@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/admin-users-route.ts

@@ -1,302 +0,0 @@
-/**
- * Standalone admin endpoint for user management.
- *
- * Mounts:
- *   GET /users
- *   GET /users/:userId
- *   POST /users
- *   PUT /users/:userId
- *   DELETE /users/:userId
- *   POST /bootstrap
- */
-
-import { Hono } from "hono";
-import { ApiError, errorHandler } from "../api/errors";
-import type { AuthRepository } from "./interfaces";
-import { createRequireAuth, requireAdmin } from "./middleware";
-import type { AuthHooks } from "./auth-hooks";
-import { resolveAuthHooks } from "./auth-hooks";
-import { prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
-import type { EmailService, EmailConfig } from "../email";
-import type { HonoEnv } from "../api/types";
-import type { AdminUser, AuthCollectionConfig } from "@rebasepro/types";
-import { logger } from "../utils/logger";
-
-export interface AdminUsersRouteConfig {
-    authRepo: AuthRepository;
-    emailService?: EmailService;
-    emailConfig?: EmailConfig;
-    serviceKey?: string;
-    authHooks?: AuthHooks;
-    collectionAuthConfig?: AuthCollectionConfig;
-    isBootstrapCompleted?: () => Promise<boolean>;
-    setBootstrapCompleted?: () => Promise<void>;
-}
-
-export function createAdminUsersRoute(config: AdminUsersRouteConfig): Hono<HonoEnv> {
-    const router = new Hono<HonoEnv>();
-    const authRepo = config.authRepo;
-    const { emailService, emailConfig, collectionAuthConfig } = config;
-    const ops = resolveAuthHooks(config.authHooks);
-
-    function toAdminUser(
-        u: {
-            id: string;
-            email: string;
-            displayName?: string | null;
-            photoUrl?: string | null;
-            createdAt?: Date | string;
-            updatedAt?: Date | string;
-        },
-        roles: string[]
-    ): AdminUser {
-        return {
-            uid: u.id,
-            email: u.email,
-            displayName: u.displayName ?? null,
-            photoURL: u.photoUrl ?? null,
-            provider: "custom",
-            roles,
-            createdAt: u.createdAt instanceof Date ? u.createdAt.toISOString() : (u.createdAt ?? new Date().toISOString()),
-            updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : (u.updatedAt ?? new Date().toISOString())
-        };
-    }
-
-    router.onError(errorHandler);
-    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
-
-    router.post("/bootstrap", async (c) => {
-        const user = c.get("user");
-        if (!user || typeof user !== "object") {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        if (config.isBootstrapCompleted) {
-            const alreadyDone = await config.isBootstrapCompleted();
-            if (alreadyDone) {
-                throw ApiError.forbidden("Bootstrap has already been completed.", "BOOTSTRAP_COMPLETED");
-            }
-        }
-
-        const users = await authRepo.listUsers();
-        let hasAdmin = false;
-
-        for (const u of users) {
-            const roles = await authRepo.getUserRoleIds(u.id);
-            if (roles.includes("admin")) {
-                hasAdmin = true;
-                break;
-            }
-        }
-
-        if (hasAdmin) {
-            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
-        }
-
-        const userId = "userId" in user ? (user as { userId: string }).userId : ("uid" in user ? (user as { uid: string }).uid : undefined);
-        if (!userId) {
-            throw ApiError.unauthorized("User ID not found in auth context");
-        }
-        const caller = await authRepo.getUserById(userId);
-        if (!caller) {
-            throw ApiError.notFound("Authenticated user does not exist in the database.", "USER_NOT_FOUND");
-        }
-        await authRepo.setUserRoles(userId, ["admin"]);
-
-        if (config.setBootstrapCompleted) {
-            await config.setBootstrapCompleted();
-        }
-
-        return c.json({
-            success: true,
-            message: "You are now an admin",
-            user: {
-                uid: userId,
-                roles: ["admin"]
-            }
-        });
-    });
-
-    router.get("/users", requireAdmin, async (c) => {
-        const limitParam = c.req.query("limit");
-        const offsetParam = c.req.query("offset");
-        const search = c.req.query("search");
-        const orderBy = c.req.query("orderBy");
-        const orderDir = c.req.query("orderDir") as "asc" | "desc" | undefined;
-
-        const limit = limitParam ? parseInt(limitParam, 10) : 25;
-        const offset = offsetParam ? parseInt(offsetParam, 10) : 0;
-
-        const result = await authRepo.listUsersPaginated({
-            limit,
-            offset,
-            search: search || undefined,
-            orderBy: orderBy || undefined,
-            orderDir: orderDir || undefined,
-            roleId: c.req.query("role") || undefined
-        });
-
-        const usersWithRoles = await Promise.all(
-            result.users.map(async (u) => {
-                const roles = await authRepo.getUserRoleIds(u.id);
-                return toAdminUser(u, roles);
-            })
-        );
-
-        return c.json({
-            users: usersWithRoles,
-            total: result.total,
-            limit: result.limit,
-            offset: result.offset
-        });
-    });
-
-    router.get("/users/:userId", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const result = await authRepo.getUserWithRoles(userId);
-
-        if (!result) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const adminUser = toAdminUser(result.user, result.roles.map((r) => r.id));
-        return c.json({ user: adminUser });
-    });
-
-    router.post("/users", requireAdmin, async (c) => {
-        const body = await c.req.json();
-        const { email, roles } = body;
-        if (!email) {
-            throw ApiError.badRequest("Email is required");
-        }
-
-        const existing = await authRepo.getUserByEmail(email.toLowerCase());
-        if (existing) {
-            throw ApiError.conflict("A user with this email already exists");
-        }
-
-        const prepResult = await prepareAdminUserValues(body, {
-            authRepo,
-            emailService,
-            emailConfig,
-            resolvedHooks: ops,
-            collectionAuthConfig
-        });
-
-        const user = await authRepo.createUser({
-            email: prepResult.values.email as string,
-            passwordHash: prepResult.values.passwordHash as string | undefined,
-            displayName: prepResult.values.displayName as string | undefined,
-            photoUrl: prepResult.values.photoUrl as string | undefined,
-            metadata: prepResult.values.metadata as Record<string, unknown> | undefined
-        });
-
-        if (roles && Array.isArray(roles)) {
-            await authRepo.setUserRoles(user.id, roles);
-        }
-
-        const finalizeResult = await finalizeAdminUserCreation(
-            { id: user.id, values: prepResult.values },
-            prepResult.clearPassword,
-            {
-                authRepo,
-                emailService,
-                emailConfig,
-                resolvedHooks: ops,
-                collectionAuthConfig
-            }
-        );
-
-        const userRoles = await authRepo.getUserRoleIds(user.id);
-        const adminUser = toAdminUser(user, userRoles);
-
-        return c.json(
-            {
-                user: adminUser,
-                invitationSent: finalizeResult.invitationSent,
-                ...(finalizeResult.temporaryPassword ? { temporaryPassword: finalizeResult.temporaryPassword } : {})
-            },
-            201
-        );
-    });
-
-    router.put("/users/:userId", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const body = await c.req.json();
-        const { password, email, displayName, roles } = body;
-
-        const existing = await authRepo.getUserById(userId);
-        if (!existing) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const updates: Record<string, unknown> = {};
-        if (email !== undefined) updates.email = email.toLowerCase();
-        if (displayName !== undefined) updates.displayName = displayName;
-
-        if (password) {
-            const validation = ops.validatePasswordStrength(password);
-            if (!validation.valid) {
-                throw ApiError.badRequest(`Password too weak: ${validation.errors.join(". ")}`);
-            }
-            updates.passwordHash = await ops.hashPassword(password);
-        }
-
-        if (Object.keys(updates).length > 0) {
-            await authRepo.updateUser(userId, updates);
-        }
-
-        if (roles !== undefined && Array.isArray(roles)) {
-            const currentRoles = await authRepo.getUserRoleIds(userId);
-            const wasAdmin = currentRoles.includes("admin");
-            const willBeAdmin = roles.includes("admin");
-
-            if (wasAdmin && !willBeAdmin) {
-                const adminUsers = await authRepo.listUsersPaginated({
-                    roleId: "admin",
-                    limit: 1
-                });
-                if (adminUsers.total <= 1) {
-                    throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
-                }
-            }
-            await authRepo.setUserRoles(userId, roles);
-        }
-
-        const result = await authRepo.getUserWithRoles(userId);
-        const adminUser = toAdminUser(result!.user, result!.roles.map((r) => r.id));
-
-        return c.json({ user: adminUser });
-    });
-
-    router.delete("/users/:userId", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const authUser = c.get("user") as { uid?: string; userId?: string } | undefined;
-        const currentUserId = authUser?.uid || authUser?.userId;
-
-        if (currentUserId === userId) {
-            throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
-        }
-
-        const existing = await authRepo.getUserById(userId);
-        if (!existing) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const roles = await authRepo.getUserRoleIds(userId);
-        if (roles.includes("admin")) {
-            const adminUsers = await authRepo.listUsersPaginated({
-                roleId: "admin",
-                limit: 1
-            });
-            if (adminUsers.total <= 1) {
-                throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
-            }
-        }
-
-        await authRepo.deleteUser(userId);
-        return c.json({ success: true });
-    });
-
-    return router;
-}

package/src/auth/api-keys/api-key-middleware.ts

@@ -1,133 +0,0 @@
-/**
- * Hono middleware for authenticating requests via Service API Keys.
- *
- * This middleware is integrated into `createAuthMiddleware()` and
- * activates only when the bearer token starts with `rk_`. It:
- *
- * 1. Hashes the token with SHA-256
- * 2. Looks up the hash in the `rebase.api_keys` table
- * 3. Validates the key is not revoked and not expired
- * 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
- * 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
- *
- * @module
- */
-
-import { createHash } from "crypto";
-import type { Context } from "hono";
-import type { DataDriver } from "@rebasepro/types";
-import type { HonoEnv } from "../../api/types";
-import type { ApiKeyStore } from "./api-key-store";
-import type { ApiKeyMasked } from "./api-key-types";
-import { scopeDataDriver } from "../rls-scope";
-import { logger } from "../../utils/logger";
-
-/**
- * Check whether a token looks like a Rebase API key.
- */
-export function isApiKeyToken(token: string): boolean {
-    return token.startsWith("rk_");
-}
-
-/**
- * Hash a plaintext API key token for database lookup.
- */
-function hashToken(token: string): string {
-    return createHash("sha256").update(token).digest("hex");
-}
-
-/**
- * Options for the API key authentication handler.
- */
-export interface ApiKeyAuthOptions {
-    store: ApiKeyStore;
-    driver: DataDriver;
-}
-
-/**
- * Validate an API key token and populate the Hono context.
- *
- * Returns `true` if the key is valid and context has been populated,
- * or returns an error Response if the key is invalid.
- *
- * This is NOT a standalone middleware — it's called from within
- * `createAuthMiddleware()` when a `rk_` prefixed token is detected.
- */
-export async function validateApiKey(
-    c: Context<HonoEnv>,
-    token: string,
-    options: ApiKeyAuthOptions
-): Promise<Response | true> {
-    const { store, driver } = options;
-
-    const hash = hashToken(token);
-    const apiKey = await store.findByKeyHash(hash);
-
-    if (!apiKey) {
-        return c.json({
-            error: { message: "Invalid API key",
-code: "UNAUTHORIZED" }
-        }, 401);
-    }
-
-    // Check revocation
-    if (apiKey.revoked_at) {
-        return c.json({
-            error: { message: "API key has been revoked",
-code: "UNAUTHORIZED" }
-        }, 401);
-    }
-
-    // Check expiration
-    if (apiKey.expires_at && new Date(apiKey.expires_at) < new Date()) {
-        return c.json({
-            error: { message: "API key has expired",
-code: "UNAUTHORIZED" }
-        }, 401);
-    }
-
-    // Set user identity — API keys represent service accounts
-    const userId = `api-key:${apiKey.id}`;
-    const roles: string[] = apiKey.admin ? ["admin", "service"] : ["service"];
-    c.set("user", { userId, roles });
-
-    // Expose masked key metadata for downstream permission checks
-    const masked: ApiKeyMasked = {
-        id: apiKey.id,
-        name: apiKey.name,
-        key_prefix: apiKey.key_prefix,
-        permissions: apiKey.permissions,
-        admin: apiKey.admin,
-        rate_limit: apiKey.rate_limit,
-        created_by: apiKey.created_by,
-        created_at: apiKey.created_at,
-        updated_at: apiKey.updated_at,
-        last_used_at: apiKey.last_used_at,
-        expires_at: apiKey.expires_at,
-        revoked_at: apiKey.revoked_at
-    };
-    // Store apiKey in the context for permission checking in api-generator
-    c.set("apiKey", masked);
-
-    // Scope the DataDriver — API keys bypass RLS (service identity)
-    try {
-        const scopedDriver = await scopeDataDriver(driver, {
-            uid: userId,
-            roles
-        });
-        c.set("driver", scopedDriver);
-    } catch (error) {
-        logger.error("[AUTH] RLS scoping failed for API key", { error: error });
-        return c.json({
-            error: { message: "Internal authentication error",
-code: "INTERNAL_ERROR" }
-        }, 500);
-    }
-
-    // Touch last_used_at in the background (non-blocking)
-    store.updateLastUsed(apiKey.id).catch(() => {
-        // Swallowed intentionally — logged inside the store
-    });
-
-    return true;
-}

package/src/auth/api-keys/api-key-routes.ts

@@ -1,193 +0,0 @@
-/**
- * Admin routes for managing Service API Keys.
- *
- * Mounted under `/api/admin/api-keys` with `requireAuth` + `requireAdmin`.
- * All routes return masked keys (never the hash). The full plaintext key
- * is returned exactly once in the POST response.
- *
- * @module
- */
-
-import { Hono } from "hono";
-import { ApiError, errorHandler } from "../../api/errors";
-import { createRequireAuth, requireAdmin } from "../middleware";
-import type { HonoEnv } from "../../api/types";
-import type { ApiKeyStore } from "./api-key-store";
-import type { CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyPermission } from "./api-key-types";
-
-export interface ApiKeyRouteOptions {
-    store: ApiKeyStore;
-    serviceKey?: string;
-}
-
-/**
- * Validate that a permissions array is well-formed.
- */
-function validatePermissions(permissions: unknown): permissions is ApiKeyPermission[] {
-    if (!Array.isArray(permissions)) return false;
-    for (const perm of permissions) {
-        if (typeof perm !== "object" || perm === null) return false;
-        if (typeof perm.collection !== "string" || perm.collection.length === 0) return false;
-        if (!Array.isArray(perm.operations) || perm.operations.length === 0) return false;
-        const validOps = new Set(["read", "write", "delete"]);
-        for (const op of perm.operations) {
-            if (!validOps.has(op)) return false;
-        }
-    }
-    return true;
-}
-
-/**
- * Create admin routes for API key management.
- */
-export function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv> {
-    const { store, serviceKey } = options;
-    const router = new Hono<HonoEnv>();
-
-    router.onError(errorHandler);
-
-    // Apply auth middleware (service-key-aware)
-    router.use("/*", createRequireAuth({ serviceKey }));
-    router.use("/*", requireAdmin);
-
-    // GET / — List all API keys (masked)
-    router.get("/", async (c) => {
-        const keys = await store.listApiKeys();
-        return c.json({ keys });
-    });
-
-    // POST / — Create a new API key
-    router.post("/", async (c) => {
-        const body = await c.req.json() as Record<string, unknown>;
-        const { name, permissions, admin, rate_limit, expires_at } = body;
-
-        if (!name || typeof name !== "string" || name.trim().length === 0) {
-            throw ApiError.badRequest("Name is required", "INVALID_INPUT");
-        }
-
-        if (!validatePermissions(permissions)) {
-            throw ApiError.badRequest(
-                "Permissions must be an array of { collection: string, operations: ('read' | 'write' | 'delete')[] }",
-                "INVALID_INPUT"
-            );
-        }
-
-        if (admin !== undefined && typeof admin !== "boolean") {
-            throw ApiError.badRequest("admin must be a boolean", "INVALID_INPUT");
-        }
-
-        if (rate_limit !== undefined && rate_limit !== null) {
-            if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
-                throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
-            }
-        }
-
-        if (expires_at !== undefined && expires_at !== null) {
-            const parsed = new Date(expires_at as string);
-            if (isNaN(parsed.getTime())) {
-                throw ApiError.badRequest("expires_at must be a valid ISO-8601 date", "INVALID_INPUT");
-            }
-            if (parsed <= new Date()) {
-                throw ApiError.badRequest("expires_at must be in the future", "INVALID_INPUT");
-            }
-        }
-
-        const user = c.get("user");
-        const createdBy = (user && typeof user === "object" && "userId" in user)
-            ? (user.userId as string)
-            : "unknown";
-
-        const request: CreateApiKeyRequest = {
-            name: name.trim(),
-            permissions: permissions as ApiKeyPermission[],
-            admin: (admin as boolean) ?? false,
-            rate_limit: (rate_limit as number | null) ?? null,
-            expires_at: (expires_at as string | null) ?? null
-        };
-
-        const keyWithSecret = await store.createApiKey(request, createdBy);
-
-        return c.json({ key: keyWithSecret }, 201);
-    });
-
-    // GET /:id — Get API key details (masked)
-    router.get("/:id", async (c) => {
-        const id = c.req.param("id");
-        const key = await store.getApiKeyById(id);
-
-        if (!key) {
-            throw ApiError.notFound("API key not found");
-        }
-
-        return c.json({ key });
-    });
-
-    // PUT /:id — Update API key
-    router.put("/:id", async (c) => {
-        const id = c.req.param("id");
-        const body = await c.req.json() as Record<string, unknown>;
-        const { name, permissions, admin, rate_limit, expires_at } = body;
-
-        // Validate fields if provided
-        if (name !== undefined) {
-            if (typeof name !== "string" || name.trim().length === 0) {
-                throw ApiError.badRequest("Name must be a non-empty string", "INVALID_INPUT");
-            }
-        }
-
-        if (permissions !== undefined) {
-            if (!validatePermissions(permissions)) {
-                throw ApiError.badRequest(
-                    "Permissions must be an array of { collection: string, operations: ('read' | 'write' | 'delete')[] }",
-                    "INVALID_INPUT"
-                );
-            }
-        }
-
-        if (admin !== undefined && typeof admin !== "boolean") {
-            throw ApiError.badRequest("admin must be a boolean", "INVALID_INPUT");
-        }
-
-        if (rate_limit !== undefined && rate_limit !== null) {
-            if (typeof rate_limit !== "number" || rate_limit < 1 || !Number.isInteger(rate_limit)) {
-                throw ApiError.badRequest("rate_limit must be a positive integer or null", "INVALID_INPUT");
-            }
-        }
-
-        if (expires_at !== undefined && expires_at !== null) {
-            const parsed = new Date(expires_at as string);
-            if (isNaN(parsed.getTime())) {
-                throw ApiError.badRequest("expires_at must be a valid ISO-8601 date", "INVALID_INPUT");
-            }
-        }
-
-        const updates: UpdateApiKeyRequest = {};
-        if (name !== undefined) updates.name = (name as string).trim();
-        if (permissions !== undefined) updates.permissions = permissions as ApiKeyPermission[];
-        if (admin !== undefined) updates.admin = admin as boolean;
-        if (rate_limit !== undefined) updates.rate_limit = rate_limit as number | null;
-        if (expires_at !== undefined) updates.expires_at = expires_at as string | null;
-
-        const key = await store.updateApiKey(id, updates);
-
-        if (!key) {
-            throw ApiError.notFound("API key not found");
-        }
-
-        return c.json({ key });
-    });
-
-    // DELETE /:id — Revoke (soft-delete)
-    router.delete("/:id", async (c) => {
-        const id = c.req.param("id");
-        const revoked = await store.revokeApiKey(id);
-
-        if (!revoked) {
-            throw ApiError.notFound("API key not found or already revoked");
-        }
-
-        return c.json({ success: true });
-    });
-
-    return router;
-}