@rebasepro/server-core 0.6.0 → 0.7.0

package/dist/auth/interfaces.d.ts

@@ -1,401 +0,0 @@
-import { z } from "zod";
-/**
- * Authentication Abstraction Interfaces
- *
- * These interfaces define the contracts for authentication-related operations.
- * Implementations can use different databases (PostgreSQL, MongoDB, etc.) to
- * store user, role, and token data.
- */
-/**
- * User data structure
- */
-export interface UserData {
-    id: string;
-    email: string;
-    passwordHash?: string | null;
-    displayName?: string | null;
-    photoUrl?: string | null;
-    emailVerified: boolean;
-    emailVerificationToken?: string | null;
-    emailVerificationSentAt?: Date | null;
-    isAnonymous?: boolean;
-    metadata?: Record<string, unknown>;
-    createdAt: Date;
-    updatedAt: Date;
-}
-/**
- * Data for creating a new user
- */
-export interface CreateUserData {
-    email: string;
-    passwordHash?: string;
-    displayName?: string;
-    photoUrl?: string;
-    emailVerified?: boolean;
-    isAnonymous?: boolean;
-    metadata?: Record<string, unknown>;
-}
-/**
- * User Identity Data (OAuth accounts linked to user)
- */
-export interface UserIdentityData {
-    id: string;
-    userId: string;
-    provider: string;
-    providerId: string;
-    profileData?: Record<string, unknown> | null;
-    createdAt: Date;
-    updatedAt: Date;
-}
-/**
- * Standardized profile data returned by an OAuth provider verification payload
- */
-export interface OAuthProviderProfile {
-    providerId: string;
-    email: string;
-    displayName?: string | null;
-    photoUrl?: string | null;
-}
-/**
- * Pluggable OAuth Provider integration strategy
- */
-export interface OAuthProvider<T = unknown> {
-    /** The identifier of the provider (e.g. "github", "google") */
-    id: string;
-    /** Zod schema validating the expected request payload (e.g. { code: string }) */
-    schema: z.ZodSchema<T>;
-    /** Verify external tokens/codes and return a standardized user profile */
-    verify: (payload: T) => Promise<OAuthProviderProfile | null>;
-}
-/**
- * Role data structure
- */
-export interface RoleData {
-    id: string;
-    name: string;
-    isAdmin: boolean;
-    defaultPermissions: {
-        read?: boolean;
-        create?: boolean;
-        edit?: boolean;
-        delete?: boolean;
-    } | null;
-    collectionPermissions: Record<string, {
-        read?: boolean;
-        create?: boolean;
-        edit?: boolean;
-        delete?: boolean;
-    }> | null;
-}
-/**
- * Data for creating a new role
- */
-export interface CreateRoleData {
-    id: string;
-    name: string;
-    isAdmin?: boolean;
-    defaultPermissions?: RoleData["defaultPermissions"];
-    collectionPermissions?: RoleData["collectionPermissions"];
-}
-/**
- * Refresh token info
- */
-export interface RefreshTokenInfo {
-    id: string;
-    userId: string;
-    tokenHash: string;
-    expiresAt: Date;
-    createdAt: Date;
-    userAgent?: string | null;
-    ipAddress?: string | null;
-}
-/**
- * Password reset token info
- */
-export interface PasswordResetTokenInfo {
-    userId: string;
-    expiresAt: Date;
-}
-/**
- * Options for paginated user listing
- */
-export interface ListUsersOptions {
-    /** Max results per page (default 25) */
-    limit?: number;
-    /** Number of results to skip (default 0) */
-    offset?: number;
-    /** Search term — matches against email and displayName (case-insensitive) */
-    search?: string;
-    /** Field to sort by (default "createdAt") */
-    orderBy?: string;
-    /** Sort direction (default "desc") */
-    orderDir?: "asc" | "desc";
-    /** Filter by role ID */
-    roleId?: string;
-}
-/**
- * Result of a paginated user listing
- */
-export interface PaginatedUsersResult {
-    users: UserData[];
-    /** Total number of users matching the filters (ignoring limit/offset) */
-    total: number;
-    limit: number;
-    offset: number;
-}
-/**
- * Abstract user repository interface.
- * Handles all user-related database operations.
- */
-export interface UserRepository {
-    /**
-     * Create a new user
-     */
-    createUser(data: CreateUserData): Promise<UserData>;
-    /**
-     * Get a user by ID
-     */
-    getUserById(id: string): Promise<UserData | null>;
-    /**
-     * Get a user by email
-     */
-    getUserByEmail(email: string): Promise<UserData | null>;
-    /**
-     * Get a user by an OAuth identity
-     */
-    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
-    /**
-     * Get all identities linked to a user
-     */
-    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
-    /**
-     * Link a new OAuth identity to a user
-     */
-    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
-    /**
-     * Update a user
-     */
-    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
-    /**
-     * Delete a user
-     */
-    deleteUser(id: string): Promise<void>;
-    /**
-     * List all users (unbounded — use listUsersPaginated for large datasets)
-     */
-    listUsers(): Promise<UserData[]>;
-    /**
-     * List users with server-side pagination, search, and sorting.
-     */
-    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
-    /**
-     * Update user's password hash
-     */
-    updatePassword(id: string, passwordHash: string): Promise<void>;
-    /**
-     * Set email verification status
-     */
-    setEmailVerified(id: string, verified: boolean): Promise<void>;
-    /**
-     * Set email verification token
-     */
-    setVerificationToken(id: string, token: string | null): Promise<void>;
-    /**
-     * Find user by email verification token
-     */
-    getUserByVerificationToken(token: string): Promise<UserData | null>;
-    /**
-     * Get roles for a user
-     */
-    getUserRoles(userId: string): Promise<RoleData[]>;
-    /**
-     * Get role IDs for a user
-     */
-    getUserRoleIds(userId: string): Promise<string[]>;
-    /**
-     * Set roles for a user (replaces existing roles)
-     */
-    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
-    /**
-     * Assign a specific role to a new user
-     */
-    assignDefaultRole(userId: string, roleId: string): Promise<void>;
-    /**
-     * Get user with their roles
-     */
-    getUserWithRoles(userId: string): Promise<{
-        user: UserData;
-        roles: RoleData[];
-    } | null>;
-}
-/**
- * Abstract role repository interface.
- * Handles all role-related database operations.
- */
-export interface RoleRepository {
-    /**
-     * Get a role by ID
-     */
-    getRoleById(id: string): Promise<RoleData | null>;
-    /**
-     * List all roles
-     */
-    listRoles(): Promise<RoleData[]>;
-    /**
-     * Create a new role
-     */
-    createRole(data: CreateRoleData): Promise<RoleData>;
-    /**
-     * Update a role
-     */
-    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
-    /**
-     * Delete a role
-     */
-    deleteRole(id: string): Promise<void>;
-}
-/**
- * Abstract token repository interface.
- * Handles refresh tokens and password reset tokens.
- */
-export interface TokenRepository {
-    /**
-     * Create a new refresh token
-     */
-    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
-    /**
-     * Find a refresh token by hash
-     */
-    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
-    /**
-     * Delete a refresh token by hash
-     */
-    deleteRefreshToken(tokenHash: string): Promise<void>;
-    /**
-     * Delete all refresh tokens for a user
-     */
-    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
-    /**
-     * List all refresh tokens for a user
-     */
-    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
-    /**
-     * Delete a specific refresh token by its primary key ID
-     */
-    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
-    /**
-     * Create a password reset token
-     */
-    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
-    /**
-     * Find a valid (not expired, not used) password reset token by hash
-     */
-    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
-    /**
-     * Mark a password reset token as used
-     */
-    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
-    /**
-     * Delete all password reset tokens for a user
-     */
-    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
-    /**
-     * Clean up expired tokens
-     */
-    deleteExpiredTokens(): Promise<void>;
-}
-/**
- * MFA factor data structure
- */
-export interface MfaFactor {
-    id: string;
-    userId: string;
-    factorType: "totp";
-    friendlyName?: string;
-    verified: boolean;
-    createdAt: Date;
-    updatedAt: Date;
-}
-/**
- * MFA challenge information
- */
-export interface MfaChallengeInfo {
-    id: string;
-    factorId: string;
-    createdAt: Date;
-    verifiedAt?: Date;
-    ipAddress?: string;
-}
-/**
- * Recovery code data structure
- */
-export interface RecoveryCode {
-    id: string;
-    userId: string;
-    usedAt?: Date;
-}
-/**
- * Abstract MFA repository interface.
- * Handles all MFA-related database operations.
- */
-export interface MfaRepository {
-    /**
-     * Create a new MFA factor for a user
-     */
-    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
-    /**
-     * Get all MFA factors for a user
-     */
-    getMfaFactors(userId: string): Promise<MfaFactor[]>;
-    /**
-     * Get a specific MFA factor by ID
-     */
-    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
-        secretEncrypted: string;
-    }) | null>;
-    /**
-     * Mark an MFA factor as verified
-     */
-    verifyMfaFactor(factorId: string): Promise<void>;
-    /**
-     * Delete an MFA factor
-     */
-    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
-    /**
-     * Create an MFA challenge
-     */
-    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
-    /**
-     * Get an MFA challenge by ID
-     */
-    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
-    /**
-     * Mark an MFA challenge as verified
-     */
-    verifyMfaChallenge(challengeId: string): Promise<void>;
-    /**
-     * Create recovery codes for a user
-     */
-    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
-    /**
-     * Use a recovery code (mark as used)
-     */
-    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
-    /**
-     * Get unused recovery code count for a user
-     */
-    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
-    /**
-     * Delete all recovery codes for a user
-     */
-    deleteAllRecoveryCodes(userId: string): Promise<void>;
-    /**
-     * Check if a user has any verified MFA factors
-     */
-    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
-}
-/**
- * Combined auth repository interface for convenience
- */
-export interface AuthRepository extends UserRepository, RoleRepository, TokenRepository, MfaRepository {
-}

package/dist/auth/jwt.d.ts

@@ -1,55 +0,0 @@
-export interface JwtConfig {
-    secret: string;
-    accessExpiresIn?: string;
-    refreshExpiresIn?: string;
-}
-export interface AccessTokenPayload {
-    userId: string;
-    roles: string[];
-    uid?: string;
-    /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
-    aal?: "aal1" | "aal2";
-    /** Email claim from the JWT, if present */
-    email?: string;
-    /** Display name claim from the JWT, if present */
-    displayName?: string;
-    /** Photo URL claim from the JWT, if present */
-    photoURL?: string;
-    /** Whether MFA has been verified for this session */
-    mfa_verified?: boolean;
-    /** Authentication Methods Reference — list of methods used (e.g. 'pwd', 'otp') */
-    amr?: string[];
-}
-/**
- * Configure JWT settings - call this during initialization.
- * Validates the secret strength to prevent deployment with default/weak secrets.
- */
-export declare function configureJwt(config: JwtConfig): void;
-/**
- * Generate an access token (short-lived, 1 hour by default)
- */
-export declare function generateAccessToken(userId: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
-/**
- * Get the expiration time of an access token in milliseconds from now
- */
-export declare function getAccessTokenExpiryMs(): number;
-/**
- * Get the expiration timestamp for an access token
- */
-export declare function getAccessTokenExpiry(): number;
-/**
- * Verify and decode an access token
- */
-export declare function verifyAccessToken(token: string): AccessTokenPayload | null;
-/**
- * Generate a random refresh token (long-lived, 30 days by default)
- */
-export declare function generateRefreshToken(): string;
-/**
- * Hash a refresh token for database storage (don't store raw tokens)
- */
-export declare function hashRefreshToken(token: string): string;
-/**
- * Calculate refresh token expiration date
- */
-export declare function getRefreshTokenExpiry(): Date;

package/dist/auth/linkedin-oauth.d.ts

@@ -1,18 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-export interface LinkedinUserInfo {
-    linkedinId: string;
-    email: string;
-    displayName: string | null;
-    photoUrl: string | null;
-    emailVerified: boolean;
-}
-/**
- * Creates a LinkedIn OAuth Provider integration
- */
-export declare function createLinkedinProvider(config: {
-    clientId: string;
-    clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/mfa-routes.d.ts

@@ -1,6 +0,0 @@
-import { Hono } from "hono";
-import { z } from "zod";
-import { HonoEnv } from "../api/types";
-import type { AuthModuleConfig } from "./routes";
-import { resolveAuthHooks } from "./auth-hooks";
-export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T): void;

package/dist/auth/mfa.d.ts

@@ -1,49 +0,0 @@
-/**
- * TOTP (Time-based One-Time Password) implementation.
- *
- * Pure Node.js crypto implementation — no external dependencies required.
- * Implements RFC 6238 (TOTP) and RFC 4226 (HOTP).
- */
-/**
- * Encode a Buffer to Base32 string (RFC 4648)
- */
-export declare function base32Encode(buffer: Buffer): string;
-/**
- * Decode a Base32 string to Buffer
- */
-export declare function base32Decode(encoded: string): Buffer;
-/**
- * Generate a TOTP value for the current time step
- */
-export declare function generateTotp(secret: Buffer, timeStep?: number): string;
-/**
- * Verify a TOTP token with a configurable time window
- *
- * @param secret - The shared secret as a Buffer
- * @param token - The 6-digit TOTP code to verify
- * @param window - Number of time steps to check on each side (default: 1)
- * @returns true if the token is valid within the window
- */
-export declare function verifyTotp(secret: Buffer, token: string, window?: number): boolean;
-/**
- * Generate a new TOTP secret and return the setup information
- *
- * @param issuer - The issuer name (app name) for the QR code
- * @param accountName - The account identifier (usually email)
- * @returns Object with base32 secret and otpauth URI
- */
-export declare function generateTotpSecret(issuer: string, accountName: string): {
-    secret: string;
-    uri: string;
-};
-/**
- * Generate a set of one-time recovery codes
- *
- * @param count - Number of recovery codes to generate (default: 10)
- * @returns Array of formatted recovery code strings (e.g. "A1B2C-D3E4F")
- */
-export declare function generateRecoveryCodes(count?: number): string[];
-/**
- * Hash a recovery code for storage
- */
-export declare function hashRecoveryCode(code: string): string;

package/dist/auth/microsoft-oauth.d.ts

@@ -1,16 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
- *
- * Supports both personal Microsoft accounts and work/school (Azure AD) accounts
- * via the "common" tenant endpoint. Uses the authorization code flow.
- */
-export declare function createMicrosoftProvider(config: {
-    clientId: string;
-    clientSecret: string;
-    /** Tenant ID. Defaults to "common" which allows both personal and organizational accounts. */
-    tenantId?: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/middleware.d.ts

@@ -1,106 +0,0 @@
-import { MiddlewareHandler, Context } from "hono";
-import { DataDriver } from "@rebasepro/types";
-import { AccessTokenPayload } from "./jwt";
-import { HonoEnv } from "../api/types";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
-/**
- * Result from a custom auth validator.
- * - `false`/`null`/`undefined` = not authenticated
- * - `true` = authenticated as default user
- * - object with `userId` or `uid` = authenticated with user info
- */
-export type AuthResult = boolean | null | undefined | {
-    userId?: string;
-    uid?: string;
-    roles?: string[];
-    [key: string]: unknown;
-};
-/**
- * Options for creating an auth middleware via createAuthMiddleware()
- */
-export interface AuthMiddlewareOptions {
-    /** DataDriver to scope via withAuth() for RLS */
-    driver: DataDriver;
-    /**
-     * If true, return 401 when no valid token is present.
-     *
-     * **Defaults to `true` (secure by default).** Set to `false` only for
-     * intentionally public endpoints where access control is fully delegated
-     * to Postgres Row-Level Security policies.
-     */
-    requireAuth?: boolean;
-    /** Optional custom validator (for non-JWT auth, e.g. Firebase Auth) */
-    validator?: (c: Context<HonoEnv>) => Promise<AuthResult>;
-    /**
-     * A static secret key for server-to-server / script authentication.
-     *
-     * When a request sends `Authorization: Bearer <key>` and the key matches
-     * this value, the request is granted admin-level access (uid: `service`,
-     * roles: `["admin"]`) **without** JWT verification. The driver is scoped
-     * via `withAuth()` with the service identity.
-     *
-     * This is the Rebase equivalent of a Firebase Service Account key.
-     * Set via `REBASE_SERVICE_KEY` in `.env` and pass through the backend config.
-     *
-     * **Security:** The comparison uses constant-time equality to prevent
-     * timing attacks. The key must be at least 32 characters.
-     */
-    serviceKey?: string;
-    /**
-     * API key store for authenticating `rk_` prefixed tokens.
-     * When set, tokens starting with `rk_` are validated against the
-     * database instead of being treated as JWTs.
-     */
-    apiKeyStore?: ApiKeyStore;
-}
-/**
- * Hono middleware that requires a valid JWT token
- * Returns 401 if token is missing or invalid
- */
-export declare const requireAuth: MiddlewareHandler<HonoEnv>;
-/**
- * Factory that creates a requireAuth middleware with optional service key support.
- *
- * When `serviceKey` is provided, the middleware will check if the Bearer token
- * matches the service key using constant-time comparison. If it matches, the
- * request is authenticated as a service user with admin privileges.
- *
- * This allows admin routes (which use standalone requireAuth + requireAdmin)
- * to be accessed via service keys for scripts and server-to-server calls.
- */
-export declare function createRequireAuth(options?: {
-    serviceKey?: string;
-}): MiddlewareHandler<HonoEnv>;
-/**
- * Middleware that requires the user to have an admin or schema-admin role.
- * Must be used AFTER requireAuth or on a route where user is guaranteed.
- */
-export declare const requireAdmin: MiddlewareHandler<HonoEnv>;
-/**
- * Middleware that optionally extracts user from JWT
- * Does not return 401 if token is missing - allows anonymous access
- */
-export declare const optionalAuth: MiddlewareHandler<HonoEnv>;
-/**
- * Extract user from token - for WebSocket authentication
- */
-export declare function extractUserFromToken(token: string): AccessTokenPayload | null;
-/**
- * Create a configurable auth middleware that handles:
- * 1. Token extraction (via custom validator or JWT Bearer token)
- * 2. RLS-scoped DataDriver via withAuth()
- * 3. Enforcement (401 when requireAuth is true and no user)
- *
- * **Secure by default:** `requireAuth` defaults to `true`. Anonymous
- * access is only allowed when the developer explicitly opts out by
- * setting `requireAuth: false`, indicating that Postgres RLS policies
- * fully control access.
- *
- * **Fail-closed:** The raw unscoped driver is never placed in the
- * request context. Every code path either scopes via `withAuth()` or
- * rejects the request. This prevents silent RLS bypass.
- *
- * This is the single source of truth for HTTP auth in Rebase.
- * Use this instead of manually parsing tokens in route handlers.
- */
-export declare function createAuthMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler<HonoEnv>;

package/dist/auth/password.d.ts

@@ -1,22 +0,0 @@
-export interface PasswordValidationResult {
-    valid: boolean;
-    errors: string[];
-}
-/**
- * Password requirements:
- * - Minimum 8 characters
- * - At least 1 uppercase letter
- * - At least 1 lowercase letter
- * - At least 1 number
- */
-export declare function validatePasswordStrength(password: string): PasswordValidationResult;
-/**
- * Hash a password using Node's built-in scrypt
- * Returns format: salt:hash (both hex encoded)
- */
-export declare function hashPassword(password: string): Promise<string>;
-/**
- * Verify a password against a scrypt hash
- * Expects format: salt:hash (both hex encoded)
- */
-export declare function verifyPassword(password: string, storedHash: string): Promise<boolean>;