@rebasepro/server-core 0.6.1 → 0.8.0

package/src/api/rest/api-generator.ts

@@ -1,11 +1,11 @@
 import { Hono } from "hono";
-import { AuthAdapter, DataDriver, Entity, EntityCollection, FetchCollectionProps, DataHooks, BackendHookContext, RestFetchService } from "@rebasepro/types";
+import { AuthAdapter, DataDriver, Entity, EntityCollection, RestFetchService, getCollectionDataPath } from "@rebasepro/types";
 import { QueryOptions, HonoEnv } from "../types";
 import { ApiError, isRebaseApiError } from "../errors";
 import { parseQueryOptions } from "./query-parser";
 import { httpMethodToOperation, isOperationAllowed } from "../../auth/api-keys/api-key-permission-guard";
 import type { ApiKeyMasked } from "../../auth/api-keys/api-key-types";
-import { logger } from "../../utils/logger";
+
 
 
 /**
@@ -16,31 +16,21 @@ export class RestApiGenerator {
     private collections: EntityCollection[];
     private router: Hono<HonoEnv>;
     private driver: DataDriver;
-    private dataHooks?: DataHooks;
+
     private authAdapter?: AuthAdapter;
 
     constructor(
         collections: EntityCollection[],
         driver: DataDriver,
-        dataHooks?: DataHooks,
         authAdapter?: AuthAdapter
     ) {
         this.collections = collections;
         this.driver = driver;
-        this.dataHooks = dataHooks;
         this.authAdapter = authAdapter;
         this.router = new Hono<HonoEnv>();
     }
 
-    /** Build a BackendHookContext from a Hono context */
-    private buildHookContext(c: { get: (key: string) => unknown }, method: BackendHookContext["method"]): BackendHookContext {
-        const user = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        return {
-            requestUser: user ? { userId: user.userId,
-roles: user.roles ?? [] } : undefined,
-            method
-        };
-    }
+
 
     /**
      * Generate REST routes using existing DataDriver
@@ -124,7 +114,7 @@ roles: user.roles ?? [] } : undefined,
 
             const driver = this.getScopedDriver(c);
             const fetchService = this.getFetchService(driver);
-            const hookCtx = this.buildHookContext(c, "GET");
+
 
             // Use include-aware path when available
             if (fetchService) {
@@ -132,7 +122,7 @@ roles: user.roles ?? [] } : undefined,
                 let entities = await fetchService.fetchCollectionForRest(
                     collectionPath,
                     {
-                        filter: queryOptions.where as FetchCollectionProps["filter"],
+                        filter: queryOptions.where,
                         limit: queryOptions.limit,
                         offset: queryOptions.offset,
                         orderBy: queryOptions.orderBy?.[0]?.field,
@@ -143,7 +133,7 @@ roles: user.roles ?? [] } : undefined,
                     queryOptions.include
                 );
 
-                entities = await this.applyAfterReadBatch(collection.slug, entities, hookCtx);
+
 
                 const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 
@@ -161,7 +151,7 @@ roles: user.roles ?? [] } : undefined,
             // Fallback path
             let entities = await this.fetchRawCollection(driver, resolvedCollection, queryOptions, searchString);
 
-            entities = await this.applyAfterReadBatch(collection.slug, entities, hookCtx);
+
 
             const total = await this.countRawEntities(driver, resolvedCollection, queryOptions, searchString);
 
@@ -184,7 +174,7 @@ roles: user.roles ?? [] } : undefined,
             const queryOptions = parseQueryOptions(queryDict);
             const driver = this.getScopedDriver(c);
             const fetchService = this.getFetchService(driver);
-            const hookCtx = this.buildHookContext(c, "GET");
+
 
             // Use include-aware path when available
             if (fetchService) {
@@ -199,10 +189,7 @@ roles: user.roles ?? [] } : undefined,
                     throw ApiError.notFound("Entity not found");
                 }
 
-                entity = await this.applyAfterRead(collection.slug, entity, hookCtx);
-                if (!entity) {
-                    throw ApiError.notFound("Entity not found");
-                }
+
 
                 return c.json(entity);
             }
@@ -214,10 +201,7 @@ roles: user.roles ?? [] } : undefined,
                 throw ApiError.notFound("Entity not found");
             }
 
-            entity = await this.applyAfterRead(collection.slug, entity, hookCtx);
-            if (!entity) {
-                throw ApiError.notFound("Entity not found");
-            }
+
 
             return c.json(entity);
         });
@@ -228,13 +212,11 @@ roles: user.roles ?? [] } : undefined,
                 this.enforceApiKeyPermission(c, collection.slug);
                 const driver = this.getScopedDriver(c);
                 const path = collection.slug;
-                const hookCtx = this.buildHookContext(c, "POST");
+
 
                 let body = await c.req.json().catch(() => ({}));
 
-                if (this.dataHooks?.beforeSave) {
-                    body = await this.dataHooks.beforeSave(path, body, undefined, hookCtx);
-                }
+
 
                 const isAuth = collection.auth;
                 const isAuthCollection = isAuth === true || (isAuth && typeof isAuth === "object" && isAuth.enabled === true);
@@ -263,11 +245,7 @@ values: entity.values as Record<string, unknown> },
 
                     const response = this.formatResponse(entity) as Record<string, unknown>;
 
-                    if (this.dataHooks?.afterSave) {
-                        Promise.resolve(this.dataHooks.afterSave(path, response, hookCtx)).catch(err => {
-                            logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
-                        });
-                    }
+
 
                     return c.json({
                         ...response,
@@ -285,11 +263,7 @@ values: entity.values as Record<string, unknown> },
 
                 const response = this.formatResponse(entity);
 
-                if (this.dataHooks?.afterSave) {
-                    Promise.resolve(this.dataHooks.afterSave(path, response as Record<string, unknown>, hookCtx)).catch(err => {
-                        logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
-                    });
-                }
+
 
                 return c.json(response, 201);
             } catch (error) {
@@ -315,10 +289,10 @@ values: entity.values as Record<string, unknown> },
                 this.enforceApiKeyPermission(c, collection.slug);
                 const id = c.req.param("id");
                 const driver = this.getScopedDriver(c);
-                const hookCtx = this.buildHookContext(c, "PUT");
+
 
                 const existingEntity = await driver.fetchEntity({
-                    path: collection.slug,
+                    path: getCollectionDataPath(collection),
                     entityId: String(id),
                     collection: resolvedCollection
                 });
@@ -329,12 +303,10 @@ values: entity.values as Record<string, unknown> },
 
                 let body = await c.req.json().catch(() => ({}));
 
-                if (this.dataHooks?.beforeSave) {
-                    body = await this.dataHooks.beforeSave(collection.slug, body, String(id), hookCtx);
-                }
+
 
                 const entity = await driver.saveEntity({
-                    path: collection.slug,
+                    path: getCollectionDataPath(collection),
                     entityId: String(id),
                     values: body,
                     collection: resolvedCollection,
@@ -343,11 +315,7 @@ values: entity.values as Record<string, unknown> },
 
                 const response = this.formatResponse(entity);
 
-                if (this.dataHooks?.afterSave) {
-                    Promise.resolve(this.dataHooks.afterSave(collection.slug, response as Record<string, unknown>, hookCtx)).catch(err => {
-                        logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
-                    });
-                }
+
 
                 return c.json(response);
             } catch (error) {
@@ -371,10 +339,10 @@ values: entity.values as Record<string, unknown> },
             this.enforceApiKeyPermission(c, collection.slug);
             const id = c.req.param("id");
             const driver = this.getScopedDriver(c);
-            const hookCtx = this.buildHookContext(c, "DELETE");
+
 
             const existingEntity = await driver.fetchEntity({
-                path: collection.slug,
+                path: getCollectionDataPath(collection),
                 entityId: String(id),
                 collection: resolvedCollection
             });
@@ -383,20 +351,14 @@ values: entity.values as Record<string, unknown> },
                 throw ApiError.notFound("Entity not found");
             }
 
-            if (this.dataHooks?.beforeDelete) {
-                await this.dataHooks.beforeDelete(collection.slug, String(id), hookCtx);
-            }
+
 
             await driver.deleteEntity({
                 entity: existingEntity,
                 collection: resolvedCollection
             });
 
-            if (this.dataHooks?.afterDelete) {
-                Promise.resolve(this.dataHooks.afterDelete(collection.slug, String(id), hookCtx)).catch(err => {
-                    logger.error("[BackendHooks] data.afterDelete error", { error: err instanceof Error ? err.message : err });
-                });
-            }
+
 
             return new Response(null, { status: 204 });
         });
@@ -464,7 +426,7 @@ entityId };
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
 
-            const hookCtx = this.buildHookContext(c, "GET");
+
 
             if (parsed.entityId === "count") {
                 // GET /parent/:parentId/child/count — count child entities
@@ -474,7 +436,7 @@ entityId };
 
                 const total = driver.countEntities ? await driver.countEntities({
                     path: parsed.collectionPath,
-                    filter: queryOptions.where as FetchCollectionProps["filter"],
+                    filter: queryOptions.where,
                     searchString
                 }) : 0;
 
@@ -487,11 +449,7 @@ entityId };
                 });
                 if (!entity) throw ApiError.notFound("Entity not found");
 
-                const flatResult = this.flattenEntity(entity);
-                const hookResult = await this.applyAfterRead(c.req.param("parent"), flatResult, hookCtx);
-                if (!hookResult) throw ApiError.notFound("Entity not found");
-
-                return c.json(hookResult);
+                return c.json(this.flattenEntity(entity));
             } else {
                 // GET /parent/:parentId/child — list entities
                 const queryDict = c.req.queries();
@@ -499,19 +457,18 @@ entityId };
                 const searchString = Array.isArray(queryDict.searchString) ? queryDict.searchString[queryDict.searchString.length - 1] : undefined;
                 const entities = await driver.fetchCollection({
                     path: parsed.collectionPath,
-                    filter: queryOptions.where as FetchCollectionProps["filter"],
+                    filter: queryOptions.where,
                     limit: queryOptions.limit,
                     orderBy: queryOptions.orderBy?.[0]?.field,
                     order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
                     searchString
                 });
 
-                let flatEntities = entities.map(e => this.flattenEntity(e));
-                flatEntities = await this.applyAfterReadBatch(c.req.param("parent"), flatEntities, hookCtx);
+                const flatEntities = entities.map(e => this.flattenEntity(e));
 
                 const total = driver.countEntities ? await driver.countEntities({
                     path: parsed.collectionPath,
-                    filter: queryOptions.where as FetchCollectionProps["filter"],
+                    filter: queryOptions.where,
                     searchString
                 }) : flatEntities.length;
 
@@ -536,14 +493,12 @@ entityId };
             if (!parsed || parsed.entityId) return next();
 
             const driver = this.getScopedDriver(c);
-            const hookCtx = this.buildHookContext(c, "POST");
+
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
             let body = await c.req.json().catch(() => ({}));
 
-            if (this.dataHooks?.beforeSave) {
-                body = await this.dataHooks.beforeSave(parsed.collectionPath, body, undefined, hookCtx);
-            }
+
 
             const entity = await driver.saveEntity({
                 path: parsed.collectionPath,
@@ -553,11 +508,7 @@ entityId };
 
             const response = this.formatResponse(entity);
 
-            if (this.dataHooks?.afterSave) {
-                Promise.resolve(this.dataHooks.afterSave(parsed.collectionPath, response as Record<string, unknown>, hookCtx)).catch(err => {
-                    logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
-                });
-            }
+
 
             return c.json(response, 201);
         });
@@ -571,15 +522,13 @@ entityId };
             if (!parsed || !parsed.entityId) return next();
 
             const driver = this.getScopedDriver(c);
-            const hookCtx = this.buildHookContext(c, "PUT");
+
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
 
             let body = await c.req.json().catch(() => ({}));
 
-            if (this.dataHooks?.beforeSave) {
-                body = await this.dataHooks.beforeSave(parsed.collectionPath, body, parsed.entityId, hookCtx);
-            }
+
 
             const entity = await driver.saveEntity({
                 path: parsed.collectionPath,
@@ -590,11 +539,7 @@ entityId };
 
             const response = this.formatResponse(entity);
 
-            if (this.dataHooks?.afterSave) {
-                Promise.resolve(this.dataHooks.afterSave(parsed.collectionPath, response as Record<string, unknown>, hookCtx)).catch(err => {
-                    logger.error("[BackendHooks] data.afterSave error", { error: err instanceof Error ? err.message : err });
-                });
-            }
+
 
             return c.json(response);
         });
@@ -608,7 +553,7 @@ entityId };
             if (!parsed || !parsed.entityId) return next();
 
             const driver = this.getScopedDriver(c);
-            const hookCtx = this.buildHookContext(c, "DELETE");
+
 
             this.enforceApiKeyPermission(c, c.req.param("parent"));
 
@@ -619,17 +564,11 @@ entityId };
 
             if (!existingEntity) throw ApiError.notFound("Entity not found");
 
-            if (this.dataHooks?.beforeDelete) {
-                await this.dataHooks.beforeDelete(parsed.collectionPath, parsed.entityId, hookCtx);
-            }
+
 
             await driver.deleteEntity({ entity: existingEntity });
 
-            if (this.dataHooks?.afterDelete) {
-                Promise.resolve(this.dataHooks.afterDelete(parsed.collectionPath, parsed.entityId, hookCtx)).catch(err => {
-                    logger.error("[BackendHooks] data.afterDelete error", { error: err instanceof Error ? err.message : err });
-                });
-            }
+
 
             return new Response(null, { status: 204 });
         });
@@ -686,9 +625,9 @@ entityId };
      */
     private async fetchRawCollection(driver: DataDriver, collection: EntityCollection, queryOptions: QueryOptions, searchString?: string) {
         const entities = await driver.fetchCollection({
-            path: collection.slug,
+            path: getCollectionDataPath(collection),
             collection,
-            filter: queryOptions.where as FetchCollectionProps["filter"],
+            filter: queryOptions.where,
             limit: queryOptions.limit,
             orderBy: queryOptions.orderBy?.[0]?.field,
             order: queryOptions.orderBy?.[0]?.direction === "desc" ? "desc" : "asc",
@@ -705,9 +644,9 @@ entityId };
      */
     private async countRawEntities(driver: DataDriver, collection: EntityCollection, queryOptions: QueryOptions, searchString?: string): Promise<number> {
         return driver.countEntities ? await driver.countEntities({
-            path: collection.slug,
+            path: getCollectionDataPath(collection),
             collection,
-            filter: queryOptions.where as FetchCollectionProps["filter"],
+            filter: queryOptions.where,
             searchString
         }) : 0;
     }
@@ -717,7 +656,7 @@ entityId };
      */
     private async fetchRawEntity(driver: DataDriver, collection: EntityCollection, entityId: string) {
         const entity = await driver.fetchEntity({
-            path: collection.slug,
+            path: getCollectionDataPath(collection),
             entityId,
             collection
         });
@@ -725,23 +664,5 @@ entityId };
         return entity ? this.flattenEntity(entity) : null;
     }
 
-    /**
-     * Apply data.afterRead hook to a single entity.
-     * Returns the transformed entity, or null to filter it out.
-     */
-    private async applyAfterRead(slug: string, entity: Record<string, unknown>, ctx: BackendHookContext): Promise<Record<string, unknown> | null> {
-        if (!this.dataHooks?.afterRead) return entity;
-        return this.dataHooks.afterRead(slug, entity, ctx);
-    }
 
-    /**
-     * Apply data.afterRead hook to an array of entities, filtering out nulls.
-     */
-    private async applyAfterReadBatch(slug: string, entities: Record<string, unknown>[], ctx: BackendHookContext): Promise<Record<string, unknown>[]> {
-        if (!this.dataHooks?.afterRead) return entities;
-        const results = await Promise.all(
-            entities.map(e => this.applyAfterRead(slug, e, ctx))
-        );
-        return results.filter((e): e is Record<string, unknown> => e !== null);
-    }
 }

package/src/api/rest/query-parser.ts

@@ -1,25 +1,8 @@
-import type { VectorSearchParams, LogicalCondition, FilterCondition } from "@rebasepro/types";
+import type { VectorSearchParams, LogicalCondition, FilterCondition, WhereFilterOp } from "@rebasepro/types";
+import { toCanonicalOp } from "@rebasepro/types";
+export const mapOperator = (op: string) => toCanonicalOp(op) ?? null;
 import { QueryOptions } from "../types";
 
-/**
- * Map PostgREST-style operators to Rebase WhereFilterOp
- */
-export function mapOperator(op: string): string | null {
-    switch (op) {
-        case "eq": return "==";
-        case "neq": return "!=";
-        case "gt": return ">";
-        case "gte": return ">=";
-        case "lt": return "<";
-        case "lte": return "<=";
-        case "in": return "in";
-        case "nin": return "not-in";
-        case "cs": return "array-contains";
-        case "csa": return "array-contains-any";
-        default: return null;
-    }
-}
-
 function getLastValue(val: unknown): unknown {
     if (Array.isArray(val)) {
         return val[val.length - 1];
@@ -60,7 +43,7 @@ value: true };
         valStr = rest;
     }
 
-    const rebaseOp = (mapOperator(op) || "==") as FilterCondition["operator"];
+    const rebaseOp = (toCanonicalOp(op) ?? "==") as FilterCondition["operator"];
     let parsedVal: unknown = valStr;
     if (valStr === "true") parsedVal = true;
     else if (valStr === "false") parsedVal = false;
@@ -158,7 +141,7 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
         if (reservedQueryKeys.includes(key)) continue;
 
         const rawValues = Array.isArray(rawValue) ? rawValue : [rawValue];
-        const conditions: [string, unknown][] = [];
+        const conditions: [WhereFilterOp, unknown][] = [];
 
         for (const value of rawValues) {
             if (typeof value === "string") {
@@ -166,7 +149,7 @@ export function parseQueryOptions(query: Record<string, unknown>): QueryOptions
                 if (parts.length >= 2) {
                     const op = parts[0];
                     const val = parts.slice(1).join(".");
-                    const rebaseOp = mapOperator(op);
+                    const rebaseOp = toCanonicalOp(op);
 
                     if (rebaseOp) {
                         let parsedVal: string | number | boolean | null | (string | number | boolean | null)[] = val;

package/src/api/server.ts

@@ -6,6 +6,7 @@ import { serve } from "@hono/node-server";
 import { GraphQLSchemaGenerator } from "./graphql/graphql-schema-generator";
 import { RestApiGenerator } from "./rest/api-generator";
 import { DataDriver, EntityCollection, Relation } from "@rebasepro/types";
+import { createDataSourceRegistry, resolveDataSource } from "@rebasepro/common";
 import { ApiConfig, HonoEnv } from "./types";
 import { loadCollectionsFromDirectory } from "../collections/loader";
 import { createSchemaEditorRoutes } from "./schema-editor-routes";
@@ -142,9 +143,16 @@ export class RebaseApiServer {
             return c.json({ data: collectionsMetadata });
         });
 
+        // Server data routes are only generated for server-transport
+        // collections; direct/custom sources are client-only.
+        const dataSourceRegistry = createDataSourceRegistry(this.config.dataSources);
+        const serverCollections = (this.config.collections || []).filter(
+            (collection) => resolveDataSource(collection, dataSourceRegistry).transport === "server"
+        );
+
         // GraphQL endpoint
         if (this.config.enableGraphQL) {
-            const schemaGenerator = new GraphQLSchemaGenerator(this.config.collections || [], this.driver);
+            const schemaGenerator = new GraphQLSchemaGenerator(serverCollections, this.driver);
             const schema = schemaGenerator.generateSchema();
 
             // Context is automatically passed to resolvers via contextValue containing Hono's 'c'
@@ -182,7 +190,7 @@ export class RebaseApiServer {
         }
 
         if (this.config.enableREST) {
-            const restGenerator = new RestApiGenerator(this.config.collections || [], this.driver);
+            const restGenerator = new RestApiGenerator(serverCollections, this.driver);
             const restRoutes = restGenerator.generateRoutes();
             this.router.route(basePath, restRoutes);
         }

package/src/api/types.ts

@@ -1,4 +1,4 @@
-import { EntityCollection, VectorSearchParams, LogicalCondition } from "@rebasepro/types";
+import { EntityCollection, VectorSearchParams, LogicalCondition, FilterValues } from "@rebasepro/types";
 import { AuthResult } from "../auth/middleware";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { DataDriver } from "@rebasepro/types";
@@ -28,6 +28,12 @@ export type HonoEnv = {
 export interface ApiConfig {
     collections?: EntityCollection[];
     collectionsDir?: string;
+    /**
+     * Declared data sources. When provided, collections on a `direct`/`custom`
+     * transport are treated as client-only and no server routes are generated
+     * for them.
+     */
+    dataSources?: import("@rebasepro/types").DataSourceDefinition[];
     basePath?: string;
     enableGraphQL?: boolean;
     enableREST?: boolean;
@@ -78,7 +84,7 @@ export interface ApiResponse<T = unknown> {
 export interface QueryOptions {
     limit?: number;
     offset?: number;
-    where?: Record<string, unknown>;
+    where?: FilterValues<string>;
     logical?: LogicalCondition;
     orderBy?: Array<{ field: string; direction: "asc" | "desc" }>;
     include?: string[];

package/src/auth/adapter-middleware.ts

@@ -15,7 +15,7 @@
  * token verification strategy is pluggable.
  */
 
-import type { MiddlewareHandler } from "hono";
+import type { MiddlewareHandler, Context } from "hono";
 import type { DataDriver, AuthAdapter } from "@rebasepro/types";
 import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
@@ -28,6 +28,12 @@ export interface AdapterAuthMiddlewareOptions {
     adapter: AuthAdapter;
     /** The DataDriver to scope via withAuth() for RLS. */
     driver: DataDriver;
+    /**
+     * Optional per-request driver resolver for multi-data-source backends.
+     * Returns the unscoped delegate to use for this request (e.g. Postgres vs
+     * Mongo). When omitted, `driver` is used for every request.
+     */
+    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
     /**
      * If true, return 401 when no valid user is resolved.
      * Defaults to `true` (secure by default).
@@ -41,9 +47,11 @@ export interface AdapterAuthMiddlewareOptions {
  * Create a Hono middleware that uses an `AuthAdapter` for request verification.
  */
 export function createAdapterAuthMiddleware(options: AdapterAuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { adapter, driver, requireAuth: enforceAuth = true, apiKeyStore } = options;
+    const { adapter, driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, apiKeyStore } = options;
 
     return async (c, next) => {
+        // Pick the per-request delegate (multi-data-source) before scoping.
+        const driver = resolveDriver ? resolveDriver(c) : baseDriver;
         // ── API Key check (Rebase-level, independent of auth adapter) ────
         if (apiKeyStore) {
             const authHeader = c.req.header("authorization") || "";

package/src/auth/admin-roles-route.ts

@@ -0,0 +1,36 @@
+/**
+ * Admin endpoint for listing all roles.
+ *
+ * Mounts: GET /roles
+ */
+
+import { Hono } from "hono";
+import { errorHandler } from "../api/errors";
+import type { AuthRepository } from "./interfaces";
+import { createRequireAuth, requireAdmin } from "./middleware";
+import type { HonoEnv } from "../api/types";
+
+export interface AdminRolesRouteConfig {
+    authRepo: AuthRepository;
+    serviceKey?: string;
+}
+
+/**
+ * Create a standalone admin route for listing roles.
+ *
+ * Mounts: GET /roles
+ */
+export function createAdminRolesRoute(config: AdminRolesRouteConfig): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    const authRepo = config.authRepo;
+
+    router.onError(errorHandler);
+    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
+
+    router.get("/roles", requireAdmin, async (c) => {
+        const roles = await authRepo.listRoles();
+        return c.json({ roles });
+    });
+
+    return router;
+}