@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/api-keys/api-key-store.ts

@@ -1,340 +0,0 @@
-/**
- * Database operations for Service API Keys.
- *
- * Uses the DataDriver's `admin.executeSql` capability (same pattern as
- * the cron-store and ensure-tables modules). All data lives in the
- * `rebase.api_keys` table.
- *
- * @module
- */
-
-import { randomBytes, createHash } from "crypto";
-import type { DataDriver } from "@rebasepro/types";
-import { isSQLAdmin } from "@rebasepro/types";
-import { logger } from "../../utils/logger";
-import type {
-    ApiKey,
-    ApiKeyMasked,
-    ApiKeyPermission,
-    ApiKeyWithSecret,
-    CreateApiKeyRequest,
-    UpdateApiKeyRequest
-} from "./api-key-types";
-
-const TABLE = "rebase.api_keys";
-
-/** Characters used to generate the random portion of an API key. */
-const HEX_CHARS = "abcdef0123456789";
-
-/**
- * Generate a plaintext API key with the `rk_live_` prefix.
- *
- * Format: `rk_live_` + 32 random hex characters.
- */
-function generateApiKey(): string {
-    const random = randomBytes(16).toString("hex"); // 32 hex chars
-    return `rk_live_${random}`;
-}
-
-/**
- * SHA-256 hash a plaintext API key for database storage.
- */
-function hashKey(plaintext: string): string {
-    return createHash("sha256").update(plaintext).digest("hex");
-}
-
-/**
- * Extract the display prefix from a plaintext key (first 12 chars).
- */
-function keyPrefix(plaintext: string): string {
-    return plaintext.substring(0, 12);
-}
-
-/**
- * Strip the `key_hash` field and return a safe-to-expose masked key.
- */
-function toMasked(row: ApiKey): ApiKeyMasked {
-    return {
-        id: row.id,
-        name: row.name,
-        key_prefix: row.key_prefix,
-        permissions: row.permissions,
-        admin: row.admin,
-        rate_limit: row.rate_limit,
-        created_by: row.created_by,
-        created_at: row.created_at,
-        updated_at: row.updated_at,
-        last_used_at: row.last_used_at,
-        expires_at: row.expires_at,
-        revoked_at: row.revoked_at
-    };
-}
-
-/**
- * Parse a raw DB row into the typed `ApiKey` shape.
- */
-function rowToApiKey(row: Record<string, unknown>): ApiKey {
-    let permissions = (row.permissions ?? []) as ApiKeyPermission[];
-    if (typeof row.permissions === "string") {
-        try {
-            permissions = JSON.parse(row.permissions) as ApiKeyPermission[];
-        } catch {
-            permissions = [];
-        }
-    }
-
-    return {
-        id: row.id as string,
-        name: row.name as string,
-        key_prefix: row.key_prefix as string,
-        key_hash: row.key_hash as string,
-        permissions,
-        admin: Boolean(row.admin),
-        rate_limit: row.rate_limit !== null && row.rate_limit !== undefined
-            ? Number(row.rate_limit)
-            : null,
-        created_by: row.created_by as string,
-        created_at: new Date(row.created_at as string).toISOString(),
-        updated_at: new Date(row.updated_at as string).toISOString(),
-        last_used_at: row.last_used_at ? new Date(row.last_used_at as string).toISOString() : null,
-        expires_at: row.expires_at ? new Date(row.expires_at as string).toISOString() : null,
-        revoked_at: row.revoked_at ? new Date(row.revoked_at as string).toISOString() : null
-    };
-}
-
-// ─── Public API ──────────────────────────────────────────────────────
-
-export interface ApiKeyStore {
-    /** Ensure the `rebase.api_keys` table exists. Called once on startup. */
-    ensureTable(): Promise<void>;
-
-    /** Create a new API key. Returns the full plaintext key exactly once. */
-    createApiKey(request: CreateApiKeyRequest, createdBy: string): Promise<ApiKeyWithSecret>;
-
-    /** Look up an API key by its SHA-256 hash. Returns `null` if not found. */
-    findByKeyHash(hash: string): Promise<ApiKey | null>;
-
-    /** List all API keys (masked, never includes hash). */
-    listApiKeys(): Promise<ApiKeyMasked[]>;
-
-    /** Get a single API key by ID (masked). */
-    getApiKeyById(id: string): Promise<ApiKeyMasked | null>;
-
-    /** Update name, permissions, rate_limit, or expires_at. */
-    updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null>;
-
-    /** Soft-delete: set `revoked_at` to now. */
-    revokeApiKey(id: string): Promise<boolean>;
-
-    /** Touch `last_used_at` to the current timestamp. */
-    updateLastUsed(id: string): Promise<void>;
-}
-
-/**
- * Create an `ApiKeyStore` backed by the driver's SQL admin capability.
- *
- * Returns `undefined` if the driver does not support `executeSql`.
- */
-export function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined {
-    const admin = driver.admin;
-    if (!isSQLAdmin(admin)) {
-        logger.warn("⚠️ [api-key-store] DataDriver does not support SQL admin — API keys will not be available.");
-        return undefined;
-    }
-
-    const exec = (sqlText: string, options?: { params?: unknown[] }) =>
-        admin.executeSql(sqlText, options?.params ? { params: options.params } : undefined);
-
-    return {
-        // ── Schema bootstrap ────────────────────────────────────────
-        async ensureTable(): Promise<void> {
-            try {
-                await exec("CREATE SCHEMA IF NOT EXISTS rebase");
-                await exec(`
-                    CREATE TABLE IF NOT EXISTS ${TABLE} (
-                        id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-                        name TEXT NOT NULL,
-                        key_prefix TEXT NOT NULL,
-                        key_hash TEXT NOT NULL UNIQUE,
-                        permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
-                        admin BOOLEAN NOT NULL DEFAULT FALSE,
-                        rate_limit INTEGER,
-                        created_by TEXT NOT NULL,
-                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-                        last_used_at TIMESTAMPTZ,
-                        expires_at TIMESTAMPTZ,
-                        revoked_at TIMESTAMPTZ
-                    )
-                `);
-
-                await exec(`
-                    CREATE INDEX IF NOT EXISTS idx_api_keys_hash
-                    ON ${TABLE}(key_hash)
-                `);
-
-                await exec(`
-                    CREATE INDEX IF NOT EXISTS idx_api_keys_prefix
-                    ON ${TABLE}(key_prefix)
-                `);
-
-                // Migration: add admin column to existing tables
-                await exec(`
-                    ALTER TABLE ${TABLE}
-                    ADD COLUMN IF NOT EXISTS admin BOOLEAN NOT NULL DEFAULT FALSE
-                `);
-
-                logger.info("✅ API keys table ready");
-            } catch (err) {
-                logger.error("❌ Failed to create API keys table", { error: err });
-                logger.warn("⚠️ Continuing without API keys support.");
-            }
-        },
-
-        // ── Create ──────────────────────────────────────────────────
-        async createApiKey(request: CreateApiKeyRequest, createdBy: string): Promise<ApiKeyWithSecret> {
-            const plaintext = generateApiKey();
-            const hash = hashKey(plaintext);
-            const prefix = keyPrefix(plaintext);
-            const permissionsJson = JSON.stringify(request.permissions);
-
-            const rows = await exec(
-                `INSERT INTO ${TABLE} (name, key_prefix, key_hash, permissions, admin, rate_limit, created_by, expires_at)
-                 VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)
-                 RETURNING *`,
-                { params: [
-                    request.name,
-                    prefix,
-                    hash,
-                    permissionsJson,
-                    request.admin ?? false,
-                    request.rate_limit ?? null,
-                    createdBy,
-                    request.expires_at ?? null
-                ]}
-            );
-
-            const apiKey = rowToApiKey(rows[0]);
-            return {
-                ...toMasked(apiKey),
-                key: plaintext
-            };
-        },
-
-        // ── Lookup by hash ──────────────────────────────────────────
-        async findByKeyHash(hash: string): Promise<ApiKey | null> {
-            const rows = await exec(
-                `SELECT * FROM ${TABLE}
-                 WHERE key_hash = $1
-                 LIMIT 1`,
-                { params: [hash] }
-            );
-            if (rows.length === 0) return null;
-            return rowToApiKey(rows[0]);
-        },
-
-        // ── List all (masked) ───────────────────────────────────────
-        async listApiKeys(): Promise<ApiKeyMasked[]> {
-            const rows = await exec(`
-                SELECT * FROM ${TABLE}
-                ORDER BY created_at DESC
-            `);
-            return rows.map(r => toMasked(rowToApiKey(r)));
-        },
-
-        // ── Get by ID (masked) ──────────────────────────────────────
-        async getApiKeyById(id: string): Promise<ApiKeyMasked | null> {
-            const rows = await exec(
-                `SELECT * FROM ${TABLE}
-                 WHERE id = $1
-                 LIMIT 1`,
-                { params: [id] }
-            );
-            if (rows.length === 0) return null;
-            return toMasked(rowToApiKey(rows[0]));
-        },
-
-        // ── Update ──────────────────────────────────────────────────
-        async updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null> {
-            const setClauses: string[] = [];
-            const params: unknown[] = [];
-            let paramIdx = 1;
-
-            if (updates.name !== undefined) {
-                setClauses.push(`name = $${paramIdx++}`);
-                params.push(updates.name);
-            }
-            if (updates.permissions !== undefined) {
-                setClauses.push(`permissions = $${paramIdx++}::jsonb`);
-                params.push(JSON.stringify(updates.permissions));
-            }
-            if (updates.admin !== undefined) {
-                setClauses.push(`admin = $${paramIdx++}`);
-                params.push(updates.admin);
-            }
-            if (updates.rate_limit !== undefined) {
-                if (updates.rate_limit !== null) {
-                    setClauses.push(`rate_limit = $${paramIdx++}`);
-                    params.push(updates.rate_limit);
-                } else {
-                    setClauses.push("rate_limit = NULL");
-                }
-            }
-            if (updates.expires_at !== undefined) {
-                if (updates.expires_at !== null) {
-                    setClauses.push(`expires_at = $${paramIdx++}`);
-                    params.push(updates.expires_at);
-                } else {
-                    setClauses.push("expires_at = NULL");
-                }
-            }
-
-            if (setClauses.length === 0) {
-                return this.getApiKeyById(id);
-            }
-
-            setClauses.push("updated_at = NOW()");
-
-            // The WHERE id = $N uses the next available param index
-            params.push(id);
-
-            const rows = await exec(
-                `UPDATE ${TABLE}
-                 SET ${setClauses.join(", ")}
-                 WHERE id = $${paramIdx}
-                 RETURNING *`,
-                { params }
-            );
-
-            if (rows.length === 0) return null;
-            return toMasked(rowToApiKey(rows[0]));
-        },
-
-        // ── Revoke (soft-delete) ────────────────────────────────────
-        async revokeApiKey(id: string): Promise<boolean> {
-            const rows = await exec(
-                `UPDATE ${TABLE}
-                 SET revoked_at = NOW(), updated_at = NOW()
-                 WHERE id = $1 AND revoked_at IS NULL
-                 RETURNING id`,
-                { params: [id] }
-            );
-            return rows.length > 0;
-        },
-
-        // ── Touch last_used_at ──────────────────────────────────────
-        async updateLastUsed(id: string): Promise<void> {
-            try {
-                await exec(
-                    `UPDATE ${TABLE}
-                     SET last_used_at = NOW()
-                     WHERE id = $1`,
-                    { params: [id] }
-                );
-            } catch (err) {
-                // Non-blocking — don't fail requests because of a usage timestamp update
-                logger.error("[api-key-store] Failed to update last_used_at", { error: err });
-            }
-        }
-    };
-}

package/src/auth/apple-oauth.ts

@@ -1,122 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import jwt from "jsonwebtoken";
-import { logger } from "../utils/logger";
-/**
- * Creates an Apple Sign In OAuth Provider integration.
- *
- * Apple requires a client secret that is a signed JWT, regenerated on each
- * token exchange (valid up to 6 months). This provider handles that automatically.
- *
- * Required Apple Developer configuration:
- * - Services ID (clientId)
- * - Key ID from the private key registered with Apple
- * - Team ID from Apple Developer account
- * - Private key (.p8 file contents) downloaded from Apple Developer portal
- */
-export function createAppleProvider(config: {
-    clientId: string;
-    teamId: string;
-    keyId: string;
-    /** The raw PEM contents of the .p8 private key file */
-    privateKey: string;
-}): OAuthProvider<{
-            code: string;
-            redirectUri: string;
-            user?: { name?: { firstName?: string; lastName?: string }; email?: string };
-        }> {
-    /**
-     * Generate a client_secret JWT signed with the Apple private key.
-     * Apple requires this instead of a static client_secret.
-     */
-    async function generateClientSecret(): Promise<string> {
-        return jwt.sign({}, config.privateKey, {
-            algorithm: "ES256",
-            keyid: config.keyId,
-            issuer: config.teamId,
-            expiresIn: "180d",
-            audience: "https://appleid.apple.com",
-            subject: config.clientId
-        });
-    }
-
-    return {
-        id: "apple",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required"),
-            /** Apple sends user info only on first authorization; the frontend must forward it. */
-            user: z.object({
-                name: z.object({
-                    firstName: z.string().optional(),
-                    lastName: z.string().optional()
-                }).optional(),
-                email: z.string().email().optional()
-            }).optional()
-        }),
-        verify: async (payload: {
-            code: string;
-            redirectUri: string;
-            user?: { name?: { firstName?: string; lastName?: string }; email?: string };
-        }): Promise<OAuthProviderProfile | null> => {
-            try {
-                const clientSecret = await generateClientSecret();
-
-                // Exchange code for tokens
-                const tokenResponse = await fetch("https://appleid.apple.com/auth/token", {
-                    method: "POST",
-                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                    body: new URLSearchParams({
-                        client_id: config.clientId,
-                        client_secret: clientSecret,
-                        code: payload.code,
-                        grant_type: "authorization_code",
-                        redirect_uri: payload.redirectUri
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Apple access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { id_token: string };
-
-                // Decode the id_token (JWT) to get user info.
-                // Apple's id_token is a standard JWT — we only need the payload.
-                const [, payloadB64] = tokenData.id_token.split(".");
-                const decoded = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8")) as {
-                    sub: string;
-                    email?: string;
-                    email_verified?: string | boolean;
-                };
-
-                // Apple only sends the user's name on the FIRST authorization.
-                // Subsequent logins only have the id_token. The frontend should pass
-                // the user object from the first auth for us to capture the name.
-                const email = decoded.email || payload.user?.email;
-                if (!email) {
-                    logger.error("Apple user has no email");
-                    return null;
-                }
-
-                let displayName: string | null = null;
-                if (payload.user?.name) {
-                    const parts = [payload.user.name.firstName, payload.user.name.lastName].filter(Boolean);
-                    displayName = parts.length > 0 ? parts.join(" ") : null;
-                }
-
-                return {
-                    providerId: decoded.sub,
-                    email,
-                    displayName,
-                    photoUrl: null, // Apple does not provide a profile photo
-                    emailVerified: decoded.email_verified === true || decoded.email_verified === "true"
-                };
-            } catch (error) {
-                logger.error("Apple OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/bitbucket-oauth.ts

@@ -1,84 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
- */
-export function createBitbucketProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "bitbucket",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-
-                const tokenResponse = await fetch("https://bitbucket.org/site/oauth2/access_token", {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/x-www-form-urlencoded",
-                        "Authorization": `Basic ${basicAuth}`
-                    },
-                    body: new URLSearchParams({
-                        grant_type: "authorization_code",
-                        code: payload.code,
-                        redirect_uri: payload.redirectUri
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Bitbucket access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-                const accessToken = tokenData.access_token;
-
-                const profileResponse = await fetch("https://api.bitbucket.org/2.0/user", {
-                    headers: { "Authorization": `Bearer ${accessToken}` }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Bitbucket user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const p = await profileResponse.json() as {
-                    uuid: string; display_name?: string; username?: string;
-                    links?: { avatar?: { href?: string } };
-                };
-
-                // Bitbucket doesn't return email in user profile — fetch from /emails endpoint
-                const emailsResponse = await fetch("https://api.bitbucket.org/2.0/user/emails", {
-                    headers: { "Authorization": `Bearer ${accessToken}` }
-                });
-
-                let email: string | null = null;
-                if (emailsResponse.ok) {
-                    const emailData = await emailsResponse.json() as {
-                        values: Array<{ email: string; is_primary: boolean; is_confirmed: boolean }>;
-                    };
-                    const primary = emailData.values.find(e => e.is_primary && e.is_confirmed)
-                        || emailData.values.find(e => e.is_confirmed);
-                    email = primary?.email || null;
-                }
-
-                if (!email) { logger.error("Bitbucket user has no verified email"); return null; }
-
-                return {
-                    providerId: p.uuid,
-                    email,
-                    displayName: p.display_name || p.username || null,
-                    photoUrl: p.links?.avatar?.href || null,
-                    emailVerified: true
-                };
-            } catch (error) {
-                logger.error("Bitbucket OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}