@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/builtin-auth-adapter.ts

@@ -1,380 +0,0 @@
-/**
- * RebaseBuiltinAuthAdapter
- *
- * Wraps Rebase's existing built-in JWT auth system (routes, middleware, user/role
- * management) into the `AuthAdapter` interface. This is the default adapter used
- * when the user passes a plain `RebaseAuthConfig` object.
- *
- * This is NOT a rewrite — it delegates to the existing `createAuthRoutes()`,
- * `createResetPasswordRoute()`, and `verifyAccessToken()` functions. The goal is to
- * present the same functionality through the pluggable `AuthAdapter` contract.
- */
-
-import type {
-    AuthAdapter,
-    AuthenticatedUser,
-    AuthAdapterCapabilities,
-    UserManagementAdapter,
-    AuthUserListOptions,
-    AuthUserListResult,
-    AuthUserData,
-    AuthCreateUserData,
-    BootstrappedAuth
-} from "@rebasepro/types";
-
-import { Hono } from "hono";
-import { verifyAccessToken } from "./jwt";
-import type { AccessTokenPayload } from "./jwt";
-import { createAuthRoutes } from "./routes";
-import { createResetPasswordRoute } from "./reset-password-admin";
-import { createAdminRolesRoute } from "./admin-roles-route";
-import { createAdminUsersRoute } from "./admin-users-route";
-import { prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
-import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks, ResolvedAuthHooks } from "./auth-hooks";
-import { resolveAuthHooks } from "./auth-hooks";
-import type { EmailService, EmailConfig } from "../email";
-import type { HonoEnv } from "../api/types";
-import { safeCompare } from "./crypto-utils";
-import { logger } from "../utils/logger";
-
-/**
- * Configuration for the built-in Rebase auth adapter.
- *
- * This mirrors the existing `RebaseAuthConfig` — users pass this and
- * server-core auto-wraps it in a `RebaseBuiltinAuthAdapter`.
- */
-export interface BuiltinAuthAdapterConfig {
-    /** The bootstrapper-provided auth repository (users, roles, tokens). */
-    authRepository: AuthRepository;
-    /** Email service for password resets, verification, etc. */
-    emailService?: EmailService;
-    /** Email configuration. */
-    emailConfig?: EmailConfig;
-    /** Whether to allow new user registration. */
-    allowRegistration?: boolean;
-    /** Default role to assign to new users. */
-    defaultRole?: string;
-    /** OAuth providers to register. */
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    oauthProviders?: OAuthProvider<any>[];
-    /** Static service key for server-to-server auth. */
-    serviceKey?: string;
-    /** Auth hooks for customizing password, credentials, lifecycle, etc. */
-    authHooks?: AuthHooks;
-    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
-    collectionAuthConfig?: import("@rebasepro/types").AuthCollectionConfig;
-    /** Enable magic link (passwordless email) login. Requires email service. */
-    enableMagicLink?: boolean;
-}
-
-/**
- * Create the built-in Rebase auth adapter.
- *
- * This wraps the existing auth infrastructure (JWT, OAuth, user/role management)
- * into the `AuthAdapter` interface. It's used internally by `initializeRebaseBackend()`
- * when the user passes a plain `RebaseAuthConfig` object.
- */
-export function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): AuthAdapter {
-    const {
-        authRepository,
-        emailService,
-        emailConfig,
-        allowRegistration = false,
-        defaultRole,
-        oauthProviders = [],
-        serviceKey,
-        authHooks,
-        collectionAuthConfig,
-        enableMagicLink = false
-    } = config;
-
-    const resolvedOps = resolveAuthHooks(authHooks);
-
-    const adapter: AuthAdapter = {
-        id: "rebase-builtin",
-
-        serviceKey,
-
-        async verifyRequest(request: Request): Promise<AuthenticatedUser | null> {
-            const authHeader = request.headers.get("authorization");
-            const url = new URL(request.url, "http://localhost");
-            const queryToken = url.searchParams.get("token");
-            const hasBearer = authHeader?.startsWith("Bearer ");
-
-            if (!hasBearer && !queryToken) {
-                return null;
-            }
-
-            const token = hasBearer ? authHeader!.substring(7) : queryToken!;
-
-            // Check service key first (constant-time)
-            if (serviceKey && safeCompare(token, serviceKey)) {
-                return {
-                    uid: "service",
-                    email: "service@rebase.internal",
-                    roles: ["admin"],
-                    isAdmin: true,
-                    rawToken: token
-                };
-            }
-
-            // JWT verification
-            const payload = verifyAccessToken(token);
-            if (!payload) {
-                return null;
-            }
-
-            // Resolve roles from the repository
-            let roles: string[] = payload.roles || [];
-            try {
-                roles = await authRepository.getUserRoleIds(payload.userId);
-            } catch (err: unknown) {
-                logger.warn("Role lookup from repository failed, using token roles as fallback", { userId: payload.userId, error: err });
-            }
-
-            const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
-
-            return {
-                uid: payload.userId,
-                email: payload.email ?? "",
-                displayName: payload.displayName ?? null,
-                roles,
-                isAdmin,
-                rawToken: token
-            };
-        },
-
-        async verifyToken(token: string): Promise<AuthenticatedUser | null> {
-            // Service key check (constant-time)
-            if (serviceKey && safeCompare(token, serviceKey)) {
-                return {
-                    uid: "service",
-                    email: "service@rebase.internal",
-                    roles: ["admin"],
-                    isAdmin: true,
-                    rawToken: token
-                };
-            }
-
-            // JWT verification
-            const payload = verifyAccessToken(token);
-            if (!payload) {
-                return null;
-            }
-
-            let roles: string[] = payload.roles || [];
-            try {
-                roles = await authRepository.getUserRoleIds(payload.userId);
-            } catch (err: unknown) {
-                logger.warn("Role lookup from repository failed, using token roles as fallback", { userId: payload.userId, error: err });
-            }
-
-            const isAdmin = roles.some((r) => r === "admin" || r === "schema-admin");
-
-            return {
-                uid: payload.userId,
-                email: payload.email ?? "",
-                displayName: payload.displayName ?? null,
-                roles,
-                isAdmin,
-                rawToken: token
-            };
-        },
-
-        userManagement: createUserManagementFromRepo(authRepository, resolvedOps),
-
-
-        createAuthRoutes(): Hono<HonoEnv> | undefined {
-            return createAuthRoutes({
-                authRepo: authRepository,
-                emailService,
-                emailConfig,
-                allowRegistration,
-                defaultRole,
-                oauthProviders,
-                authHooks,
-                enableMagicLink
-            });
-        },
-
-        createAdminRoutes(): Hono<HonoEnv> | undefined {
-            const router = new Hono<HonoEnv>();
-            const resetPasswordRoute = createResetPasswordRoute({
-                authRepo: authRepository,
-                emailService,
-                emailConfig,
-                serviceKey,
-                authHooks,
-                collectionAuthConfig
-            });
-            const rolesRoute = createAdminRolesRoute({
-                authRepo: authRepository,
-                serviceKey
-            });
-            const adminUsersRoute = createAdminUsersRoute({
-                authRepo: authRepository,
-                emailService,
-                emailConfig,
-                serviceKey,
-                authHooks,
-                collectionAuthConfig
-            });
-            router.route("/", resetPasswordRoute);
-            router.route("/", rolesRoute);
-            router.route("/", adminUsersRoute);
-            return router;
-        },
-
-        async prepareUserCreation(values, collectionAuth) {
-            const parsedCollectionAuth = collectionAuth as import("@rebasepro/types").AuthCollectionConfig | undefined;
-            return prepareAdminUserValues(values, {
-                authRepo: authRepository,
-                emailService,
-                emailConfig,
-                resolvedHooks: resolvedOps,
-                collectionAuthConfig: parsedCollectionAuth ?? collectionAuthConfig
-            });
-        },
-
-        async finalizeUserCreation(entity, clearPassword) {
-            return finalizeAdminUserCreation(entity, clearPassword, {
-                authRepo: authRepository,
-                emailService,
-                emailConfig,
-                resolvedHooks: resolvedOps,
-                collectionAuthConfig
-            });
-        },
-
-        async getCapabilities(): Promise<AuthAdapterCapabilities> {
-            // Detect bootstrap mode: are there any users?
-            let needsSetup = false;
-            try {
-                const result = await authRepository.listUsersPaginated({ limit: 1 });
-                needsSetup = result.total === 0;
-            } catch {
-                // If the check fails, assume not in setup mode
-            }
-
-            const enabledProviders = oauthProviders.map((p) => p.id);
-
-            return {
-                hasBuiltInAuthRoutes: true,
-                emailPasswordLogin: true,
-                registration: allowRegistration || needsSetup,
-                registrationEnabled: allowRegistration || needsSetup,
-                passwordReset: !!emailService?.isConfigured(),
-                sessionManagement: true,
-                profileUpdate: true,
-                emailVerification: !!emailService?.isConfigured(),
-                magicLink: enableMagicLink && !!emailService?.isConfigured(),
-                enabledProviders,
-                needsSetup
-            };
-        }
-    };
-
-    return adapter;
-}
-
-// ─── Internal Helpers ────────────────────────────────────────────────────────
-
-function createUserManagementFromRepo(repo: AuthRepository, resolvedOps: ResolvedAuthHooks): UserManagementAdapter {
-    return {
-        async listUsers(options?: AuthUserListOptions): Promise<AuthUserListResult> {
-            const result = await repo.listUsersPaginated({
-                limit: options?.limit,
-                offset: options?.offset,
-                search: options?.search,
-                orderBy: options?.orderBy,
-                orderDir: options?.orderDir,
-                roleId: options?.roleId
-            });
-            return {
-                users: result.users.map(toAuthUserData),
-                total: result.total,
-                limit: result.limit,
-                offset: result.offset
-            };
-        },
-
-        async getUserById(id: string): Promise<AuthUserData | null> {
-            const user = await repo.getUserById(id);
-            return user ? toAuthUserData(user) : null;
-        },
-
-        async createUser(data: AuthCreateUserData): Promise<AuthUserData> {
-            const passwordHash = data.password ? await resolvedOps.hashPassword(data.password) : undefined;
-            let createData: import("./interfaces").CreateUserData = {
-                email: data.email,
-                passwordHash,
-                displayName: data.displayName,
-                photoUrl: data.photoUrl,
-                metadata: data.metadata
-            };
-            if (resolvedOps.beforeUserCreate) {
-                createData = await resolvedOps.beforeUserCreate(createData);
-            }
-            const user = await repo.createUser(createData);
-            if (resolvedOps.afterUserCreate) {
-                try {
-                    await resolvedOps.afterUserCreate(user);
-                } catch (err) {
-                    logger.error("[AuthHooks] afterUserCreate error", { error: err instanceof Error ? err.message : err });
-                }
-            }
-            return toAuthUserData(user);
-        },
-
-        async updateUser(id: string, data: Partial<AuthCreateUserData>): Promise<AuthUserData | null> {
-            const updateData: Record<string, unknown> = {};
-            if (data.email !== undefined) updateData.email = data.email;
-            if (data.displayName !== undefined) updateData.displayName = data.displayName;
-            if (data.photoUrl !== undefined) updateData.photoUrl = data.photoUrl;
-            if (data.metadata !== undefined) updateData.metadata = data.metadata;
-            if (data.password) {
-                updateData.passwordHash = await resolvedOps.hashPassword(data.password);
-            }
-            const user = await repo.updateUser(id, updateData);
-            return user ? toAuthUserData(user) : null;
-        },
-
-        async deleteUser(id: string): Promise<void> {
-            // Call beforeUserDelete hook (throw to prevent deletion)
-            if (resolvedOps.beforeUserDelete) {
-                await resolvedOps.beforeUserDelete(id);
-            }
-
-            await repo.deleteUser(id);
-
-            // Fire afterUserDelete hook (fire-and-forget)
-            if (resolvedOps.afterUserDelete) {
-                resolvedOps.afterUserDelete(id).catch(err => {
-                    logger.error("[AuthHooks] afterUserDelete error", { error: err instanceof Error ? err.message : err });
-                });
-            }
-        },
-
-        async getUserRoles(userId: string): Promise<string[]> {
-            return repo.getUserRoleIds(userId);
-        },
-
-        async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
-            await repo.setUserRoles(userId, roleIds);
-        }
-    };
-}
-
-function toAuthUserData(user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; emailVerified?: boolean; metadata?: Record<string, unknown>; createdAt?: Date; updatedAt?: Date }): AuthUserData {
-    return {
-        id: user.id,
-        email: user.email,
-        displayName: user.displayName,
-        photoUrl: user.photoUrl,
-        emailVerified: user.emailVerified,
-        metadata: user.metadata,
-        createdAt: user.createdAt,
-        updatedAt: user.updatedAt
-    };
-}

package/src/auth/custom-auth-adapter.ts

@@ -1,86 +0,0 @@
-/**
- * Custom Auth Adapter Factory
- *
- * Provides a minimal-config way for users with existing auth systems
- * to plug into Rebase. Only `verifyRequest` is required — everything
- * else is optional.
- *
- * @example
- * ```ts
- * import { createCustomAuthAdapter } from "@rebasepro/server-core";
- *
- * const auth = createCustomAuthAdapter({
- *   verifyRequest: async (request) => {
- *     const token = request.headers.get("Authorization")?.replace("Bearer ", "");
- *     if (!token) return null;
- *     const decoded = jwt.verify(token, MY_SECRET);
- *     return {
- *       uid: decoded.sub,
- *       email: decoded.email,
- *       displayName: decoded.name,
- *       roles: decoded.roles || [],
- *       isAdmin: decoded.roles?.includes("admin") ?? false,
- *     };
- *   },
- * });
- * ```
- */
-
-import type {
-    AuthAdapter,
-    AuthAdapterCapabilities,
-    CustomAuthAdapterOptions
-} from "@rebasepro/types";
-
-/**
- * Create a custom auth adapter from minimal options.
- *
- * This is the recommended entry point for users who already have their own
- * auth system and just need to tell Rebase how to extract the user from
- * incoming requests.
- *
- * @param options - Configuration options. Only `verifyRequest` is required.
- * @returns A fully-formed `AuthAdapter` ready for `initializeRebaseBackend()`.
- */
-export function createCustomAuthAdapter(options: CustomAuthAdapterOptions): AuthAdapter {
-    const defaultCapabilities: AuthAdapterCapabilities = {
-        hasBuiltInAuthRoutes: false,
-        emailPasswordLogin: false,
-        registration: false,
-        passwordReset: false,
-        sessionManagement: false,
-        profileUpdate: false,
-        emailVerification: false,
-        magicLink: false,
-        enabledProviders: [],
-        ...options.capabilities
-    };
-
-    const resolvedVerifyToken = options.verifyToken
-        ?? (async (token: string) => {
-            // Synthesize a minimal Request so adapters that only implement
-            // verifyRequest still work for WebSocket token verification.
-            const syntheticRequest = new Request("http://localhost/_ws_auth", {
-                headers: { Authorization: `Bearer ${token}` }
-            });
-            return options.verifyRequest(syntheticRequest);
-        });
-
-    return {
-        id: "custom",
-
-        serviceKey: options.serviceKey,
-
-        verifyRequest: options.verifyRequest,
-
-        verifyToken: resolvedVerifyToken,
-
-        userManagement: options.userManagement,
-
-        transformAuthResponse: options.transformAuthResponse,
-
-        getCapabilities() {
-            return defaultCapabilities;
-        }
-    };
-}

package/src/auth/discord-oauth.ts

@@ -1,85 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Discord OAuth2 Provider integration.
- *
- * Uses the authorization code flow. Requires the "identify" and "email"
- * scopes to retrieve the user's email and profile information.
- */
-export function createDiscordProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "discord",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Exchange code for access token
-                const tokenResponse = await fetch("https://discord.com/api/v10/oauth2/token", {
-                    method: "POST",
-                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                    body: new URLSearchParams({
-                        client_id: config.clientId,
-                        client_secret: config.clientSecret,
-                        grant_type: "authorization_code",
-                        code: payload.code,
-                        redirect_uri: payload.redirectUri
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Discord access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-                const accessToken = tokenData.access_token;
-
-                // Fetch user profile
-                const profileResponse = await fetch("https://discord.com/api/v10/users/@me", {
-                    headers: { "Authorization": `Bearer ${accessToken}` }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Discord user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const profileData = await profileResponse.json() as {
-                    id: string;
-                    username: string;
-                    global_name?: string | null;
-                    avatar?: string | null;
-                    email?: string | null;
-                    verified?: boolean;
-                };
-
-                if (!profileData.email) {
-                    logger.error("Discord user has no email (email scope may not have been granted)");
-                    return null;
-                }
-
-                // Build avatar URL
-                let photoUrl: string | null = null;
-                if (profileData.avatar) {
-                    const ext = profileData.avatar.startsWith("a_") ? "gif" : "png";
-                    photoUrl = `https://cdn.discordapp.com/avatars/${profileData.id}/${profileData.avatar}.${ext}?size=256`;
-                }
-
-                return {
-                    providerId: profileData.id,
-                    email: profileData.email,
-                    displayName: profileData.global_name || profileData.username || null,
-                    photoUrl,
-                    emailVerified: profileData.verified === true
-                };
-            } catch (error) {
-                logger.error("Discord OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/facebook-oauth.ts

@@ -1,74 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Facebook / Meta OAuth Provider integration.
- *
- * Uses the authorization code flow to exchange a code for an access token,
- * then fetches user profile from the Facebook Graph API.
- */
-export function createFacebookProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "facebook",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Exchange code for access token
-                const tokenUrl = new URL("https://graph.facebook.com/v19.0/oauth/access_token");
-                tokenUrl.searchParams.set("client_id", config.clientId);
-                tokenUrl.searchParams.set("client_secret", config.clientSecret);
-                tokenUrl.searchParams.set("redirect_uri", payload.redirectUri);
-                tokenUrl.searchParams.set("code", payload.code);
-
-                const tokenResponse = await fetch(tokenUrl.toString());
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Facebook access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-                const accessToken = tokenData.access_token;
-
-                // Fetch user profile with email and profile picture
-                const profileUrl = new URL("https://graph.facebook.com/v19.0/me");
-                profileUrl.searchParams.set("fields", "id,name,email,picture.type(large)");
-                profileUrl.searchParams.set("access_token", accessToken);
-
-                const profileResponse = await fetch(profileUrl.toString());
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Facebook user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const profileData = await profileResponse.json() as {
-                    id: string;
-                    name?: string;
-                    email?: string;
-                    picture?: { data?: { url?: string } };
-                };
-
-                if (!profileData.email) {
-                    logger.error("Facebook user has no email (email permission may not have been granted)");
-                    return null;
-                }
-
-                return {
-                    providerId: profileData.id,
-                    email: profileData.email,
-                    displayName: profileData.name || null,
-                    photoUrl: profileData.picture?.data?.url || null,
-                    emailVerified: true
-                };
-            } catch (error) {
-                logger.error("Facebook OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}