@rebasepro/server-core 0.7.0 → 0.9.0

package/src/api/types.ts

@@ -1,104 +0,0 @@
-import { EntityCollection, VectorSearchParams, LogicalCondition } from "@rebasepro/types";
-import { AuthResult } from "../auth/middleware";
-import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { DataDriver } from "@rebasepro/types";
-import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
-
-/**
- * Hono Environment Variables
- * Passed to generic Hono<HonoEnv> to type `c.get()`
- */
-export type HonoEnv = {
-    Variables: {
-        user?: AuthResult | { userId?: string, roles?: string[] };
-        driver?: DataDriver;
-        /** Set when the request is authenticated via a Service API Key. */
-        apiKey?: ApiKeyMasked;
-        /** Unique request correlation ID (generated or propagated from X-Request-ID header). */
-        requestId?: string;
-    }
-};
-
-/**
- * Configuration for API generation
- */
-/**
- * Configuration for API generation
- */
-export interface ApiConfig {
-    collections?: EntityCollection[];
-    collectionsDir?: string;
-    /**
-     * Declared data sources. When provided, collections on a `direct`/`custom`
-     * transport are treated as client-only and no server routes are generated
-     * for them.
-     */
-    dataSources?: import("@rebasepro/types").DataSourceDefinition[];
-    basePath?: string;
-    enableGraphQL?: boolean;
-    enableREST?: boolean;
-    cors?: {
-        origin?: string | string[] | boolean;
-        credentials?: boolean;
-    };
-    /** Whether auth is required for API endpoints (default: true) */
-    requireAuth?: boolean;
-    /** Optional custom validator for authentication */
-    authValidator?: (c: import("hono").Context<import("./types").HonoEnv>) => Promise<AuthResult>;
-    pagination?: {
-        defaultLimit: number;
-        maxLimit: number;
-    };
-}
-
-/**
- * Context passed to resolvers and handlers
- */
-export interface ApiContext {
-    user?: AuthResult;
-    collections: Map<string, EntityCollection>;
-    db: NodePgDatabase; // Drizzle DB instance
-}
-
-/**
- * Standard API response format
- */
-export interface ApiResponse<T = unknown> {
-    data?: T;
-    error?: {
-        message: string;
-        code?: string;
-        details?: unknown;
-    };
-    meta?: {
-        total?: number;
-        page?: number;
-        limit?: number;
-        hasMore?: boolean;
-    };
-}
-
-/**
- * Query options for API endpoints
- */
-export interface QueryOptions {
-    limit?: number;
-    offset?: number;
-    where?: Record<string, unknown>;
-    logical?: LogicalCondition;
-    orderBy?: Array<{ field: string; direction: "asc" | "desc" }>;
-    include?: string[];
-    /** Columns to return in the response (field-level selection) */
-    fields?: string[];
-    /** Vector similarity search configuration */
-    vectorSearch?: VectorSearchParams;
-}
-
-/**
- * Relation resolution configuration
- */
-export interface RelationConfig {
-    relationName: string;
-    depth?: number;
-    include?: string[];
-}

package/src/auth/adapter-middleware.ts

@@ -1,114 +0,0 @@
-/**
- * Adapter Auth Middleware
- *
- * Creates a Hono middleware that delegates authentication to an `AuthAdapter`
- * instead of hardcoded JWT verification. This is used when the user passes
- * an `AuthAdapter` to `initializeRebaseBackend()`.
- *
- * The middleware:
- * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
- * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
- * 3. Scopes the DataDriver via `withAuth()` for RLS
- * 4. Enforces auth (401) when `requireAuth` is true and no user is found
- *
- * The behavior is identical to `createAuthMiddleware()` — only the
- * token verification strategy is pluggable.
- */
-
-import type { MiddlewareHandler, Context } from "hono";
-import type { DataDriver, AuthAdapter } from "@rebasepro/types";
-import type { HonoEnv } from "../api/types";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
-import { scopeDataDriver } from "./rls-scope";
-import { validateApiKey } from "./api-keys/api-key-middleware";
-import { logger } from "../utils/logger";
-
-export interface AdapterAuthMiddlewareOptions {
-    /** The auth adapter to delegate verification to. */
-    adapter: AuthAdapter;
-    /** The DataDriver to scope via withAuth() for RLS. */
-    driver: DataDriver;
-    /**
-     * Optional per-request driver resolver for multi-data-source backends.
-     * Returns the unscoped delegate to use for this request (e.g. Postgres vs
-     * Mongo). When omitted, `driver` is used for every request.
-     */
-    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
-    /**
-     * If true, return 401 when no valid user is resolved.
-     * Defaults to `true` (secure by default).
-     */
-    requireAuth?: boolean;
-    /** Optional API key store — when provided, `rk_` bearer tokens are accepted. */
-    apiKeyStore?: ApiKeyStore;
-}
-
-/**
- * Create a Hono middleware that uses an `AuthAdapter` for request verification.
- */
-export function createAdapterAuthMiddleware(options: AdapterAuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { adapter, driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, apiKeyStore } = options;
-
-    return async (c, next) => {
-        // Pick the per-request delegate (multi-data-source) before scoping.
-        const driver = resolveDriver ? resolveDriver(c) : baseDriver;
-        // ── API Key check (Rebase-level, independent of auth adapter) ────
-        if (apiKeyStore) {
-            const authHeader = c.req.header("authorization") || "";
-            const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
-            if (token.startsWith("rk_")) {
-                const result = await validateApiKey(c, token, { store: apiKeyStore,
-driver });
-                if (result === true) return next();
-                return result;
-            }
-        }
-
-        let authenticatedUser = null;
-
-        try {
-            authenticatedUser = await adapter.verifyRequest(c.req.raw);
-        } catch (error) {
-            // adapter.verifyRequest() threw — reject the request (fail closed)
-            return c.json({ error: { message: "Unauthorized",
-code: "UNAUTHORIZED" } }, 401);
-        }
-
-        if (authenticatedUser) {
-            // Authenticated — set user context and scope driver
-            c.set("user", {
-                userId: authenticatedUser.uid,
-                email: authenticatedUser.email,
-                roles: authenticatedUser.roles
-            });
-            try {
-                c.set("driver", await scopeDataDriver(driver, {
-                    uid: authenticatedUser.uid,
-                    roles: authenticatedUser.roles
-                }));
-            } catch (error) {
-                logger.error("[AUTH-ADAPTER] RLS scoping failed for authenticated user", { error: error });
-                return c.json({ error: { message: "Internal authentication error",
-code: "INTERNAL_ERROR" } }, 500);
-            }
-        } else {
-            // Not authenticated — scope as anon for RLS evaluation
-            try {
-                c.set("driver", await scopeDataDriver(driver, { uid: "anon",
-roles: ["anon"] }));
-            } catch (error) {
-                logger.error("[AUTH-ADAPTER] Failed to create anon-scoped driver", { error: error });
-                return c.json({ error: { message: "Server configuration error",
-code: "INTERNAL_ERROR" } }, 500);
-            }
-        }
-
-        // Enforce auth if required
-        if (enforceAuth && !c.get("user")) {
-            return c.json({ error: { message: "Unauthorized: Authentication required",
-code: "UNAUTHORIZED" } }, 401);
-        }
-
-        return next();
-    };
-}

package/src/auth/admin-roles-route.ts

@@ -1,36 +0,0 @@
-/**
- * Admin endpoint for listing all roles.
- *
- * Mounts: GET /roles
- */
-
-import { Hono } from "hono";
-import { errorHandler } from "../api/errors";
-import type { AuthRepository } from "./interfaces";
-import { createRequireAuth, requireAdmin } from "./middleware";
-import type { HonoEnv } from "../api/types";
-
-export interface AdminRolesRouteConfig {
-    authRepo: AuthRepository;
-    serviceKey?: string;
-}
-
-/**
- * Create a standalone admin route for listing roles.
- *
- * Mounts: GET /roles
- */
-export function createAdminRolesRoute(config: AdminRolesRouteConfig): Hono<HonoEnv> {
-    const router = new Hono<HonoEnv>();
-    const authRepo = config.authRepo;
-
-    router.onError(errorHandler);
-    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
-
-    router.get("/roles", requireAdmin, async (c) => {
-        const roles = await authRepo.listRoles();
-        return c.json({ roles });
-    });
-
-    return router;
-}

package/src/auth/admin-user-ops.ts

@@ -1,236 +0,0 @@
-/**
- * Admin User Operations
- *
- * Shared utilities and orchestration for admin-initiated user management
- * (user creation via REST API, password reset via admin panel).
- *
- * Hook resolution order:
- * 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
- * 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
- * 3. Built-in default — framework fallback
- */
-
-import { randomBytes, createHash, randomInt } from "node:crypto";
-import type { AuthRepository } from "./interfaces";
-import type { EmailService, EmailConfig } from "../email";
-import type { ResolvedAuthHooks } from "./auth-hooks";
-import type { AuthCollectionConfig, AuthCollectionContext } from "@rebasepro/types";
-import { getPasswordResetTemplate } from "../email/templates";
-import { logger } from "../utils/logger";
-
-// ─── Shared Crypto Utilities ────────────────────────────────────────────────
-
-/**
- * Generate a cryptographically secure random password that meets strength requirements.
- *
- * 16 characters, guaranteed at least one uppercase, one lowercase, one digit.
- * Ambiguous characters (0, O, 1, l, I) are excluded.
- */
-export function generateSecurePassword(): string {
-    const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
-    const lower = "abcdefghjkmnpqrstuvwxyz";
-    const digits = "23456789";
-    const all = upper + lower + digits;
-
-    const pick = (chars: string) => chars[randomInt(chars.length)];
-    const parts = [pick(upper), pick(lower), pick(digits)];
-
-    for (let i = parts.length; i < 16; i++) {
-        parts.push(pick(all));
-    }
-
-    // Shuffle
-    for (let i = parts.length - 1; i > 0; i--) {
-        const j = randomInt(i + 1);
-        [parts[i], parts[j]] = [parts[j], parts[i]];
-    }
-    return parts.join("");
-}
-
-/**
- * Generate a cryptographically secure random token (80 hex characters).
- */
-export function generateSecureToken(): string {
-    return randomBytes(40).toString("hex");
-}
-
-/**
- * Hash a token for database storage using SHA-256.
- */
-export function hashToken(token: string): string {
-    return createHash("sha256").update(token).digest("hex");
-}
-
-// ─── Admin User Creation ────────────────────────────────────────────────────
-
-/**
- * Context needed by admin user creation / password reset operations.
- */
-export interface AdminUserContext {
-    authRepo: AuthRepository;
-    emailService?: EmailService;
-    emailConfig?: EmailConfig;
-    resolvedHooks: ResolvedAuthHooks;
-    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
-    collectionAuthConfig?: AuthCollectionConfig;
-}
-
-/**
- * Result of preparing user values for admin-initiated creation.
- */
-export interface AdminUserPrepareResult {
-    /** Values ready for `driver.saveEntity()`. */
-    values: Record<string, unknown>;
-    /** The cleartext password (for returning to admin or sending via email). */
-    clearPassword?: string;
-    /** Whether the hook already handled the invitation email. */
-    hookHandledEmail: boolean;
-    /** Whether an invitation was sent (only relevant when hookHandledEmail is true). */
-    invitationSent: boolean;
-}
-
-/**
- * Build the `AuthCollectionContext` facade from server internals.
- *
- * This is the simplified context exposed to collection-level auth hooks,
- * keeping them decoupled from internal interfaces like `AuthRepository`.
- */
-function buildCollectionContext(ctx: AdminUserContext): AuthCollectionContext {
-    const isEmailConfigured = !!(ctx.emailService && ctx.emailService.isConfigured());
-
-    return {
-        hashPassword: (password: string) => ctx.resolvedHooks.hashPassword(password),
-        sendEmail: isEmailConfigured
-            ? (options) => ctx.emailService!.send(options)
-            : undefined,
-        emailConfigured: isEmailConfigured,
-        appName: ctx.emailConfig?.appName || "Rebase",
-        resetPasswordUrl: ctx.emailConfig?.resetPasswordUrl || ""
-    };
-}
-
-/**
- * Prepare user values for an admin-initiated user creation.
- *
- * Resolution order:
- * 1. Collection-level `auth.onCreateUser` — closest to the data
- * 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
- * 3. Built-in default — generate password → hash → normalize email
- *
- * The caller is responsible for persisting (via `driver.saveEntity()`).
- */
-export async function prepareAdminUserValues(
-    body: Record<string, unknown>,
-    ctx: AdminUserContext
-): Promise<AdminUserPrepareResult> {
-    const { resolvedHooks, collectionAuthConfig } = ctx;
-
-    // 1. Collection-level hook (closest to the data)
-    if (collectionAuthConfig?.onCreateUser) {
-        const collectionCtx = buildCollectionContext(ctx);
-        const hookResult = await collectionAuthConfig.onCreateUser(body, collectionCtx);
-        return {
-            values: hookResult.values,
-            clearPassword: hookResult.temporaryPassword,
-            hookHandledEmail: true,
-            invitationSent: hookResult.invitationSent ?? false
-        };
-    }
-
-    // 2. Backend-level hook (global override)
-    if (resolvedHooks.onAdminCreateUser) {
-        const hookResult = await resolvedHooks.onAdminCreateUser(body, {
-            authRepo: ctx.authRepo,
-            emailService: ctx.emailService,
-            emailConfig: ctx.emailConfig,
-            hashPassword: (password: string) => resolvedHooks.hashPassword(password)
-        });
-        return {
-            values: hookResult.values,
-            clearPassword: hookResult.temporaryPassword,
-            hookHandledEmail: true,
-            invitationSent: hookResult.invitationSent ?? false
-        };
-    }
-
-    // 3. Built-in default
-    const password = body.password as string | undefined;
-    const clearPassword = password || generateSecurePassword();
-    const passwordHash = await resolvedHooks.hashPassword(clearPassword);
-
-    const values = { ...body };
-    values.passwordHash = passwordHash;
-    if (values.email) {
-        values.email = (values.email as string).toLowerCase();
-    }
-    values.emailVerified = true;
-    delete values.password;
-
-    return {
-        values,
-        clearPassword: password ? undefined : clearPassword,
-        hookHandledEmail: false,
-        invitationSent: false
-    };
-}
-
-/**
- * Handle post-creation work for admin-created users.
- *
- * Sends an invitation email (password-reset link) if email is configured
- * and no explicit password was provided. Falls back to returning the
- * temporary password if email fails or is not configured.
- */
-export async function finalizeAdminUserCreation(
-    entity: { id: string; values: Record<string, unknown> },
-    clearPassword: string | undefined,
-    ctx: AdminUserContext
-): Promise<{
-    temporaryPassword?: string;
-    invitationSent: boolean;
-}> {
-    // If an explicit password was provided (clearPassword is undefined), nothing to do
-    if (!clearPassword) {
-        return { invitationSent: false };
-    }
-
-    const isEmailConfigured = !!(ctx.emailService && ctx.emailService.isConfigured());
-
-    if (isEmailConfigured) {
-        try {
-            const token = generateSecureToken();
-            const tokenHash = hashToken(token);
-            const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours
-
-            await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
-
-            const baseUrl = ctx.emailConfig?.resetPasswordUrl || "";
-            const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
-
-            const appName = ctx.emailConfig?.appName || "Rebase";
-            const templateFn = ctx.emailConfig?.templates?.passwordReset;
-            const emailContent = templateFn
-                ? templateFn(setPasswordUrl, { email: entity.values.email as string,
-displayName: entity.values.displayName as string })
-                : getPasswordResetTemplate(setPasswordUrl, { email: entity.values.email as string,
-displayName: entity.values.displayName as string }, appName);
-
-            await ctx.emailService!.send({
-                to: entity.values.email as string,
-                subject: emailContent.subject,
-                html: emailContent.html,
-                text: emailContent.text
-            });
-            return { invitationSent: true };
-        } catch (emailError: unknown) {
-            logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
-            // Fall back to returning the temporary password
-            return { temporaryPassword: clearPassword,
-invitationSent: false };
-        }
-    }
-
-    // No email service — return the temporary password
-    return { temporaryPassword: clearPassword,
-invitationSent: false };
-}