@rebasepro/server-core 0.3.0 → 0.5.0

package/src/email/smtp-email-service.ts

@@ -1,6 +1,18 @@
 import { createTransport, Transporter } from "nodemailer";
 import { EmailService, EmailSendOptions, EmailConfig } from "./types";
 
+/**
+ * Safely parse a hostname from a URL string
+ */
+function getHostname(urlStr: string): string | undefined {
+    try {
+        const url = new URL(urlStr.includes("://") ? urlStr : `https://${urlStr}`);
+        return url.hostname;
+    } catch {
+        return undefined;
+    }
+}
+
 /**
  * SMTP Email Service implementation using Nodemailer
  */
@@ -12,7 +24,26 @@ export class SMTPEmailService implements EmailService {
         this.config = config;
 
         if (config.smtp) {
+            let smtpName = config.smtp.name;
+            if (!smtpName) {
+                const urlsToTry = [
+                    process.env.FRONTEND_URL,
+                    config.resetPasswordUrl,
+                    config.verifyEmailUrl
+                ];
+                for (const urlStr of urlsToTry) {
+                    if (urlStr) {
+                        const hostname = getHostname(urlStr);
+                        if (hostname) {
+                            smtpName = hostname;
+                            break;
+                        }
+                    }
+                }
+            }
+
             this.transporter = createTransport({
+                name: smtpName,
                 host: config.smtp.host,
                 port: config.smtp.port,
                 secure: config.smtp.secure ?? (config.smtp.port === 465),

package/src/email/types.ts

@@ -22,6 +22,7 @@ export interface SMTPConfig {
         user: string;
         pass: string;
     };
+    name?: string;
 }
 
 /**

package/src/init.ts

@@ -1,7 +1,21 @@
-import { DataDriver, EntityCollection, BackendBootstrapper, BootstrappedAuth, RealtimeProvider, HealthCheckResult, InitializedDriver, isSQLAdmin, BackendHooks, AuthAdapter, DatabaseAdapter } from "@rebasepro/types";
+import {
+    AuthAdapter,
+    BackendBootstrapper,
+    BackendHooks,
+    BootstrappedAuth,
+    DatabaseAdapter,
+    DataDriver,
+    EntityCollection,
+    HealthCheckResult,
+    InitializedDriver,
+    isPostgresCollection,
+    isSQLAdmin,
+    RealtimeProvider,
+    SecurityRule
+} from "@rebasepro/types";
 import { BackendCollectionRegistry } from "./collections/BackendCollectionRegistry";
 import { loadCollectionsFromDirectory } from "./collections/loader";
-import { DriverRegistry, DEFAULT_DRIVER_ID, DefaultDriverRegistry } from "./services/driver-registry";
+import { DEFAULT_DRIVER_ID, DefaultDriverRegistry, DriverRegistry } from "./services/driver-registry";
 import { Server } from "http";
 
 import { RestApiGenerator } from "./api/rest/api-generator";
@@ -16,21 +30,46 @@ import { HonoEnv } from "./api/types";
 import { configureLogLevel } from "./utils/logging";
 import { logger } from "./utils/logger";
 import { requestLogger } from "./utils/request-logger";
-import { createAdminRoutes, createAuthRoutes, requireAuth, requireAdmin, configureJwt } from "./auth";
-import { createStorageController, createStorageRoutes, DEFAULT_STORAGE_ID, DefaultStorageRegistry, BackendStorageConfig, StorageController, StorageRegistry } from "./storage";
+import { configureJwt, requireAdmin, requireAuth } from "./auth";
+import {
+    BackendStorageConfig,
+    createStorageController,
+    createStorageRoutes,
+    DEFAULT_STORAGE_ID,
+    DefaultStorageRegistry,
+    StorageController,
+    StorageRegistry
+} from "./storage";
+import type { ApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyRoutes } from "./auth/api-keys/api-key-routes";
-import type { ApiKeyStore } from "./auth/api-keys/api-key-store";
 import { createApiKeyRateLimiter } from "./auth/rate-limiter";
 import { createRebaseClient } from "@rebasepro/client";
+
 import { createHistoryRoutes } from "./history";
-import { EmailConfig, createEmailService } from "./email";
 import type { EmailService } from "./email";
+import { createEmailService, EmailConfig } from "./email";
 import type { OAuthProvider } from "./auth/interfaces";
 import type { AuthHooks } from "./auth/auth-hooks";
 import { _initRebase } from "./singleton";
 
 export interface RebaseAuthConfig {
+    /**
+     * The collection that represents auth users.
+     *
+     * When provided, this collection's underlying database table is used
+     * for all auth operations (login, registration, password reset, etc.).
+     *
+     * Import the built-in default:
+     * ```ts
+     * import { defaultUsersCollection } from "@rebasepro/common";
+     * auth: { collection: defaultUsersCollection, jwtSecret: "..." }
+     * ```
+     *
+     * Or pass your own collection with the required auth fields
+     * (email, passwordHash, displayName, etc.).
+     */
+    collection?: EntityCollection;
     jwtSecret?: string;
     accessExpiresIn?: string;
     refreshExpiresIn?: string;
@@ -83,6 +122,7 @@ export interface RebaseAuthConfig {
      * ```
      */
     hooks?: AuthHooks;
+
     [key: string]: unknown;
 }
 
@@ -135,6 +175,20 @@ export interface RebaseBackendConfig {
      */
     storage?: BackendStorageConfig | StorageController | Record<string, BackendStorageConfig | StorageController>;
     history?: unknown;
+    /**
+     * Default security rules applied to any collection that does not define
+     * its own `securityRules`. Opt-in — if not set, collections without
+     * explicit rules remain unrestricted (beyond `requireAuth`).
+     *
+     * @example
+     * ```ts
+     * defaultSecurityRules: [
+     *     { operation: "select", access: "public" },
+     *     { operations: ["insert", "update", "delete"], roles: ["admin"] }
+     * ]
+     * ```
+     */
+    defaultSecurityRules?: SecurityRule[];
     enableSwagger?: boolean;
     functionsDir?: string;
     cronsDir?: string;
@@ -218,11 +272,13 @@ export interface RebaseBackendInstance {
     storageController?: StorageController;
     collectionRegistry: BackendCollectionRegistry;
     cronScheduler?: import("./cron").CronScheduler;
+
     /**
      * Deep health check that verifies database connectivity.
      * Returns latency and component status.
      */
     healthCheck(): Promise<HealthCheckResult>;
+
     /**
      * Graceful shutdown helper for the BaaS instance.
      * Stops the cron scheduler and closes the HTTP server, allowing
@@ -288,8 +344,20 @@ async function _initializeRebaseBackend(config: RebaseBackendConfig): Promise<Re
     let activeCollections = config.collections || [];
     if (config.collectionsDir && activeCollections.length === 0) {
         activeCollections = await loadCollectionsFromDirectory(config.collectionsDir);
-        logger.info("Auto-discovered collections", { count: activeCollections.length,
-dir: config.collectionsDir });
+        logger.info("Auto-discovered collections", {
+            count: activeCollections.length,
+            dir: config.collectionsDir
+        });
+    }
+
+    // Apply default security rules to collections that don't define their own
+    if (config.defaultSecurityRules?.length) {
+        for (const collection of activeCollections) {
+            if (isPostgresCollection(collection) && (!collection.securityRules || collection.securityRules.length === 0)) {
+                collection.securityRules = config.defaultSecurityRules;
+            }
+        }
+        logger.info("Default security rules applied to collections without explicit rules");
     }
 
     const realtimeServices: Record<string, RealtimeProvider> = {};
@@ -327,14 +395,16 @@ dir: config.collectionsDir });
 
     // 1. Initialize all drivers
     for (const bootstrapper of bootstrappers) {
-        const b = bootstrapper as BackendBootstrapper & { id?: string; isDefault?: boolean };
+        const b = bootstrapper;
         logger.info("Running bootstrapper for driver", { driverId: b.id || bootstrapper.type });
         if (b.isDefault) {
             defaultDriverId = b.id || bootstrapper.type;
         }
 
-        const driverResult = await bootstrapper.initializeDriver({ collections: activeCollections,
-collectionRegistry });
+        const driverResult = await bootstrapper.initializeDriver({
+            collections: activeCollections,
+            collectionRegistry
+        });
         delegates[b.id || bootstrapper.type] = driverResult.driver;
 
         if ((b.id || bootstrapper.type) === defaultDriverId || !defaultDriverResult) {
@@ -343,7 +413,9 @@ collectionRegistry });
 
         if (bootstrapper.initializeRealtime) {
             const realtime = await bootstrapper.initializeRealtime({}, driverResult);
-            realtimeServices[b.id || bootstrapper.type] = realtime as RealtimeProvider;
+            if (realtime) {
+                realtimeServices[b.id || bootstrapper.type] = realtime;
+            }
         }
     }
 
@@ -354,7 +426,7 @@ collectionRegistry });
     if (!defaultDriver || !defaultDriverResult) {
         throw new Error("Default driver not initialized by bootstrappers");
     }
-    const defaultBootstrapper = bootstrappers.find(b => (b as BackendBootstrapper & { id?: string }).id === defaultDriverId || b.type === defaultDriverId) || bootstrappers[0];
+    const defaultBootstrapper = bootstrappers.find(b => b.id === defaultDriverId || b.type === defaultDriverId) || bootstrappers[0];
     const defaultRealtimeService = defaultDriverResult.realtimeProvider;
 
     // 2. Initialize Auth & History via the default driver's bootstrapper
@@ -378,7 +450,6 @@ collectionRegistry });
             // (the return type still exposes `auth?: BootstrappedAuth`)
             authConfigResult = {
                 userService: authAdapter.userManagement ?? {},
-                roleService: authAdapter.roleManagement ?? {},
             };
         } else {
             // ── RebaseAuthConfig — wrap in built-in adapter ──
@@ -520,7 +591,10 @@ collectionRegistry });
 
             if (safeAuthConfig.linkedin?.clientId && safeAuthConfig.linkedin?.clientSecret) {
                 const { createLinkedinProvider } = await import("./auth");
-                oauthProviders.push(createLinkedinProvider(safeAuthConfig.linkedin as { clientId: string; clientSecret: string }));
+                oauthProviders.push(createLinkedinProvider(safeAuthConfig.linkedin as {
+                    clientId: string;
+                    clientSecret: string
+                }));
             }
 
             if (safeAuthConfig.github?.clientId && safeAuthConfig.github?.clientSecret) {
@@ -647,7 +721,7 @@ collectionRegistry });
         // maxFileSize (default 50MB), which overrides the global API body limit.
         const storageMaxSize = (
             config.storage && typeof config.storage === "object" && "type" in config.storage
-                ? (config.storage as BackendStorageConfig & { maxFileSize?: number }).maxFileSize
+                ? (config.storage as BackendStorageConfig).maxFileSize
                 : undefined
         ) ?? 50 * 1024 * 1024;
 
@@ -790,6 +864,29 @@ collectionRegistry });
     if (emailService) {
         Object.assign(serverClient, { email: emailService });
         logger.info("Email service attached to singleton", { configured: emailService.isConfigured() });
+
+        if (emailService.isConfigured() && typeof emailService.verifyConnection === "function") {
+            emailService.verifyConnection().then((success) => {
+                if (!success) {
+                    logger.warn("Warning: SMTP connection verification failed. Email delivery may fail.");
+                } else {
+                    logger.info("SMTP connection verified successfully.");
+                }
+            }).catch((err) => {
+                logger.warn("Warning: SMTP connection verification failed. Email delivery may fail.", { error: err });
+            });
+        }
+    }
+
+    // Attach raw SQL capability when the driver supports it (Postgres, MySQL).
+    // Document databases (MongoDB, Firestore) won't have this.
+    const driverAdmin = defaultBootstrapper.getAdmin?.(defaultDriverResult);
+    if (isSQLAdmin(driverAdmin)) {
+        Object.assign(serverClient, {
+            sql: (query: string, options?: { database?: string; role?: string }) =>
+                driverAdmin.executeSql(query, options)
+        });
+        logger.info("SQL capability attached to singleton");
     }
 
     _initRebase(serverClient);
@@ -842,8 +939,10 @@ collectionRegistry });
             const fnRoutes = createFunctionRoutes(loadedFunctions);
             functionsRouter.route("/", fnRoutes);
             config.app.route(`${basePath}/functions`, functionsRouter);
-            logger.info("Mounted custom functions", { count: loadedFunctions.length,
-path: `${basePath}/functions` });
+            logger.info("Mounted custom functions", {
+                count: loadedFunctions.length,
+                path: `${basePath}/functions`
+            });
         }
     }
 
@@ -892,13 +991,15 @@ path: `${basePath}/functions` });
             // Start the scheduler
             cronScheduler.start();
 
-            logger.info("Mounted cron jobs", { count: loadedCronJobs.length,
-path: `${basePath}/cron` });
+            logger.info("Mounted cron jobs", {
+                count: loadedCronJobs.length,
+                path: `${basePath}/cron`
+            });
         }
     }
 
-    if ((defaultBootstrapper as BackendBootstrapper & { initializeWebsockets?: (...args: unknown[]) => unknown }).initializeWebsockets) {
-        await (defaultBootstrapper as BackendBootstrapper & { initializeWebsockets: (...args: unknown[]) => unknown }).initializeWebsockets(config.server, defaultRealtimeService, defaultDriver, config.auth, authAdapter);
+    if (defaultBootstrapper.initializeWebsockets && defaultRealtimeService) {
+        await defaultBootstrapper.initializeWebsockets(config.server, defaultRealtimeService, defaultDriver, config.auth, authAdapter);
     }
 
     logger.info("Rebase Backend Initialized");
@@ -913,12 +1014,16 @@ path: `${basePath}/cron` });
                 await admin.executeSql("SELECT 1");
             } else {
                 // Fallback: try a lightweight fetch to confirm driver is responsive
-                await defaultDriver.fetchCollection({ path: "__health_check_nonexistent__",
-limit: 1 });
+                await defaultDriver.fetchCollection({
+                    path: "__health_check_nonexistent__",
+                    limit: 1
+                });
             }
             const latencyMs = Math.round(performance.now() - start);
-            return { healthy: true,
-latencyMs };
+            return {
+                healthy: true,
+                latencyMs
+            };
         } catch (error: unknown) {
             const latencyMs = Math.round(performance.now() - start);
             logger.error("Health check failed", {
@@ -952,12 +1057,11 @@ latencyMs };
                 //    timer callbacks don't fire against a closed pool.
                 for (const [key, rt] of Object.entries(realtimeServices)) {
                     try {
-                        const rtWithLifecycle = rt as RealtimeProvider & { destroy?: () => Promise<void>; stopListening?: () => Promise<void> };
-                        if (typeof rtWithLifecycle.destroy === "function") {
-                            await rtWithLifecycle.destroy();
+                        if (typeof rt.destroy === "function") {
+                            await rt.destroy();
                             logger.info(`Realtime service "${key}" destroyed`);
-                        } else if (typeof rtWithLifecycle.stopListening === "function") {
-                            await rtWithLifecycle.stopListening();
+                        } else if (typeof rt.stopListening === "function") {
+                            await rt.stopListening();
                             logger.info(`Realtime service "${key}" LISTEN client stopped`);
                         }
                     } catch (err) {

package/src/storage/image-transform.ts

@@ -6,9 +6,10 @@
  * in-memory cache to avoid redundant processing.
  */
 
-// Lazy-load sharp to avoid crashing when it isn't installed (e.g. in tests)
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let sharpFactory: ((input: Buffer | Uint8Array) => any) | undefined;
 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 async function getSharp(): Promise<(input: Buffer | Uint8Array) => any> {
     if (!sharpFactory) {
         try {

package/test/admin-routes.test.ts

@@ -540,174 +540,5 @@ displayName: "Updated" }),
         });
     });
 
-    // ── Role CRUD ───────────────────────────────────────────────────────
-    describe("Role Management", () => {
-        describe("GET /admin/roles", () => {
-            it("returns list of roles", async () => {
-                const app = createApp();
-                mockAuthRepo.listRoles.mockResolvedValueOnce([
-                    mockRole("admin", true),
-                    mockRole("editor"),
-                    mockRole("viewer")
-                ]);
-
-                const res = await app.request("/admin/roles", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(200);
-                const body = await res.json() as any;
-                expect(body.roles).toHaveLength(3);
-                expect(body.roles[0].isAdmin).toBe(true);
-            });
-        });
-
-        describe("GET /admin/roles/:roleId", () => {
-            it("returns role by ID", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("admin", true));
-
-                const res = await app.request("/admin/roles/admin", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(200);
-                const body = await res.json() as any;
-                expect(body.role.id).toBe("admin");
-                expect(body.role.isAdmin).toBe(true);
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/missing", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(404);
-            });
-        });
-
-        describe("POST /admin/roles", () => {
-            it("creates a new role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "custom",
-name: "Custom Role" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(201);
-                const body = await res.json() as any;
-                expect(body.role.id).toBe("custom");
-            });
 
-            it("returns 400 for missing id or name", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "nope" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("returns 409 when role already exists", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("custom"));
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "custom",
-name: "Dup" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(409);
-                const body = await res.json() as any;
-                expect(body.error.code).toBe("ROLE_EXISTS");
-            });
-        });
-
-        describe("PUT /admin/roles/:roleId", () => {
-            it("updates an existing role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("editor"));
-
-                const res = await app.request("/admin/roles/editor", {
-                    method: "PUT",
-                    headers: { "Content-Type": "application/json",
-...adminAuth() },
-                    body: JSON.stringify({ name: "Super Editor" })
-                });
-                expect(res.status).toBe(200);
-                expect(mockAuthRepo.updateRole).toHaveBeenCalledWith("editor", expect.objectContaining({
-                    name: "Super Editor"
-                }));
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/missing", {
-                    method: "PUT",
-                    headers: { "Content-Type": "application/json",
-...adminAuth() },
-                    body: JSON.stringify({ name: "Nope" })
-                });
-                expect(res.status).toBe(404);
-            });
-        });
-
-        describe("DELETE /admin/roles/:roleId", () => {
-            it("deletes a custom role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("custom"));
-
-                const res = await app.request("/admin/roles/custom", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(200);
-                expect(mockAuthRepo.deleteRole).toHaveBeenCalledWith("custom");
-            });
-
-            it("prevents deletion of built-in admin role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles/admin", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-                const body = await res.json() as any;
-                expect(body.error.code).toBe("BUILTIN_ROLE");
-            });
-
-            it("prevents deletion of built-in editor role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles/editor", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("prevents deletion of built-in viewer role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles/viewer", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/ghost", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(404);
-            });
-        });
-    });
 });

package/test/backend-hooks-admin.test.ts

@@ -362,32 +362,7 @@ describe("BackendHooks — Admin Routes", () => {
         });
     });
 
-    // ── roles.afterRead ─────────────────────────────────────────────────
-    describe("roles.afterRead", () => {
-        it("filters out roles from GET /admin/roles", async () => {
-            const hooks: BackendHooks = {
-                roles: {
-                    afterRead(role) {
-                        // Hide internal roles
-                        if (role.id === "internal") return null;
-                        return role;
-                    }
-                }
-            };
-            const app = createApp(hooks);
-            mockAuthRepo.listRoles.mockResolvedValueOnce([
-                mockRole("admin", true),
-                mockRole("internal"),
-                mockRole("editor")
-            ]);
 
-            const res = await app.request("/admin/roles", { headers: { ...adminAuth() } });
-            expect(res.status).toBe(200);
-            const body = await res.json() as any;
-            expect(body.roles).toHaveLength(2);
-            expect(body.roles.map((r: any) => r.id)).toEqual(["admin", "editor"]);
-        });
-    });
 
     // ── no hooks (passthrough) ──────────────────────────────────────────
     describe("no hooks configured", () => {

package/test/custom-auth-adapter.test.ts

@@ -143,7 +143,7 @@ describe("createCustomAuthAdapter", () => {
         expect(adapter.serviceKey).toBe("sk_live_123");
     });
 
-    it("passes through userManagement and roleManagement when provided", () => {
+    it("passes through userManagement when provided", () => {
         const userMgmt = {
             getUser: jest.fn(),
             listUsers: jest.fn(),
@@ -151,27 +151,19 @@ describe("createCustomAuthAdapter", () => {
             updateUser: jest.fn(),
             deleteUser: jest.fn(),
         };
-        const roleMgmt = {
-            listRoles: jest.fn(),
-            getUserRoles: jest.fn(),
-            setUserRoles: jest.fn(),
-        };
 
         const adapter = createCustomAuthAdapter({
             verifyRequest: async () => null,
             userManagement: userMgmt as unknown as CustomAuthAdapterOptions["userManagement"],
-            roleManagement: roleMgmt as unknown as CustomAuthAdapterOptions["roleManagement"],
         });
 
         expect(adapter.userManagement).toBe(userMgmt);
-        expect(adapter.roleManagement).toBe(roleMgmt);
     });
 
-    it("omits userManagement and roleManagement when not provided", () => {
+    it("omits userManagement when not provided", () => {
         const adapter = createCustomAuthAdapter({
             verifyRequest: async () => null,
         });
         expect(adapter.userManagement).toBeUndefined();
-        expect(adapter.roleManagement).toBeUndefined();
     });
 });