@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/rate-limiter.ts

@@ -1,225 +0,0 @@
-import { MiddlewareHandler } from "hono";
-import { HonoEnv } from "../api/types";
-
-/**
- * In-memory sliding-window rate limiter for Hono.
- *
- * Suitable for single-instance and moderate-scale deployments.
- * For multi-instance setups, consider a shared store
- * (e.g. PostgreSQL-backed counters or an external rate-limit service).
- */
-
-interface RateLimitEntry {
-    timestamps: number[];
-}
-
-interface RateLimiterOptions {
-    /** Time window in milliseconds (default: 15 minutes) */
-    windowMs?: number;
-    /** Maximum requests per window (default: 100) */
-    limit?: number;
-    /** Key generator function. Defaults to IP-based keying. */
-    keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
-    /** Custom message for rate limit responses */
-    message?: string;
-}
-
-/**
- * Create a rate-limiting middleware.
- *
- * Uses a sliding window algorithm: only timestamps within the last
- * `windowMs` milliseconds are counted. Old entries are garbage-collected
- * every `windowMs` to prevent unbounded memory growth.
- */
-export function createRateLimiter(options: RateLimiterOptions = {}): MiddlewareHandler<HonoEnv> {
-    const {
-        windowMs = 15 * 60 * 1000,
-        limit = 100,
-        keyGenerator = defaultKeyGenerator,
-        message = "Too many requests, please try again later."
-    } = options;
-
-    const store = new Map<string, RateLimitEntry>();
-
-    // Periodic cleanup to prevent memory leak from expired entries
-    const cleanupInterval = setInterval(() => {
-        const now = Date.now();
-        for (const [key, entry] of store.entries()) {
-            entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
-            if (entry.timestamps.length === 0) {
-                store.delete(key);
-            }
-        }
-    }, windowMs);
-
-    // Allow the Node.js process to exit even if the interval is still running
-    if (cleanupInterval.unref) {
-        cleanupInterval.unref();
-    }
-
-    return async (c, next) => {
-        const key = keyGenerator(c);
-        const now = Date.now();
-
-        let entry = store.get(key);
-        if (!entry) {
-            entry = { timestamps: [] };
-            store.set(key, entry);
-        }
-
-        // Remove timestamps outside the current window
-        entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
-
-        if (entry.timestamps.length >= limit) {
-            const retryAfterMs = entry.timestamps[0] + windowMs - now;
-            const retryAfterSec = Math.ceil(retryAfterMs / 1000);
-
-            c.header("Retry-After", String(retryAfterSec));
-            c.header("X-RateLimit-Limit", String(limit));
-            c.header("X-RateLimit-Remaining", "0");
-            c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1000)));
-
-            return c.json({
-                error: {
-                    message,
-                    code: "RATE_LIMITED"
-                }
-            }, 429);
-        }
-
-        entry.timestamps.push(now);
-
-        // Set rate limit headers
-        c.header("X-RateLimit-Limit", String(limit));
-        c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
-
-        return next();
-    };
-}
-
-/**
- * Default key generator: extract client IP from standard headers.
- */
-function defaultKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string {
-    const forwardedFor = c.req.header("x-forwarded-for");
-    if (forwardedFor) {
-        const ips = forwardedFor.split(",");
-        // The leftmost IP can be easily spoofed by the client in the initial request.
-        // Reverse proxies append to the right. We take the rightmost IP as the most
-        // reliable indicator of the true client IP (the one closest to our server).
-        return ips[ips.length - 1].trim();
-    }
-    return c.req.header("x-real-ip") || "unknown";
-}
-
-/**
- * Pre-configured rate limiter for general auth endpoints (login, register).
- * 200 requests per 15 minutes per IP.
- */
-export const defaultAuthLimiter = createRateLimiter({
-    windowMs: 15 * 60 * 1000,
-    limit: 200,
-    message: "Too many authentication attempts, please try again later."
-});
-
-/**
- * Pre-configured strict rate limiter for sensitive endpoints (password reset, verification).
- * 50 requests per 15 minutes per IP.
- */
-export const strictAuthLimiter = createRateLimiter({
-    windowMs: 15 * 60 * 1000,
-    limit: 50,
-    message: "Too many requests to this sensitive endpoint, please try again later."
-});
-
-/**
- * Key generator for API-key-based rate limiting.
- *
- * Uses the API key ID (from `c.get("apiKey")`) as the rate limit key.
- * Falls back to IP-based keying when the request is not authenticated
- * via an API key.
- */
-export function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string {
-    const apiKey = c.get("apiKey") as { id: string } | undefined;
-    if (apiKey) {
-        return `api-key:${apiKey.id}`;
-    }
-    return defaultKeyGenerator(c);
-}
-
-/**
- * Create a rate limiter specifically for API key requests.
- *
- * When a request is authenticated via an API key that has a `rate_limit`
- * configured, this limiter enforces per-key limits using the key's ID
- * as the rate limit bucket.
- *
- * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
- * @param windowMs     - Time window in milliseconds (default: 15 minutes).
- */
-export function createApiKeyRateLimiter(
-    defaultLimit = 1000,
-    windowMs = 15 * 60 * 1000
-): MiddlewareHandler<HonoEnv> {
-    // We maintain a single shared store keyed by API key ID.
-    // The actual limit is resolved per-request from the key's metadata.
-    const store = new Map<string, { timestamps: number[] }>();
-
-    const cleanupInterval = setInterval(() => {
-        const now = Date.now();
-        for (const [key, entry] of store.entries()) {
-            entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
-            if (entry.timestamps.length === 0) {
-                store.delete(key);
-            }
-        }
-    }, windowMs);
-
-    if (cleanupInterval.unref) {
-        cleanupInterval.unref();
-    }
-
-    return async (c, next) => {
-        const apiKey = c.get("apiKey") as { id: string; rate_limit: number | null } | undefined;
-        if (!apiKey) {
-            // Not an API key request — skip this limiter
-            return next();
-        }
-
-        const limit = apiKey.rate_limit ?? defaultLimit;
-        const key = `api-key:${apiKey.id}`;
-        const now = Date.now();
-
-        let entry = store.get(key);
-        if (!entry) {
-            entry = { timestamps: [] };
-            store.set(key, entry);
-        }
-
-        entry.timestamps = entry.timestamps.filter(t => now - t < windowMs);
-
-        if (entry.timestamps.length >= limit) {
-            const retryAfterMs = entry.timestamps[0] + windowMs - now;
-            const retryAfterSec = Math.ceil(retryAfterMs / 1000);
-
-            c.header("Retry-After", String(retryAfterSec));
-            c.header("X-RateLimit-Limit", String(limit));
-            c.header("X-RateLimit-Remaining", "0");
-            c.header("X-RateLimit-Reset", String(Math.ceil((now + retryAfterMs) / 1000)));
-
-            return c.json({
-                error: {
-                    message: "API key rate limit exceeded, please try again later.",
-                    code: "RATE_LIMITED"
-                }
-            }, 429);
-        }
-
-        entry.timestamps.push(now);
-
-        c.header("X-RateLimit-Limit", String(limit));
-        c.header("X-RateLimit-Remaining", String(limit - entry.timestamps.length));
-
-        return next();
-    };
-}

package/src/auth/reset-password-admin.ts

@@ -1,160 +0,0 @@
-/**
- * Standalone admin endpoint for resetting a user's password.
- *
- * Hook resolution order:
- * 1. Collection-level hook (`auth.onResetPassword` on the collection)
- * 2. Backend-level hook (`AuthHooks.onAdminResetPassword`)
- * 3. Built-in default (send reset email, or generate temp password)
- */
-
-import { Hono } from "hono";
-import { ApiError, errorHandler } from "../api/errors";
-import type { AuthRepository } from "./interfaces";
-import { createRequireAuth, requireAdmin } from "./middleware";
-import type { AuthHooks } from "./auth-hooks";
-import { resolveAuthHooks } from "./auth-hooks";
-import { generateSecurePassword, generateSecureToken, hashToken } from "./admin-user-ops";
-import { getPasswordResetTemplate } from "../email/templates";
-import type { EmailService, EmailConfig } from "../email";
-import type { HonoEnv } from "../api/types";
-import type { AuthCollectionConfig } from "@rebasepro/types";
-import { logger } from "../utils/logger";
-
-export interface ResetPasswordRouteConfig {
-    authRepo: AuthRepository;
-    emailService?: EmailService;
-    emailConfig?: EmailConfig;
-    serviceKey?: string;
-    authHooks?: AuthHooks;
-    /** The parsed auth config from the collection, if available. */
-    collectionAuthConfig?: AuthCollectionConfig;
-}
-
-/**
- * Create a standalone admin route for resetting user passwords.
- *
- * Mounts: POST /users/:userId/reset-password
- */
-export function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono<HonoEnv> {
-    const router = new Hono<HonoEnv>();
-    const authRepo = config.authRepo;
-    const { emailService, emailConfig, collectionAuthConfig } = config;
-    const ops = resolveAuthHooks(config.authHooks);
-
-    router.onError(errorHandler);
-    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
-
-    router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const existing = await authRepo.getUserById(userId);
-        if (!existing) {
-            throw ApiError.notFound("User not found");
-        }
-
-        let invitationSent = false;
-        let temporaryPassword: string | undefined;
-
-        // Parse optional body — if a password is provided, set it directly
-        const body = await c.req.json().catch(() => ({}));
-
-        if (body.password) {
-            const password = body.password as string;
-            const validation = ops.validatePasswordStrength(password);
-            if (!validation.valid) {
-                throw ApiError.badRequest(
-                    `Password too weak: ${validation.errors.join(", ")}`
-                );
-            }
-            const passwordHash = await ops.hashPassword(password);
-            await authRepo.updatePassword(existing.id, passwordHash);
-            temporaryPassword = undefined;
-            invitationSent = false;
-        }
-        // 1. Collection-level hook (closest to the data)
-        else if (collectionAuthConfig?.onResetPassword) {
-            const isEmailConfigured = !!(emailService && emailService.isConfigured());
-            const hookResult = await collectionAuthConfig.onResetPassword(existing.id, {
-                hashPassword: (password: string) => ops.hashPassword(password),
-                sendEmail: isEmailConfigured
-                    ? (options) => emailService!.send(options)
-                    : undefined,
-                emailConfigured: isEmailConfigured,
-                appName: emailConfig?.appName || "Rebase",
-                resetPasswordUrl: emailConfig?.resetPasswordUrl || ""
-            });
-            temporaryPassword = hookResult.temporaryPassword;
-            invitationSent = hookResult.invitationSent ?? false;
-        }
-        // 2. Backend-level hook (global override)
-        else if (ops.onAdminResetPassword) {
-            const hookResult = await ops.onAdminResetPassword(existing.id, {
-                authRepo,
-                emailService,
-                emailConfig
-            });
-            temporaryPassword = hookResult.temporaryPassword;
-            invitationSent = hookResult.invitationSent ?? false;
-        }
-        // 3. Built-in default
-        else {
-            const isEmailConfigured = !!(emailService && emailService.isConfigured());
-
-            if (isEmailConfigured) {
-                try {
-                    const token = generateSecureToken();
-                    const tokenHash = hashToken(token);
-                    const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
-
-                    await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
-
-                    const baseUrl = emailConfig?.resetPasswordUrl || "";
-                    const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
-
-                    const appName = emailConfig?.appName || "Rebase";
-                    const templateFn = emailConfig?.templates?.passwordReset;
-                    const emailContent = templateFn
-                        ? templateFn(setPasswordUrl, { email: existing.email,
-displayName: existing.displayName })
-                        : getPasswordResetTemplate(setPasswordUrl, { email: existing.email,
-displayName: existing.displayName }, appName);
-
-                    await emailService!.send({
-                        to: existing.email,
-                        subject: emailContent.subject,
-                        html: emailContent.html,
-                        text: emailContent.text
-                    });
-                    invitationSent = true;
-                } catch (emailError: unknown) {
-                    logger.error("Failed to send reset email", { error: emailError instanceof Error ? emailError.message : emailError });
-                    // Fall back to returning the temporary password
-                    const clearPassword = generateSecurePassword();
-                    const passwordHash = await ops.hashPassword(clearPassword);
-                    await authRepo.updatePassword(existing.id, passwordHash);
-                    temporaryPassword = clearPassword;
-                }
-            } else {
-                // No email service — generate password, set it, and return one-time
-                const clearPassword = generateSecurePassword();
-                const passwordHash = await ops.hashPassword(clearPassword);
-                await authRepo.updatePassword(existing.id, passwordHash);
-                temporaryPassword = clearPassword;
-            }
-        }
-
-        const userRoles = await authRepo.getUserRoleIds(existing.id);
-
-        return c.json({
-            user: {
-                uid: existing.id,
-                email: existing.email,
-                displayName: existing.displayName,
-                roles: userRoles
-            },
-            invitationSent,
-            ...(temporaryPassword ? { temporaryPassword } : {})
-        }, 200);
-    });
-
-    return router;
-}

package/src/auth/rls-scope.ts

@@ -1,58 +0,0 @@
-/**
- * Shared RLS (Row-Level Security) scoping helper.
- *
- * DataDrivers may implement a `withAuth()` method that returns a scoped
- * clone of the driver with RLS policies applied for the given user.
- * This is database-specific (e.g. Postgres SET LOCAL ROLE) and is not
- * part of the core DataDriver interface.
- *
- * This module provides the shared duck-typing logic used by the
- * adapter-aware middleware.
- *
- * @module
- */
-
-import type { DataDriver } from "@rebasepro/types";
-
-/**
- * A DataDriver that supports RLS scoping via `withAuth()`.
- *
- * This is not part of the public DataDriver interface because not all
- * database implementations support RLS. Drivers that do (e.g. Postgres)
- * extend DataDriver with this method.
- */
-interface RLSScopedDriver extends DataDriver {
-    withAuth(user: { uid: string; roles?: string[] }): Promise<DataDriver>;
-}
-
-/**
- * Returns true if the driver supports RLS scoping via `withAuth()`.
- */
-function isRLSScopedDriver(driver: DataDriver): driver is RLSScopedDriver {
-    return "withAuth" in driver && typeof (driver as Record<string, unknown>).withAuth === "function";
-}
-
-/**
- * Scope a DataDriver via `withAuth()` for RLS.
- *
- * SECURITY: If `withAuth()` is available but fails, the error is re-thrown
- * so the request is **denied** rather than proceeding with unscoped access
- * (fail-closed behavior).
- *
- * If the driver does not support RLS, the original driver is returned.
- *
- * @param driver - The DataDriver to scope.
- * @param user   - The authenticated user identity for RLS.
- * @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
- */
-export async function scopeDataDriver(
-    driver: DataDriver,
-    user: { uid: string; roles?: string[] }
-): Promise<DataDriver> {
-    if (isRLSScopedDriver(driver)) {
-        // Fail closed — do NOT catch and swallow errors here.
-        // If RLS scoping fails the request must be rejected.
-        return await driver.withAuth(user);
-    }
-    return driver;
-}