@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/session-routes.ts

@@ -1,353 +0,0 @@
-import { Hono } from "hono";
-import { z } from "zod";
-import { randomBytes } from "crypto";
-import { ApiError } from "../api/errors";
-import { HonoEnv } from "../api/types";
-import { requireAuth } from "./middleware";
-import { logger } from "../utils/logger";
-import { strictAuthLimiter, defaultAuthLimiter } from "./rate-limiter";
-import { hashRefreshToken } from "./jwt";
-import type { AuthModuleConfig } from "./routes";
-import { resolveAuthHooks } from "./auth-hooks";
-import type { CreateUserData } from "./interfaces";
-import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-
-interface SessionRoutesConfig {
-    router: Hono<HonoEnv>;
-    config: AuthModuleConfig;
-    ops: ReturnType<typeof resolveAuthHooks>;
-    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
-    buildAuthResponse: (
-        user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; metadata?: Record<string, unknown> | null },
-        roleIds: string[],
-        accessToken: string,
-        refreshToken: string
-    ) => unknown;
-    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
-        roleIds: string[];
-        accessToken: string;
-        refreshToken: string;
-    }>;
-    applyTransformHook: (
-        response: AuthResponsePayload,
-        method: TransformAuthResponseContext["method"],
-        request: Request,
-        userId: string
-    ) => Promise<AuthResponsePayload>;
-}
-
-export function mountSessionRoutes(opts: SessionRoutesConfig): void {
-    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = opts;
-    const authRepo = config.authRepo;
-
-    const logoutSchema = z.object({
-        refreshToken: z.string().optional()
-    });
-
-    const linkSchema = z.object({
-        email: z.string().email("Invalid email address").max(255),
-        password: z.string().min(1, "Password is required").max(128)
-    });
-
-    const updateProfileSchema = z.object({
-        displayName: z.string().max(255).optional(),
-        photoURL: z.string().url().max(2048).optional()
-    });
-
-    const isEmailConfigured = () => !!(config.emailService && config.emailService.isConfigured());
-
-    /**
-     * POST /auth/logout
-     */
-    router.post("/logout", async (c) => {
-        const { refreshToken } = parseBody(logoutSchema, await c.req.json());
-
-        if (refreshToken) {
-            const tokenHash = hashRefreshToken(refreshToken);
-            await authRepo.deleteRefreshToken(tokenHash);
-        }
-
-        // Call afterLogout hook (fire-and-forget)
-        // Extract userId from the access token if present
-        const authHeader = c.req.header("authorization");
-        if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
-            const { verifyAccessToken } = await import("./jwt");
-            const payload = verifyAccessToken(authHeader.substring(7));
-            if (payload) {
-                ops.afterLogout(payload.userId).catch((err) => {
-                    logger.error("[AuthHooks] afterLogout error", {
-                        error: err instanceof Error ? err.message : err
-                    });
-                });
-            }
-        }
-
-        return c.json({ success: true });
-    });
-
-    /**
-     * GET /auth/sessions
-     * Get active refresh tokens (sessions) for the current user
-     */
-    router.get("/sessions", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const currentRefreshToken = c.req.header("x-refresh-token") as string;
-        const currentTokenHash = currentRefreshToken ? hashRefreshToken(currentRefreshToken) : null;
-
-        const sessions = await authRepo.listRefreshTokensForUser(userCtx.userId);
-
-        const mappedSessions = sessions.map((s) => ({
-            id: s.id,
-            userAgent: s.userAgent,
-            ipAddress: s.ipAddress,
-            createdAt: s.createdAt,
-            isCurrentSession: currentTokenHash ? s.tokenHash === currentTokenHash : false
-        }));
-
-        return c.json({ sessions: mappedSessions });
-    });
-
-    /**
-     * DELETE /auth/sessions
-     * Delete all refresh tokens for the current user (remote logout every device)
-     */
-    router.delete("/sessions", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        await authRepo.deleteAllRefreshTokensForUser(userCtx.userId);
-        return c.json({
-            success: true,
-            message: "All sessions revoked successfully"
-        });
-    });
-
-    /**
-     * DELETE /auth/sessions/:id
-     * Delete a specific refresh token (remote logout)
-     */
-    router.delete("/sessions/:id", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const id = c.req.param("id");
-        if (!id) {
-            throw ApiError.badRequest("Session ID is required", "INVALID_INPUT");
-        }
-
-        await authRepo.deleteRefreshTokenById(id, userCtx.userId);
-        return c.json({
-            success: true,
-            message: "Session revoked successfully"
-        });
-    });
-
-    /**
-     * GET /auth/me
-     * Get current authenticated user
-     */
-    router.get("/me", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const result = await authRepo.getUserWithRoles(userCtx.userId);
-        if (!result) {
-            throw ApiError.notFound("User not found");
-        }
-
-        return c.json({
-            user: {
-                uid: result.user.id,
-                email: result.user.email,
-                displayName: result.user.displayName,
-                photoURL: result.user.photoUrl,
-                emailVerified: result.user.emailVerified,
-                roles: result.roles.map((r) => r.id),
-                metadata: result.user.metadata ?? {}
-            }
-        });
-    });
-
-    /**
-     * PATCH /auth/me
-     * Update current authenticated user profile
-     */
-    router.patch("/me", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const { displayName, photoURL } = parseBody(updateProfileSchema, await c.req.json());
-
-        const updatedUser = await authRepo.updateUser(userCtx.userId, {
-            displayName: displayName !== undefined ? displayName : undefined,
-            photoUrl: photoURL !== undefined ? photoURL : undefined
-        });
-
-        if (!updatedUser) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const result = await authRepo.getUserWithRoles(userCtx.userId);
-        if (!result) {
-            throw ApiError.notFound("User not found");
-        }
-
-        return c.json({
-            user: {
-                uid: result.user.id,
-                email: result.user.email,
-                displayName: result.user.displayName,
-                photoURL: result.user.photoUrl,
-                emailVerified: result.user.emailVerified,
-                roles: result.roles.map((r) => r.id),
-                metadata: result.user.metadata ?? {}
-            }
-        });
-    });
-
-    /**
-     * GET /auth/config
-     * Get public auth configuration
-     */
-    router.get("/config", defaultAuthLimiter, async (c) => {
-        let needsSetup: boolean;
-        if (config.isBootstrapCompleted) {
-            needsSetup = !(await config.isBootstrapCompleted());
-        } else {
-            const allUsers = await authRepo.listUsers();
-            needsSetup = allUsers.length === 0;
-        }
-
-        const registrationAllowed = needsSetup || !!config.allowRegistration;
-        const enabledProviders = (config.oauthProviders || []).map((p) => p.id);
-
-        return c.json({
-            needsSetup,
-            registrationEnabled: registrationAllowed,
-            emailServiceEnabled: isEmailConfigured(),
-            magicLinkEnabled: !!config.enableMagicLink && isEmailConfigured(),
-            enabledProviders
-        });
-    });
-
-    /**
-     * POST /auth/anonymous
-     * Create an anonymous user with temporary credentials
-     */
-    router.post("/anonymous", strictAuthLimiter, async (c) => {
-        const anonId = randomBytes(16).toString("hex");
-        const anonEmail = `anon_${anonId.slice(0, 8)}@anonymous.local`;
-
-        let createData: CreateUserData = {
-            email: anonEmail,
-            emailVerified: false,
-            isAnonymous: true
-        };
-
-        if (ops.beforeUserCreate) {
-            createData = await ops.beforeUserCreate(createData);
-        }
-
-        const user = await authRepo.createUser(createData);
-
-        // Assign default role (follow register route pattern, but never auto-admin)
-        if (config.defaultRole) {
-            await authRepo.assignDefaultRole(user.id, config.defaultRole);
-        }
-
-        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
-            user.id,
-            c.req.header("user-agent") || "unknown",
-            c.req.header("x-forwarded-for") || "unknown"
-        );
-
-        // Fire afterUserCreate hook
-        if (ops.afterUserCreate) {
-            ops.afterUserCreate(user).catch((err) => {
-                logger.error("[AuthHooks] afterUserCreate error", {
-                    error: err instanceof Error ? err.message : err
-                });
-            });
-        }
-
-        // Fire onAuthenticated hook
-        if (ops.onAuthenticated) {
-            ops.onAuthenticated(user, "anonymous").catch((err) => {
-                logger.error("[AuthHooks] onAuthenticated error", {
-                    error: err instanceof Error ? err.message : err
-                });
-            });
-        }
-
-        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken) as AuthResponsePayload;
-        const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
-        return c.json(finalResponse, 201);
-    });
-
-    /**
-     * POST /auth/anonymous/link
-     * Upgrade an anonymous user to a permanent account with email/password
-     */
-    router.post("/anonymous/link", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const user = await authRepo.getUserById(userCtx.userId);
-        if (!user?.isAnonymous) {
-            throw ApiError.badRequest("User is not anonymous", "NOT_ANONYMOUS");
-        }
-
-        const { email, password } = parseBody(linkSchema, await c.req.json());
-
-        // Validate password strength
-        const passwordValidation = ops.validatePasswordStrength(password);
-        if (!passwordValidation.valid) {
-            throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
-        }
-
-        // Check if email is already taken
-        const existingUser = await authRepo.getUserByEmail(email.toLowerCase());
-        if (existingUser) {
-            throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
-        }
-
-        // Hash password
-        const passwordHash = await ops.hashPassword(password);
-
-        // Update user: set email, password, remove anonymous flag
-        const updatedUser = await authRepo.updateUser(user.id, {
-            email: email.toLowerCase(),
-            passwordHash,
-            isAnonymous: false
-        });
-
-        if (!updatedUser) {
-            throw ApiError.notFound("User not found");
-        }
-
-        // Generate new tokens with updated identity
-        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
-            user.id,
-            c.req.header("user-agent") || "unknown",
-            c.req.header("x-forwarded-for") || "unknown"
-        );
-
-        const authResponse = buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken) as AuthResponsePayload;
-        const finalResponse = await applyTransformHook(authResponse, "anonymous", c.req.raw, user.id);
-        return c.json(finalResponse);
-    });
-}

package/src/auth/slack-oauth.ts

@@ -1,73 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
- * Uses the OpenID Connect flow with the "openid,email,profile" scopes.
- */
-export function createSlackProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "slack",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                const tokenResponse = await fetch("https://slack.com/api/openid.connect.token", {
-                    method: "POST",
-                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                    body: new URLSearchParams({
-                        client_id: config.clientId,
-                        client_secret: config.clientSecret,
-                        code: payload.code,
-                        redirect_uri: payload.redirectUri,
-                        grant_type: "authorization_code"
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Slack access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { ok: boolean; access_token?: string; error?: string };
-                if (!tokenData.ok || !tokenData.access_token) {
-                    logger.error("Slack token exchange failed", { detail: tokenData.error });
-                    return null;
-                }
-
-                const profileResponse = await fetch("https://slack.com/api/openid.connect.userInfo", {
-                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Slack user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const p = await profileResponse.json() as {
-                    ok: boolean; sub: string; name?: string;
-                    email?: string; picture?: string; email_verified?: boolean;
-                };
-
-                if (!p.ok || !p.email) {
-                    logger.error("Slack user has no email");
-                    return null;
-                }
-
-                return {
-                    providerId: p.sub,
-                    email: p.email,
-                    displayName: p.name || null,
-                    photoUrl: p.picture || null,
-                    emailVerified: p.email_verified === true
-                };
-            } catch (error) {
-                logger.error("Slack OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/spotify-oauth.ts

@@ -1,69 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Spotify OAuth Provider integration.
- * Uses the authorization code flow with the "user-read-email" scope.
- */
-export function createSpotifyProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "spotify",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-
-                const tokenResponse = await fetch("https://accounts.spotify.com/api/token", {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/x-www-form-urlencoded",
-                        "Authorization": `Basic ${basicAuth}`
-                    },
-                    body: new URLSearchParams({
-                        grant_type: "authorization_code",
-                        code: payload.code,
-                        redirect_uri: payload.redirectUri
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Spotify access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-
-                const profileResponse = await fetch("https://api.spotify.com/v1/me", {
-                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Spotify user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const p = await profileResponse.json() as {
-                    id: string; display_name?: string | null;
-                    email?: string; images?: Array<{ url: string }>;
-                };
-
-                if (!p.email) { logger.error("Spotify user has no email"); return null; }
-
-                return {
-                    providerId: p.id,
-                    email: p.email,
-                    displayName: p.display_name || null,
-                    photoUrl: p.images?.[0]?.url || null,
-                    emailVerified: true
-                };
-            } catch (error) {
-                logger.error("Spotify OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/twitter-oauth.ts

@@ -1,128 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Twitter/X OAuth 2.0 Provider integration.
- *
- * Uses OAuth 2.0 with PKCE (authorization code flow). The frontend must include
- * the PKCE `code_verifier` when sending the authorization code.
- *
- * Twitter API v2 requires the "tweet.read" and "users.read" scopes at minimum,
- * plus "offline.access" if refresh tokens are needed on Twitter's side.
- */
-export function createTwitterProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{
-            code: string;
-            redirectUri: string;
-            codeVerifier: string;
-        }> {
-    return {
-        id: "twitter",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required"),
-            codeVerifier: z.string().min(1, "PKCE code verifier is required")
-        }),
-        verify: async (payload: {
-            code: string;
-            redirectUri: string;
-            codeVerifier: string;
-        }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Twitter OAuth 2.0 uses Basic auth for the token endpoint
-                const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
-
-                // Exchange code for access token
-                const tokenResponse = await fetch("https://api.twitter.com/2/oauth2/token", {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/x-www-form-urlencoded",
-                        "Authorization": `Basic ${basicAuth}`
-                    },
-                    body: new URLSearchParams({
-                        code: payload.code,
-                        grant_type: "authorization_code",
-                        redirect_uri: payload.redirectUri,
-                        code_verifier: payload.codeVerifier
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Twitter access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-                const accessToken = tokenData.access_token;
-
-                // Fetch user profile from Twitter API v2
-                const profileResponse = await fetch(
-                    "https://api.twitter.com/2/users/me?user.fields=id,name,username,profile_image_url",
-                    {
-                        headers: { "Authorization": `Bearer ${accessToken}` }
-                    }
-                );
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Twitter user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const profileResult = await profileResponse.json() as {
-                    data: {
-                        id: string;
-                        name: string;
-                        username: string;
-                        profile_image_url?: string;
-                    };
-                };
-
-                const profileData = profileResult.data;
-
-                // Twitter does NOT expose email via API v2 by default.
-                // It requires elevated access. If we can't get an email, we
-                // generate a placeholder email — the user can update it later.
-                // For apps with elevated access, fetch from v1.1 endpoint.
-                let email: string | null = null;
-                let emailVerified = false;
-                try {
-                    const emailResponse = await fetch(
-                        "https://api.twitter.com/1.1/account/verify_credentials.json?include_email=true",
-                        {
-                            headers: { "Authorization": `Bearer ${accessToken}` }
-                        }
-                    );
-                    if (emailResponse.ok) {
-                        const emailData = await emailResponse.json() as { email?: string };
-                        email = emailData.email || null;
-                        if (email) {
-                            emailVerified = true;
-                        }
-                    }
-                } catch {
-                    // Elevated access not available — fall through
-                }
-
-                if (!email) {
-                    // Construct a deterministic placeholder email from the Twitter user ID.
-                    // This allows the account to be created and linked; the user should
-                    // update their email through the profile settings.
-                    email = `${profileData.id}@twitter.placeholder.rebase`;
-                    // Placeholder emails are NOT verified — prevents auto-linking to existing accounts
-                    emailVerified = false;
-                }
-
-                return {
-                    providerId: profileData.id,
-                    email,
-                    displayName: profileData.name || profileData.username || null,
-                    photoUrl: profileData.profile_image_url?.replace("_normal", "_400x400") || null,
-                    emailVerified
-                };
-            } catch (error) {
-                logger.error("Twitter OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/collections/BackendCollectionRegistry.ts

@@ -1,20 +0,0 @@
-import { CollectionRegistry } from "@rebasepro/common";
-import { CollectionRegistryInterface } from "../db/interfaces";
-import { EntityCollection } from "@rebasepro/types";
-
-/**
- * Backend-agnostic collection registry.
- * Satisfies CollectionRegistryInterface through inheritance from CollectionRegistry.
- */
-export class BackendCollectionRegistry extends CollectionRegistry implements CollectionRegistryInterface {
-
-    /**
-     * Get the available relation keys for a given collection path.
-     * Maps from the collection's relation property names to the relation names.
-     */
-    getRelationKeysForCollection(collectionPath: string): string[] {
-        const collection = this.getCollectionByPath(collectionPath) as (EntityCollection & { relations?: { relationName?: string, localKey?: string }[] }) | undefined;
-        if (!collection?.relations) return [];
-        return collection.relations.map(r => (r.relationName || r.localKey || "") as string).filter(Boolean);
-    }
-}