@rebasepro/server-mongo 0.23.0 → 0.24.0

package/dist/auth/services.d.ts

@@ -4,15 +4,13 @@ export interface MongoDoc {
     _id?: string;
     [key: string]: any;
 }
-import { UserRepository, RoleRepository, TokenRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo } from "@rebasepro/server";
-export type Role = RoleData;
+import { UserRepository, TokenRepository, AuthRepository, UserData, CreateUserData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo } from "@rebasepro/server";
 export declare class MongoUserService implements UserRepository {
     private db;
     constructor(db: Db);
     private get collection();
     private get identitiesCollection();
     private get userRolesCollection();
-    private get rolesCollection();
     createUser(data: CreateUserData): Promise<UserData>;
     getUserById(id: string): Promise<UserData | null>;
     getUserByEmail(email: string): Promise<UserData | null>;
@@ -35,25 +33,14 @@ export declare class MongoUserService implements UserRepository {
     setEmailVerified(id: string, verified: boolean): Promise<void>;
     setVerificationToken(id: string, token: string | null): Promise<void>;
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    getUserRoles(uid: string): Promise<RoleData[]>;
     getUserRoleIds(uid: string): Promise<string[]>;
     setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     assignDefaultRole(uid: string, roleId: string): Promise<void>;
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: RoleData[];
+        roles: string[];
     } | null>;
 }
-export declare class MongoRoleService implements RoleRepository {
-    private db;
-    constructor(db: Db);
-    private get collection();
-    getRoleById(id: string): Promise<RoleData | null>;
-    listRoles(): Promise<RoleData[]>;
-    createRole(data: CreateRoleData): Promise<RoleData>;
-    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
-    deleteRole(id: string): Promise<void>;
-}
 export declare class MongoRefreshTokenService {
     private db;
     constructor(db: Db);
@@ -113,7 +100,6 @@ export declare class MongoTokenRepository implements TokenRepository {
 export declare class MongoAuthRepository implements AuthRepository {
     private db;
     private userService;
-    private roleService;
     private tokenRepository;
     constructor(db: Db);
     createUser(data: CreateUserData): Promise<UserData>;
@@ -130,19 +116,13 @@ export declare class MongoAuthRepository implements AuthRepository {
     setEmailVerified(id: string, verified: boolean): Promise<void>;
     setVerificationToken(id: string, token: string | null): Promise<void>;
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    getUserRoles(uid: string): Promise<RoleData[]>;
     getUserRoleIds(uid: string): Promise<string[]>;
     setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     assignDefaultRole(uid: string, roleId: string): Promise<void>;
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: RoleData[];
+        roles: string[];
     } | null>;
-    getRoleById(id: string): Promise<RoleData | null>;
-    listRoles(): Promise<RoleData[]>;
-    createRole(data: CreateRoleData): Promise<RoleData>;
-    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
-    deleteRole(id: string): Promise<void>;
     createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
     markRefreshTokenRotated(tokenHash: string): Promise<void>;
     revokeRefreshTokenSession(sessionId: string): Promise<void>;

package/dist/{ensure-collections-Bl12bSwO.js → ensure-collections-DHTVMlxf.js}

@@ -1,50 +1,6 @@
 import { logger } from "@rebasepro/server";
 //#region src/auth/ensure-collections.ts
 /**
-* Default roles to seed on first run
-*/
-var DEFAULT_ROLES = [
-	{
-		_id: "admin",
-		id: "admin",
-		name: "Admin",
-		isAdmin: true,
-		defaultPermissions: {
-			read: true,
-			create: true,
-			edit: true,
-			delete: true
-		},
-		createdAt: /* @__PURE__ */ new Date()
-	},
-	{
-		_id: "editor",
-		id: "editor",
-		name: "Editor",
-		isAdmin: false,
-		defaultPermissions: {
-			read: true,
-			create: true,
-			edit: true,
-			delete: true
-		},
-		createdAt: /* @__PURE__ */ new Date()
-	},
-	{
-		_id: "viewer",
-		id: "viewer",
-		name: "Viewer",
-		isAdmin: false,
-		defaultPermissions: {
-			read: true,
-			create: false,
-			edit: false,
-			delete: false
-		},
-		createdAt: /* @__PURE__ */ new Date()
-	}
-];
-/**
 * Indexes created by releases up to 0.13.0, on snake_case field names the auth
 * services never wrote.
 *
@@ -96,7 +52,6 @@ async function ensureAuthCollectionsExist(db) {
 		const resetTokens = db.collection("rebase_password_reset_tokens");
 		await resetTokens.createIndex({ tokenHash: 1 }, { unique: true });
 		await resetTokens.createIndex({ uid: 1 });
-		await seedDefaultRoles(db);
 		logger.info("✅ MongoDB Auth collections ready");
 	} catch (error) {
 		logger.error("❌ Failed to set up MongoDB auth collections", { error });
@@ -113,18 +68,7 @@ async function dropLegacyIndexes(db) {
 		} catch {}
 	}
 }
-async function seedDefaultRoles(db) {
-	const roles = db.collection("rebase_roles");
-	const count = await roles.countDocuments();
-	if (count > 0) {
-		logger.info(`📋 Found ${count} existing roles`);
-		return;
-	}
-	logger.info("🌱 Seeding default roles...");
-	for (const role of DEFAULT_ROLES) await roles.updateOne({ id: role.id }, { $setOnInsert: role }, { upsert: true });
-	logger.info("✅ Default roles created: admin, editor, viewer");
-}
 //#endregion
 export { ensureAuthCollectionsExist };
 
-//# sourceMappingURL=ensure-collections-Bl12bSwO.js.map
+//# sourceMappingURL=ensure-collections-DHTVMlxf.js.map

package/dist/ensure-collections-DHTVMlxf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-collections-DHTVMlxf.js","names":[],"sources":["../src/auth/ensure-collections.ts"],"sourcesContent":["import { Db } from \"mongodb\";\nimport { logger } from \"@rebasepro/server\";\n\n/**\n * Indexes created by releases up to 0.13.0, on snake_case field names the auth\n * services never wrote.\n *\n * MongoDB indexes an absent field as `null`, so a unique index whose every key\n * component is always missing admits exactly **one** document per collection:\n * the second login on the whole deployment failed with `E11000`, as did the\n * second role assignment and the second outstanding password-reset token.\n * Dropping them is therefore part of the fix, not tidying — creating the\n * correct index alongside a broken one leaves the deployment just as broken.\n *\n * `{user_id, user_agent, ip_address}` has a second reason to go: it is the\n * reverted Postgres constraint. `MongoRefreshTokenService.createToken` explains\n * why evicting by that triple signs a second browser out; the unique index\n * expressing the same rule was left behind here.\n */\nconst LEGACY_INDEX_NAMES: Record<string, string[]> = {\n    rebase_user_identities: [\"provider_1_provider_id_1\", \"user_id_1\"],\n    rebase_user_roles: [\"user_id_1_role_id_1\", \"user_id_1\"],\n    rebase_refresh_tokens: [\"token_hash_1\", \"user_id_1_user_agent_1_ip_address_1\", \"user_id_1\"],\n    rebase_password_reset_tokens: [\"token_hash_1\", \"user_id_1\"]\n};\n\nexport async function ensureAuthCollectionsExist(db: Db): Promise<void> {\n    logger.info(\"🔍 Checking MongoDB auth collections and indexes...\");\n\n    try {\n        await dropLegacyIndexes(db);\n\n        // Every key below is a field `auth/services.ts` actually writes —\n        // camelCase, matching the documents. Verified by\n        // `test/MongoAuthServices.test.ts`, which now runs this function.\n\n        // Users\n        const users = db.collection(\"rebase_users\");\n        await users.createIndex({ email: 1 }, { unique: true });\n        await users.createIndex({ id: 1 });\n\n        // User Identities\n        const identities = db.collection(\"rebase_user_identities\");\n        await identities.createIndex({ provider: 1,\nproviderId: 1 }, { unique: true });\n        await identities.createIndex({ uid: 1 });\n\n        // User Roles (junction collection)\n        const userRoles = db.collection(\"rebase_user_roles\");\n        await userRoles.createIndex({ uid: 1,\nroleId: 1 }, { unique: true });\n        await userRoles.createIndex({ roleId: 1 });\n\n        // Refresh Tokens. No unique index on (uid, userAgent, ipAddress):\n        // tokens of one sign-in accumulate under a shared sessionId.\n        const refreshTokens = db.collection(\"rebase_refresh_tokens\");\n        await refreshTokens.createIndex({ tokenHash: 1 }, { unique: true });\n        await refreshTokens.createIndex({ uid: 1 });\n        await refreshTokens.createIndex({ sessionId: 1 });\n\n        // Password Reset Tokens\n        const resetTokens = db.collection(\"rebase_password_reset_tokens\");\n        await resetTokens.createIndex({ tokenHash: 1 }, { unique: true });\n        await resetTokens.createIndex({ uid: 1 });\n\n        logger.info(\"✅ MongoDB Auth collections ready\");\n    } catch (error) {\n        // Not swallowed. Every index here is load-bearing for auth — a boot\n        // that logs this and carries on is a deployment whose second login\n        // fails, with a green boot log to say nothing is wrong.\n        logger.error(\"❌ Failed to set up MongoDB auth collections\", { error: error });\n        throw error;\n    }\n}\n\n/** Drop the indexes of {@link LEGACY_INDEX_NAMES} that this database still has. */\nasync function dropLegacyIndexes(db: Db): Promise<void> {\n    for (const [collectionName, indexNames] of Object.entries(LEGACY_INDEX_NAMES)) {\n        const collection = db.collection(collectionName);\n        for (const indexName of indexNames) {\n            try {\n                await collection.dropIndex(indexName);\n                logger.info(`🧹 Dropped stale auth index ${collectionName}.${indexName}`);\n            } catch {\n                // NamespaceNotFound / IndexNotFound — nothing to drop here.\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,IAAM,qBAA+C;CACjD,wBAAwB,CAAC,4BAA4B,WAAW;CAChE,mBAAmB,CAAC,uBAAuB,WAAW;CACtD,uBAAuB;EAAC;EAAgB;EAAuC;CAAW;CAC1F,8BAA8B,CAAC,gBAAgB,WAAW;AAC9D;AAEA,eAAsB,2BAA2B,IAAuB;CACpE,OAAO,KAAK,qDAAqD;CAEjE,IAAI;EACA,MAAM,kBAAkB,EAAE;EAO1B,MAAM,QAAQ,GAAG,WAAW,cAAc;EAC1C,MAAM,MAAM,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACtD,MAAM,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC;EAGjC,MAAM,aAAa,GAAG,WAAW,wBAAwB;EACzD,MAAM,WAAW,YAAY;GAAE,UAAU;GACjD,YAAY;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACzB,MAAM,WAAW,YAAY,EAAE,KAAK,EAAE,CAAC;EAGvC,MAAM,YAAY,GAAG,WAAW,mBAAmB;EACnD,MAAM,UAAU,YAAY;GAAE,KAAK;GAC3C,QAAQ;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACrB,MAAM,UAAU,YAAY,EAAE,QAAQ,EAAE,CAAC;EAIzC,MAAM,gBAAgB,GAAG,WAAW,uBAAuB;EAC3D,MAAM,cAAc,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EAClE,MAAM,cAAc,YAAY,EAAE,KAAK,EAAE,CAAC;EAC1C,MAAM,cAAc,YAAY,EAAE,WAAW,EAAE,CAAC;EAGhD,MAAM,cAAc,GAAG,WAAW,8BAA8B;EAChE,MAAM,YAAY,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EAChE,MAAM,YAAY,YAAY,EAAE,KAAK,EAAE,CAAC;EAExC,OAAO,KAAK,kCAAkC;CAClD,SAAS,OAAO;EAIZ,OAAO,MAAM,+CAA+C,EAAS,MAAM,CAAC;EAC5E,MAAM;CACV;AACJ;;AAGA,eAAe,kBAAkB,IAAuB;CACpD,KAAK,MAAM,CAAC,gBAAgB,eAAe,OAAO,QAAQ,kBAAkB,GAAG;EAC3E,MAAM,aAAa,GAAG,WAAW,cAAc;EAC/C,KAAK,MAAM,aAAa,YACpB,IAAI;GACA,MAAM,WAAW,UAAU,SAAS;GACpC,OAAO,KAAK,+BAA+B,eAAe,GAAG,WAAW;EAC5E,QAAQ,CAER;CAER;AACJ"}

package/dist/index.es.js

@@ -2557,9 +2557,6 @@ var MongoUserService = class {
 	get userRolesCollection() {
 		return this.db.collection("rebase_user_roles");
 	}
-	get rolesCollection() {
-		return this.db.collection("rebase_roles");
-	}
 	async createUser(data) {
 		const id = new ObjectId().toString();
 		const now = /* @__PURE__ */ new Date();
@@ -2717,17 +2714,6 @@ var MongoUserService = class {
 		const doc = await this.collection.findOne({ emailVerificationToken: token });
 		return doc ? toUser(doc) : null;
 	}
-	async getUserRoles(uid) {
-		const roleIds = (await this.userRolesCollection.find({ uid }).toArray()).map((ur) => ur.roleId);
-		if (roleIds.length === 0) return [];
-		return (await this.rolesCollection.find({ id: { $in: roleIds } }).toArray()).map((r) => ({
-			id: r.id,
-			name: r.name,
-			isAdmin: r.isAdmin ?? false,
-			defaultPermissions: r.defaultPermissions ?? null,
-			collectionPermissions: r.collectionPermissions ?? null
-		}));
-	}
 	async getUserRoleIds(uid) {
 		return (await this.userRolesCollection.find({ uid }).toArray()).map((ur) => ur.roleId);
 	}
@@ -2757,59 +2743,10 @@ var MongoUserService = class {
 		if (!user) return null;
 		return {
 			user,
-			roles: await this.getUserRoles(uid)
+			roles: await this.getUserRoleIds(uid)
 		};
 	}
 };
-var MongoRoleService = class {
-	db;
-	constructor(db) {
-		this.db = db;
-	}
-	get collection() {
-		return this.db.collection("rebase_roles");
-	}
-	async getRoleById(id) {
-		const doc = await this.collection.findOne({ id });
-		if (!doc) return null;
-		return {
-			id: doc.id,
-			name: doc.name,
-			isAdmin: doc.isAdmin ?? false,
-			defaultPermissions: doc.defaultPermissions ?? null,
-			collectionPermissions: doc.collectionPermissions ?? null
-		};
-	}
-	async listRoles() {
-		return (await this.collection.find().sort({ name: 1 }).toArray()).map((doc) => ({
-			id: doc.id,
-			name: doc.name,
-			isAdmin: doc.isAdmin ?? false,
-			defaultPermissions: doc.defaultPermissions ?? null,
-			collectionPermissions: doc.collectionPermissions ?? null
-		}));
-	}
-	async createRole(data) {
-		const doc = {
-			_id: data.id,
-			id: data.id,
-			name: data.name,
-			isAdmin: data.isAdmin ?? false,
-			defaultPermissions: data.defaultPermissions ?? null,
-			collectionPermissions: data.collectionPermissions ?? null
-		};
-		await this.collection.insertOne(doc);
-		return { ...doc };
-	}
-	async updateRole(id, data) {
-		await this.collection.updateOne({ id }, { $set: data });
-		return this.getRoleById(id);
-	}
-	async deleteRole(id) {
-		await this.collection.deleteOne({ id });
-		await this.db.collection("rebase_user_roles").deleteMany({ roleId: id });
-	}
-};
 var MongoRefreshTokenService = class {
 	db;
 	constructor(db) {
@@ -3034,12 +2971,10 @@ var MongoTokenRepository = class {
 var MongoAuthRepository = class {
 	db;
 	userService;
-	roleService;
 	tokenRepository;
 	constructor(db) {
 		this.db = db;
 		this.userService = new MongoUserService(db);
-		this.roleService = new MongoRoleService(db);
 		this.tokenRepository = new MongoTokenRepository(db);
 	}
 	async createUser(data) {
@@ -3084,9 +3019,6 @@ var MongoAuthRepository = class {
 	async getUserByVerificationToken(token) {
 		return this.userService.getUserByVerificationToken(token);
 	}
-	async getUserRoles(uid) {
-		return this.userService.getUserRoles(uid);
-	}
 	async getUserRoleIds(uid) {
 		return this.userService.getUserRoleIds(uid);
 	}
@@ -3099,21 +3031,6 @@ var MongoAuthRepository = class {
 	async getUserWithRoles(uid) {
 		return this.userService.getUserWithRoles(uid);
 	}
-	async getRoleById(id) {
-		return this.roleService.getRoleById(id);
-	}
-	async listRoles() {
-		return this.roleService.listRoles();
-	}
-	async createRole(data) {
-		return this.roleService.createRole(data);
-	}
-	async updateRole(id, data) {
-		return this.roleService.updateRole(id, data);
-	}
-	async deleteRole(id) {
-		await this.roleService.deleteRole(id);
-	}
 	async createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session) {
 		await this.tokenRepository.createRefreshToken(uid, tokenHash, expiresAt, userAgent, ipAddress, session);
 	}
@@ -3246,7 +3163,7 @@ function createMongoBootstrapper(mongoConfig) {
 		},
 		async initializeAuth(config, driverResult) {
 			const db = driverResult.internals.db;
-			const { ensureAuthCollectionsExist } = await import("./ensure-collections-Bl12bSwO.js");
+			const { ensureAuthCollectionsExist } = await import("./ensure-collections-DHTVMlxf.js");
 			await ensureAuthCollectionsExist(db);
 			const { createEmailService } = await import("@rebasepro/server");
 			const authConfig = config;
@@ -3254,7 +3171,6 @@ function createMongoBootstrapper(mongoConfig) {
 			if (authConfig?.email) emailService = createEmailService(authConfig.email);
 			return {
 				userService: new MongoUserService(db),
-				roleService: new MongoRoleService(db),
 				authRepository: new MongoAuthRepository(db),
 				emailService
 			};
@@ -3319,7 +3235,7 @@ function createMongoBootstrapper(mongoConfig) {
 		},
 		mountRoutes() {},
 		async initializeWebsockets(server, realtimeService, driver, config, authAdapter) {
-			const { createMongoWebSocket } = await import("./websocket-BtK4_9ZS.js");
+			const { createMongoWebSocket } = await import("./websocket-CXSVz4oq.js");
 			createMongoWebSocket(server, realtimeService, driver, config, cachedAdmin, authAdapter);
 		}
 	};