-        async getRoleById(id: string): Promise<AuthRoleData | null> {
-            const role = await repo.getRoleById(id);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async createRole(data: AuthCreateRoleData): Promise<AuthRoleData> {
-            const role = await repo.createRole({
-                id: data.id,
-                name: data.name,
-                isAdmin: data.isAdmin,
-                defaultPermissions: data.defaultPermissions,
-                collectionPermissions: data.collectionPermissions,
-            });
-            return toAuthRoleData(role);
-        },
-
-        async updateRole(id: string, data: Partial<AuthRoleData>): Promise<AuthRoleData | null> {
-            const role = await repo.updateRole(id, data);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async deleteRole(id: string): Promise<void> {
-            await repo.deleteRole(id);
-        },
-    };
-}
-
 function toAuthUserData(user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; emailVerified?: boolean; metadata?: Record<string, unknown>; createdAt?: Date; updatedAt?: Date }): AuthUserData {
     return {
         id: user.id,
@@ -384,13 +344,3 @@ function toAuthUserData(user: { id: string; email: string; displayName?: string
         updatedAt: user.updatedAt,
     };
 }
-
-function toAuthRoleData(role: { id: string; name: string; isAdmin: boolean; defaultPermissions?: unknown; collectionPermissions?: unknown }): AuthRoleData {
-    return {
-        id: role.id,
-        name: role.name,
-        isAdmin: role.isAdmin,
-        defaultPermissions: role.defaultPermissions as AuthRoleData["defaultPermissions"],
-        collectionPermissions: role.collectionPermissions as AuthRoleData["collectionPermissions"],
-    };
-}

package/src/auth/custom-auth-adapter.ts

@@ -76,7 +76,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
 
         userManagement: options.userManagement,
 
-        roleManagement: options.roleManagement,
+
 
         getCapabilities() {
             return defaultCapabilities;

package/src/init.ts

@@ -23,6 +23,7 @@ import { createApiKeyRoutes } from "./auth/api-keys/api-key-routes";
 import type { ApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyRateLimiter } from "./auth/rate-limiter";
 import { createRebaseClient } from "@rebasepro/client";
+import { defaultUsersCollection } from "@rebasepro/common";
 import { createHistoryRoutes } from "./history";
 import { EmailConfig, createEmailService } from "./email";
 import type { EmailService } from "./email";
@@ -292,6 +293,13 @@ async function _initializeRebaseBackend(config: RebaseBackendConfig): Promise<Re
 dir: config.collectionsDir });
     }
 
+    if (config.auth) {
+        // Prepend defaultUsersCollection if not overridden by the developer's collections
+        activeCollections = Array.from(
+            new Map([defaultUsersCollection, ...activeCollections].map(c => [c.slug, c])).values()
+        );
+    }
+
     const realtimeServices: Record<string, RealtimeProvider> = {};
     const delegates: Record<string, DataDriver> = {};
 
@@ -378,7 +386,6 @@ collectionRegistry });
             // (the return type still exposes `auth?: BootstrappedAuth`)
             authConfigResult = {
                 userService: authAdapter.userManagement ?? {},
-                roleService: authAdapter.roleManagement ?? {},
             };
         } else {
             // ── RebaseAuthConfig — wrap in built-in adapter ──
@@ -792,6 +799,17 @@ collectionRegistry });
         logger.info("Email service attached to singleton", { configured: emailService.isConfigured() });
     }
 
+    // Attach raw SQL capability when the driver supports it (Postgres, MySQL).
+    // Document databases (MongoDB, Firestore) won't have this.
+    const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
+    if (isSQLAdmin(driverAdmin)) {
+        Object.assign(serverClient, {
+            sql: (query: string, options?: { database?: string; role?: string }) =>
+                driverAdmin.executeSql(query, options)
+        });
+        logger.info("SQL capability attached to singleton");
+    }
+
     _initRebase(serverClient);
     logger.info("Rebase singleton initialized");
 

package/test/admin-routes.test.ts

@@ -540,174 +540,5 @@ displayName: "Updated" }),
         });
     });
 
-    // ── Role CRUD ───────────────────────────────────────────────────────
-    describe("Role Management", () => {
-        describe("GET /admin/roles", () => {
-            it("returns list of roles", async () => {
-                const app = createApp();
-                mockAuthRepo.listRoles.mockResolvedValueOnce([
-                    mockRole("admin", true),
-                    mockRole("editor"),
-                    mockRole("viewer")
-                ]);
-
-                const res = await app.request("/admin/roles", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(200);
-                const body = await res.json() as any;
-                expect(body.roles).toHaveLength(3);
-                expect(body.roles[0].isAdmin).toBe(true);
-            });
-        });
-
-        describe("GET /admin/roles/:roleId", () => {
-            it("returns role by ID", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("admin", true));
-
-                const res = await app.request("/admin/roles/admin", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(200);
-                const body = await res.json() as any;
-                expect(body.role.id).toBe("admin");
-                expect(body.role.isAdmin).toBe(true);
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/missing", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(404);
-            });
-        });
-
-        describe("POST /admin/roles", () => {
-            it("creates a new role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "custom",
-name: "Custom Role" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(201);
-                const body = await res.json() as any;
-                expect(body.role.id).toBe("custom");
-            });
 
-            it("returns 400 for missing id or name", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "nope" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("returns 409 when role already exists", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("custom"));
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "custom",
-name: "Dup" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(409);
-                const body = await res.json() as any;
-                expect(body.error.code).toBe("ROLE_EXISTS");
-            });
-        });
-
-        describe("PUT /admin/roles/:roleId", () => {
-            it("updates an existing role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("editor"));
-
-                const res = await app.request("/admin/roles/editor", {
-                    method: "PUT",
-                    headers: { "Content-Type": "application/json",
-...adminAuth() },
-                    body: JSON.stringify({ name: "Super Editor" })
-                });
-                expect(res.status).toBe(200);
-                expect(mockAuthRepo.updateRole).toHaveBeenCalledWith("editor", expect.objectContaining({
-                    name: "Super Editor"
-                }));
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/missing", {
-                    method: "PUT",
-                    headers: { "Content-Type": "application/json",
-...adminAuth() },
-                    body: JSON.stringify({ name: "Nope" })
-                });
-                expect(res.status).toBe(404);
-            });
-        });
-
-        describe("DELETE /admin/roles/:roleId", () => {
-            it("deletes a custom role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("custom"));
-
-                const res = await app.request("/admin/roles/custom", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(200);
-                expect(mockAuthRepo.deleteRole).toHaveBeenCalledWith("custom");
-            });
-
-            it("prevents deletion of built-in admin role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles/admin", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-                const body = await res.json() as any;
-                expect(body.error.code).toBe("BUILTIN_ROLE");
-            });
-
-            it("prevents deletion of built-in editor role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles/editor", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("prevents deletion of built-in viewer role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles/viewer", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/ghost", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(404);
-            });
-        });
-    });
 });

package/test/backend-hooks-admin.test.ts

@@ -362,32 +362,7 @@ describe("BackendHooks — Admin Routes", () => {
         });
     });
 
-    // ── roles.afterRead ─────────────────────────────────────────────────
-    describe("roles.afterRead", () => {
-        it("filters out roles from GET /admin/roles", async () => {
-            const hooks: BackendHooks = {
-                roles: {
-                    afterRead(role) {
-                        // Hide internal roles
-                        if (role.id === "internal") return null;
-                        return role;
-                    }
-                }
-            };
-            const app = createApp(hooks);
-            mockAuthRepo.listRoles.mockResolvedValueOnce([
-                mockRole("admin", true),
-                mockRole("internal"),
-                mockRole("editor")
-            ]);
 
-            const res = await app.request("/admin/roles", { headers: { ...adminAuth() } });
-            expect(res.status).toBe(200);
-            const body = await res.json() as any;
-            expect(body.roles).toHaveLength(2);
-            expect(body.roles.map((r: any) => r.id)).toEqual(["admin", "editor"]);
-        });
-    });
 
     // ── no hooks (passthrough) ──────────────────────────────────────────
     describe("no hooks configured", () => {

package/test/custom-auth-adapter.test.ts

@@ -143,7 +143,7 @@ describe("createCustomAuthAdapter", () => {
         expect(adapter.serviceKey).toBe("sk_live_123");
     });
 
-    it("passes through userManagement and roleManagement when provided", () => {
+    it("passes through userManagement when provided", () => {
         const userMgmt = {
             getUser: jest.fn(),
             listUsers: jest.fn(),
@@ -151,27 +151,19 @@ describe("createCustomAuthAdapter", () => {
             updateUser: jest.fn(),
             deleteUser: jest.fn(),
         };
-        const roleMgmt = {
-            listRoles: jest.fn(),
-            getUserRoles: jest.fn(),
-            setUserRoles: jest.fn(),
-        };
 
         const adapter = createCustomAuthAdapter({
             verifyRequest: async () => null,
             userManagement: userMgmt as unknown as CustomAuthAdapterOptions["userManagement"],
-            roleManagement: roleMgmt as unknown as CustomAuthAdapterOptions["roleManagement"],
         });
 
         expect(adapter.userManagement).toBe(userMgmt);
-        expect(adapter.roleManagement).toBe(roleMgmt);
     });
 
-    it("omits userManagement and roleManagement when not provided", () => {
+    it("omits userManagement when not provided", () => {
         const adapter = createCustomAuthAdapter({
             verifyRequest: async () => null,
         });
         expect(adapter.userManagement).toBeUndefined();
-        expect(adapter.roleManagement).toBeUndefined();
     });
 });

package/dist/types/src/users/roles.d.ts

@@ -1,14 +0,0 @@
-export type Role = {
-    /**
-     * ID of the role
-     */
-    id: string;
-    /**
-     * Name of the role
-     */
-    name: string;
-    /**
-     * If this flag is true, the user can perform any action
-     */
-    isAdmin?: boolean;
-};