@rebasepro/server-core 0.3.0 → 0.4.0

package/src/auth/admin-routes.ts

@@ -5,7 +5,7 @@ import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
 import type { AuthHooks } from "./auth-hooks";
 import { resolveAuthHooks } from "./auth-hooks";
 import { AuthModuleConfig } from "./routes";
-import type { BackendHooks, AdminUser, AdminRole, BackendHookContext } from "@rebasepro/types";
+import type { BackendHooks, AdminUser, BackendHookContext } from "@rebasepro/types";
 
 interface AdminRouteOptions extends AuthModuleConfig {
     serviceKey?: string;
@@ -99,12 +99,7 @@ export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
         return results.filter((u): u is AdminUser => u !== null);
     }
 
-    /** Apply roles.afterRead hook to an array and filter nulls */
-    async function applyRoleAfterReadBatch(roles: AdminRole[], ctx: BackendHookContext): Promise<AdminRole[]> {
-        if (!hooks?.roles?.afterRead) return roles;
-        const results = await Promise.all(roles.map(r => hooks!.roles!.afterRead!(r, ctx)));
-        return results.filter((r): r is AdminRole => r !== null);
-    }
+
 
     /** Convert a DB user record + role IDs into the AdminUser API shape */
     function toAdminUser(u: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; createdAt?: Date | string; updatedAt?: Date | string }, roles: string[]): AdminUser {
@@ -533,91 +528,7 @@ displayName: existing.displayName }, appName);
         return c.json({ success: true });
     });
 
-    router.get("/roles", requireAdmin, async (c) => {
-        const roles = await authRepo.listRoles();
-        const hookCtx = buildHookContext(c, "GET");
-
-        let adminRoles: AdminRole[] = roles.map(r => ({
-            id: r.id,
-            name: r.name,
-            isAdmin: r.isAdmin,
-            defaultPermissions: r.defaultPermissions
-        }));
-
-        adminRoles = await applyRoleAfterReadBatch(adminRoles, hookCtx);
-
-        return c.json({ roles: adminRoles });
-    });
-
-    router.get("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-        const role = await authRepo.getRoleById(roleId);
-
-        if (!role) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        return c.json({ role });
-    });
-
-    router.post("/roles", requireAdmin, async (c) => {
-        const body = await c.req.json();
-        const { id, name, isAdmin, defaultPermissions } = body;
-
-        if (!id || !name) {
-            throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
-        }
-
-        const existing = await authRepo.getRoleById(id);
-        if (existing) {
-            throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
-        }
-
-        const role = await authRepo.createRole({
-            id,
-            name,
-            isAdmin: isAdmin ?? false,
-            defaultPermissions: defaultPermissions ?? null
-        });
 
-        return c.json({ role }, 201);
-    });
-
-    router.put("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-        const body = await c.req.json();
-        const { name, isAdmin, defaultPermissions } = body;
-
-        const existing = await authRepo.getRoleById(roleId);
-        if (!existing) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        const role = await authRepo.updateRole(roleId, {
-            name,
-            isAdmin,
-            defaultPermissions
-        });
-
-        return c.json({ role });
-    });
-
-    router.delete("/roles/:roleId", requireAdmin, async (c) => {
-        const roleId = c.req.param("roleId");
-
-        if (["admin", "editor", "viewer"].includes(roleId)) {
-            throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
-        }
-
-        const existing = await authRepo.getRoleById(roleId);
-        if (!existing) {
-            throw ApiError.notFound("Role not found");
-        }
-
-        await authRepo.deleteRole(roleId);
-
-        return c.json({ success: true });
-    });
 
     return router;
 }

package/src/auth/builtin-auth-adapter.ts

@@ -15,13 +15,10 @@ import type {
     AuthenticatedUser,
     AuthAdapterCapabilities,
     UserManagementAdapter,
-    RoleManagementAdapter,
     AuthUserListOptions,
     AuthUserListResult,
     AuthUserData,
     AuthCreateUserData,
-    AuthRoleData,
-    AuthCreateRoleData,
     BootstrappedAuth,
     BackendHooks,
 } from "@rebasepro/types";
@@ -131,8 +128,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
             // Resolve roles from the repository
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -174,8 +170,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
             let roles: string[] = payload.roles || [];
             try {
-                const userRoles = await authRepository.getUserRoles(payload.userId);
-                roles = userRoles.map((r) => r.id);
+                roles = await authRepository.getUserRoleIds(payload.userId);
             } catch {
                 // Fall back to token roles if repository lookup fails
             }
@@ -194,7 +189,7 @@ export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): Auth
 
         userManagement: createUserManagementFromRepo(authRepository, resolvedOps, authHooks),
 
-        roleManagement: createRoleManagementFromRepo(authRepository),
+
 
         createAuthRoutes(): Hono<HonoEnv> | undefined {
             return createAuthRoutes({
@@ -327,9 +322,8 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
             }
         },
 
-        async getUserRoles(userId: string): Promise<AuthRoleData[]> {
-            const roles = await repo.getUserRoles(userId);
-            return roles.map(toAuthRoleData);
+        async getUserRoles(userId: string): Promise<string[]> {
+            return repo.getUserRoleIds(userId);
         },
 
         async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
@@ -338,40 +332,6 @@ function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: Resolve
     };
 }
 
-function createRoleManagementFromRepo(repo: AuthRepository): RoleManagementAdapter {
-    return {
-        async listRoles(): Promise<AuthRoleData[]> {
-            const roles = await repo.listRoles();
-            return roles.map(toAuthRoleData);
-        },
-
-        async getRoleById(id: string): Promise<AuthRoleData | null> {
-            const role = await repo.getRoleById(id);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async createRole(data: AuthCreateRoleData): Promise<AuthRoleData> {
-            const role = await repo.createRole({
-                id: data.id,
-                name: data.name,
-                isAdmin: data.isAdmin,
-                defaultPermissions: data.defaultPermissions,
-                collectionPermissions: data.collectionPermissions,
-            });
-            return toAuthRoleData(role);
-        },
-
-        async updateRole(id: string, data: Partial<AuthRoleData>): Promise<AuthRoleData | null> {
-            const role = await repo.updateRole(id, data);
-            return role ? toAuthRoleData(role) : null;
-        },
-
-        async deleteRole(id: string): Promise<void> {
-            await repo.deleteRole(id);
-        },
-    };
-}
-
 function toAuthUserData(user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; emailVerified?: boolean; metadata?: Record<string, unknown>; createdAt?: Date; updatedAt?: Date }): AuthUserData {
     return {
         id: user.id,
@@ -384,13 +344,3 @@ function toAuthUserData(user: { id: string; email: string; displayName?: string
         updatedAt: user.updatedAt,
     };
 }
-
-function toAuthRoleData(role: { id: string; name: string; isAdmin: boolean; defaultPermissions?: unknown; collectionPermissions?: unknown }): AuthRoleData {
-    return {
-        id: role.id,
-        name: role.name,
-        isAdmin: role.isAdmin,
-        defaultPermissions: role.defaultPermissions as AuthRoleData["defaultPermissions"],
-        collectionPermissions: role.collectionPermissions as AuthRoleData["collectionPermissions"],
-    };
-}

package/src/auth/custom-auth-adapter.ts

@@ -76,7 +76,7 @@ export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): Auth
 
         userManagement: options.userManagement,
 
-        roleManagement: options.roleManagement,
+
 
         getCapabilities() {
             return defaultCapabilities;

package/src/email/smtp-email-service.ts

@@ -1,6 +1,18 @@
 import { createTransport, Transporter } from "nodemailer";
 import { EmailService, EmailSendOptions, EmailConfig } from "./types";
 
+/**
+ * Safely parse a hostname from a URL string
+ */
+function getHostname(urlStr: string): string | undefined {
+    try {
+        const url = new URL(urlStr.includes("://") ? urlStr : `https://${urlStr}`);
+        return url.hostname;
+    } catch {
+        return undefined;
+    }
+}
+
 /**
  * SMTP Email Service implementation using Nodemailer
  */
@@ -12,7 +24,26 @@ export class SMTPEmailService implements EmailService {
         this.config = config;
 
         if (config.smtp) {
+            let smtpName = config.smtp.name;
+            if (!smtpName) {
+                const urlsToTry = [
+                    process.env.FRONTEND_URL,
+                    config.resetPasswordUrl,
+                    config.verifyEmailUrl
+                ];
+                for (const urlStr of urlsToTry) {
+                    if (urlStr) {
+                        const hostname = getHostname(urlStr);
+                        if (hostname) {
+                            smtpName = hostname;
+                            break;
+                        }
+                    }
+                }
+            }
+
             this.transporter = createTransport({
+                name: smtpName,
                 host: config.smtp.host,
                 port: config.smtp.port,
                 secure: config.smtp.secure ?? (config.smtp.port === 465),

package/src/email/types.ts

@@ -22,6 +22,7 @@ export interface SMTPConfig {
         user: string;
         pass: string;
     };
+    name?: string;
 }
 
 /**

package/src/init.ts

@@ -1,7 +1,21 @@
-import { DataDriver, EntityCollection, BackendBootstrapper, BootstrappedAuth, RealtimeProvider, HealthCheckResult, InitializedDriver, isSQLAdmin, BackendHooks, AuthAdapter, DatabaseAdapter } from "@rebasepro/types";
+import {
+    AuthAdapter,
+    BackendBootstrapper,
+    BackendHooks,
+    BootstrappedAuth,
+    DatabaseAdapter,
+    DataDriver,
+    EntityCollection,
+    HealthCheckResult,
+    InitializedDriver,
+    isPostgresCollection,
+    isSQLAdmin,
+    RealtimeProvider,
+    SecurityRule
+} from "@rebasepro/types";
 import { BackendCollectionRegistry } from "./collections/BackendCollectionRegistry";
 import { loadCollectionsFromDirectory } from "./collections/loader";
-import { DriverRegistry, DEFAULT_DRIVER_ID, DefaultDriverRegistry } from "./services/driver-registry";
+import { DEFAULT_DRIVER_ID, DefaultDriverRegistry, DriverRegistry } from "./services/driver-registry";
 import { Server } from "http";
 
 import { RestApiGenerator } from "./api/rest/api-generator";
@@ -16,21 +30,46 @@ import { HonoEnv } from "./api/types";
 import { configureLogLevel } from "./utils/logging";
 import { logger } from "./utils/logger";
 import { requestLogger } from "./utils/request-logger";
-import { createAdminRoutes, createAuthRoutes, requireAuth, requireAdmin, configureJwt } from "./auth";
-import { createStorageController, createStorageRoutes, DEFAULT_STORAGE_ID, DefaultStorageRegistry, BackendStorageConfig, StorageController, StorageRegistry } from "./storage";
+import { configureJwt, requireAdmin, requireAuth } from "./auth";
+import {
+    BackendStorageConfig,
+    createStorageController,
+    createStorageRoutes,
+    DEFAULT_STORAGE_ID,
+    DefaultStorageRegistry,
+    StorageController,
+    StorageRegistry
+} from "./storage";
+import type { ApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyRoutes } from "./auth/api-keys/api-key-routes";
-import type { ApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyRateLimiter } from "./auth/rate-limiter";
 import { createRebaseClient } from "@rebasepro/client";
+
 import { createHistoryRoutes } from "./history";
-import { EmailConfig, createEmailService } from "./email";
 import type { EmailService } from "./email";
+import { createEmailService, EmailConfig } from "./email";
 import type { OAuthProvider } from "./auth/interfaces";
 import type { AuthHooks } from "./auth/auth-hooks";
 import { _initRebase } from "./singleton";
 
 export interface RebaseAuthConfig {
+    /**
+     * The collection that represents auth users.
+     *
+     * When provided, this collection's underlying database table is used
+     * for all auth operations (login, registration, password reset, etc.).
+     *
+     * Import the built-in default:
+     * ```ts
+     * import { defaultUsersCollection } from "@rebasepro/common";
+     * auth: { collection: defaultUsersCollection, jwtSecret: "..." }
+     * ```
+     *
+     * Or pass your own collection with the required auth fields
+     * (email, passwordHash, displayName, etc.).
+     */
+    collection?: EntityCollection;
     jwtSecret?: string;
     accessExpiresIn?: string;
     refreshExpiresIn?: string;
@@ -83,6 +122,7 @@ export interface RebaseAuthConfig {
      * ```
      */
     hooks?: AuthHooks;
+
     [key: string]: unknown;
 }
 
@@ -135,6 +175,20 @@ export interface RebaseBackendConfig {
      */
     storage?: BackendStorageConfig | StorageController | Record<string, BackendStorageConfig | StorageController>;
     history?: unknown;
+    /**
+     * Default security rules applied to any collection that does not define
+     * its own `securityRules`. Opt-in — if not set, collections without
+     * explicit rules remain unrestricted (beyond `requireAuth`).
+     *
+     * @example
+     * ```ts
+     * defaultSecurityRules: [
+     *     { operation: "select", access: "public" },
+     *     { operations: ["insert", "update", "delete"], roles: ["admin"] }
+     * ]
+     * ```
+     */
+    defaultSecurityRules?: SecurityRule[];
     enableSwagger?: boolean;
     functionsDir?: string;
     cronsDir?: string;
@@ -218,11 +272,13 @@ export interface RebaseBackendInstance {
     storageController?: StorageController;
     collectionRegistry: BackendCollectionRegistry;
     cronScheduler?: import("./cron").CronScheduler;
+
     /**
      * Deep health check that verifies database connectivity.
      * Returns latency and component status.
      */
     healthCheck(): Promise<HealthCheckResult>;
+
     /**
      * Graceful shutdown helper for the BaaS instance.
      * Stops the cron scheduler and closes the HTTP server, allowing
@@ -288,8 +344,20 @@ async function _initializeRebaseBackend(config: RebaseBackendConfig): Promise<Re
     let activeCollections = config.collections || [];
     if (config.collectionsDir && activeCollections.length === 0) {
         activeCollections = await loadCollectionsFromDirectory(config.collectionsDir);
-        logger.info("Auto-discovered collections", { count: activeCollections.length,
-dir: config.collectionsDir });
+        logger.info("Auto-discovered collections", {
+            count: activeCollections.length,
+            dir: config.collectionsDir
+        });
+    }
+
+    // Apply default security rules to collections that don't define their own
+    if (config.defaultSecurityRules?.length) {
+        for (const collection of activeCollections) {
+            if (isPostgresCollection(collection) && (!collection.securityRules || collection.securityRules.length === 0)) {
+                collection.securityRules = config.defaultSecurityRules;
+            }
+        }
+        logger.info("Default security rules applied to collections without explicit rules");
     }
 
     const realtimeServices: Record<string, RealtimeProvider> = {};
@@ -333,8 +401,10 @@ dir: config.collectionsDir });
             defaultDriverId = b.id || bootstrapper.type;
         }
 
-        const driverResult = await bootstrapper.initializeDriver({ collections: activeCollections,
-collectionRegistry });
+        const driverResult = await bootstrapper.initializeDriver({
+            collections: activeCollections,
+            collectionRegistry
+        });
         delegates[b.id || bootstrapper.type] = driverResult.driver;
 
         if ((b.id || bootstrapper.type) === defaultDriverId || !defaultDriverResult) {
@@ -354,7 +424,9 @@ collectionRegistry });
     if (!defaultDriver || !defaultDriverResult) {
         throw new Error("Default driver not initialized by bootstrappers");
     }
-    const defaultBootstrapper = bootstrappers.find(b => (b as BackendBootstrapper & { id?: string }).id === defaultDriverId || b.type === defaultDriverId) || bootstrappers[0];
+    const defaultBootstrapper = bootstrappers.find(b => (b as BackendBootstrapper & {
+        id?: string
+    }).id === defaultDriverId || b.type === defaultDriverId) || bootstrappers[0];
     const defaultRealtimeService = defaultDriverResult.realtimeProvider;
 
     // 2. Initialize Auth & History via the default driver's bootstrapper
@@ -378,7 +450,6 @@ collectionRegistry });
             // (the return type still exposes `auth?: BootstrappedAuth`)
             authConfigResult = {
                 userService: authAdapter.userManagement ?? {},
-                roleService: authAdapter.roleManagement ?? {},
             };
         } else {
             // ── RebaseAuthConfig — wrap in built-in adapter ──
@@ -520,7 +591,10 @@ collectionRegistry });
 
             if (safeAuthConfig.linkedin?.clientId && safeAuthConfig.linkedin?.clientSecret) {
                 const { createLinkedinProvider } = await import("./auth");
-                oauthProviders.push(createLinkedinProvider(safeAuthConfig.linkedin as { clientId: string; clientSecret: string }));
+                oauthProviders.push(createLinkedinProvider(safeAuthConfig.linkedin as {
+                    clientId: string;
+                    clientSecret: string
+                }));
             }
 
             if (safeAuthConfig.github?.clientId && safeAuthConfig.github?.clientSecret) {
@@ -790,6 +864,29 @@ collectionRegistry });
     if (emailService) {
         Object.assign(serverClient, { email: emailService });
         logger.info("Email service attached to singleton", { configured: emailService.isConfigured() });
+
+        if (emailService.isConfigured() && typeof emailService.verifyConnection === "function") {
+            emailService.verifyConnection().then((success) => {
+                if (!success) {
+                    logger.warn("Warning: SMTP connection verification failed. Email delivery may fail.");
+                } else {
+                    logger.info("SMTP connection verified successfully.");
+                }
+            }).catch((err) => {
+                logger.warn("Warning: SMTP connection verification failed. Email delivery may fail.", { error: err });
+            });
+        }
+    }
+
+    // Attach raw SQL capability when the driver supports it (Postgres, MySQL).
+    // Document databases (MongoDB, Firestore) won't have this.
+    const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
+    if (isSQLAdmin(driverAdmin)) {
+        Object.assign(serverClient, {
+            sql: (query: string, options?: { database?: string; role?: string }) =>
+                driverAdmin.executeSql(query, options)
+        });
+        logger.info("SQL capability attached to singleton");
     }
 
     _initRebase(serverClient);
@@ -842,8 +939,10 @@ collectionRegistry });
             const fnRoutes = createFunctionRoutes(loadedFunctions);
             functionsRouter.route("/", fnRoutes);
             config.app.route(`${basePath}/functions`, functionsRouter);
-            logger.info("Mounted custom functions", { count: loadedFunctions.length,
-path: `${basePath}/functions` });
+            logger.info("Mounted custom functions", {
+                count: loadedFunctions.length,
+                path: `${basePath}/functions`
+            });
         }
     }
 
@@ -892,13 +991,19 @@ path: `${basePath}/functions` });
             // Start the scheduler
             cronScheduler.start();
 
-            logger.info("Mounted cron jobs", { count: loadedCronJobs.length,
-path: `${basePath}/cron` });
+            logger.info("Mounted cron jobs", {
+                count: loadedCronJobs.length,
+                path: `${basePath}/cron`
+            });
         }
     }
 
-    if ((defaultBootstrapper as BackendBootstrapper & { initializeWebsockets?: (...args: unknown[]) => unknown }).initializeWebsockets) {
-        await (defaultBootstrapper as BackendBootstrapper & { initializeWebsockets: (...args: unknown[]) => unknown }).initializeWebsockets(config.server, defaultRealtimeService, defaultDriver, config.auth, authAdapter);
+    if ((defaultBootstrapper as BackendBootstrapper & {
+        initializeWebsockets?: (...args: unknown[]) => unknown
+    }).initializeWebsockets) {
+        await (defaultBootstrapper as BackendBootstrapper & {
+            initializeWebsockets: (...args: unknown[]) => unknown
+        }).initializeWebsockets(config.server, defaultRealtimeService, defaultDriver, config.auth, authAdapter);
     }
 
     logger.info("Rebase Backend Initialized");
@@ -913,12 +1018,16 @@ path: `${basePath}/cron` });
                 await admin.executeSql("SELECT 1");
             } else {
                 // Fallback: try a lightweight fetch to confirm driver is responsive
-                await defaultDriver.fetchCollection({ path: "__health_check_nonexistent__",
-limit: 1 });
+                await defaultDriver.fetchCollection({
+                    path: "__health_check_nonexistent__",
+                    limit: 1
+                });
             }
             const latencyMs = Math.round(performance.now() - start);
-            return { healthy: true,
-latencyMs };
+            return {
+                healthy: true,
+                latencyMs
+            };
         } catch (error: unknown) {
             const latencyMs = Math.round(performance.now() - start);
             logger.error("Health check failed", {
@@ -952,7 +1061,10 @@ latencyMs };
                 //    timer callbacks don't fire against a closed pool.
                 for (const [key, rt] of Object.entries(realtimeServices)) {
                     try {
-                        const rtWithLifecycle = rt as RealtimeProvider & { destroy?: () => Promise<void>; stopListening?: () => Promise<void> };
+                        const rtWithLifecycle = rt as RealtimeProvider & {
+                            destroy?: () => Promise<void>;
+                            stopListening?: () => Promise<void>
+                        };
                         if (typeof rtWithLifecycle.destroy === "function") {
                             await rtWithLifecycle.destroy();
                             logger.info(`Realtime service "${key}" destroyed`);

package/src/storage/image-transform.ts

@@ -6,9 +6,10 @@
  * in-memory cache to avoid redundant processing.
  */
 
-// Lazy-load sharp to avoid crashing when it isn't installed (e.g. in tests)
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let sharpFactory: ((input: Buffer | Uint8Array) => any) | undefined;
 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 async function getSharp(): Promise<(input: Buffer | Uint8Array) => any> {
     if (!sharpFactory) {
         try {