@tatara/cli 0.5.0 → 0.7.0

package/templates/features/authz/files/src/core/authz/validators.ts

@@ -1,99 +0,0 @@
-import { z } from "@hono/zod-openapi";
-import { OVERLAY_EFFECTS, SCOPES } from "#core/authz/constants";
-
-export const grantSchema = z
-	.object({
-		resource: z.string().min(1),
-		action: z.string().min(1),
-		scope: z.enum(SCOPES).nullable().optional(),
-	})
-	.openapi("PermissionGrant");
-
-export const roleSchema = z
-	.object({
-		id: z.string(),
-		key: z.string(),
-		name: z.string(),
-		description: z.string().nullable(),
-		isSystem: z.boolean(),
-		grants: z.array(grantSchema),
-		memberCount: z.number().int(),
-	})
-	.openapi("Role");
-
-export const createRoleSchema = z
-	.object({
-		key: z
-			.string()
-			.regex(/^[a-z][a-z0-9_]{1,62}$/, "lowercase letters, digits and underscores"),
-		name: z.string().trim().min(1).max(120),
-		description: z.string().max(1000).nullable().optional(),
-		grants: z.array(grantSchema).default([]),
-	})
-	.openapi("CreateRole");
-
-export const updateRoleSchema = createRoleSchema.omit({ key: true }).partial().openapi("UpdateRole");
-
-export const overlayInputSchema = z
-	.object({
-		resource: z.string().min(1),
-		action: z.string().min(1),
-		scope: z.enum(SCOPES).nullable().optional(),
-		effect: z.enum(OVERLAY_EFFECTS),
-		reason: z.string().max(500).nullable().optional(),
-		expiresAt: z.iso.datetime().nullable().optional(),
-	})
-	.openapi("OverlayInput");
-
-export const overlaySchema = z
-	.object({
-		id: z.string(),
-		resource: z.string(),
-		action: z.string(),
-		scope: z.enum(SCOPES).nullable(),
-		effect: z.enum(OVERLAY_EFFECTS),
-		reason: z.string().nullable(),
-		expiresAt: z.string().nullable(),
-	})
-	.openapi("Overlay");
-
-export const memberSchema = z
-	.object({
-		userId: z.string(),
-		orgId: z.string(),
-		roles: z.array(roleSchema),
-		overlays: z.array(overlaySchema),
-	})
-	.openapi("Member");
-
-export const myPermissionsSchema = z
-	.object({
-		orgId: z.string(),
-		roles: z.array(z.string()),
-		grants: z.array(grantSchema),
-		denies: z.array(z.string()),
-	})
-	.openapi("MyPermissions");
-
-export const auditEntrySchema = z
-	.object({
-		id: z.string(),
-		actorId: z.string(),
-		targetUserId: z.string().nullable(),
-		changeType: z.string(),
-		before: z.unknown(),
-		after: z.unknown(),
-		at: z.string(),
-	})
-	.openapi("AuditEntry");
-
-export const idParams = z.object({ id: z.string().openapi({ param: { name: "id", in: "path" } }) });
-export const userParams = z.object({
-	userId: z.string().openapi({ param: { name: "userId", in: "path" } }),
-});
-export const userRoleParams = userParams.extend({
-	roleId: z.string().openapi({ param: { name: "roleId", in: "path" } }),
-});
-export const userOverlayParams = userParams.extend({
-	overlayId: z.string().openapi({ param: { name: "overlayId", in: "path" } }),
-});

package/templates/features/jobs/files/src/core/jobs/define.ts

@@ -1,37 +0,0 @@
-import type { z } from "zod";
-import type { Logger } from "#core/logging/logger";
-
-export interface JobContext {
-	logger: Logger;
-	jobId: string;
-	attempt: number;
-}
-
-export interface ConsumerDefinition<S extends z.ZodType = z.ZodType> {
-	/** job name, e.g. "billing.invoice-paid" */
-	topic: string;
-	description: string;
-	schema: S;
-	/** retries before the job is marked failed (default 3) */
-	attempts?: number;
-	handle(data: z.infer<S>, ctx: JobContext): Promise<void>;
-}
-
-/** Default export of every `consumers/*.ts`; run by the worker app. */
-export function defineConsumer<S extends z.ZodType>(definition: ConsumerDefinition<S>) {
-	return definition;
-}
-
-export interface ScheduleDefinition {
-	name: string;
-	/** cron expression (seconds optional), evaluated in UTC */
-	cron: string;
-	/** how long the run holds its lock; one run per tick across all cron processes */
-	lockTtlMs?: number;
-	run(ctx: { logger: Logger }): Promise<void>;
-}
-
-/** Default export of every `schedules/*.ts`; run by the cron app. */
-export function defineSchedule(definition: ScheduleDefinition): ScheduleDefinition {
-	return definition;
-}

package/templates/features/jobs/files/src/core/jobs/lock.ts

@@ -1,17 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { redis } from "#core/jobs/redis";
-
-const RELEASE = `if redis.call("get", KEYS[1]) == ARGV[1] then return redis.call("del", KEYS[1]) else return 0 end`;
-
-/** Runs `fn` only if this process wins the lock; returns false when another holder has it. */
-export async function withLock(key: string, ttlMs: number, fn: () => Promise<void>): Promise<boolean> {
-	const token = randomUUID();
-	const acquired = await redis().set(`lock:${key}`, token, "PX", ttlMs, "NX");
-	if (acquired !== "OK") return false;
-	try {
-		await fn();
-	} finally {
-		await redis().eval(RELEASE, 1, `lock:${key}`, token);
-	}
-	return true;
-}

package/templates/features/jobs/files/src/core/jobs/process.ts

@@ -1,19 +0,0 @@
-import type { ConsumerDefinition, JobContext } from "#core/jobs/define";
-
-export class UnknownTopicError extends Error {}
-
-/** Validates and runs one job; shared by the worker and by tests. */
-export async function processJob(
-	consumers: ConsumerDefinition[],
-	topic: string,
-	data: unknown,
-	ctx: JobContext,
-): Promise<void> {
-	const consumer = consumers.find((c) => c.topic === topic);
-	if (!consumer) throw new UnknownTopicError(`No consumer for topic "${topic}"`);
-	const parsed = consumer.schema.safeParse(data);
-	if (!parsed.success) {
-		throw new Error(`Invalid payload for ${topic}: ${parsed.error.message}`);
-	}
-	await consumer.handle(parsed.data, ctx);
-}

package/templates/features/jobs/files/src/core/jobs/queue.ts

@@ -1,29 +0,0 @@
-import { type JobsOptions, Queue } from "bullmq";
-import { env } from "#core/config/env";
-import { redis } from "#core/jobs/redis";
-import { onShutdown } from "@tatara/core";
-
-export const QUEUE_NAME = "__APP_NAME__-jobs";
-
-let queue: Queue | undefined;
-
-function getQueue(): Queue {
-	if (!queue) {
-		const q = new Queue(QUEUE_NAME, { connection: redis(), prefix: env.JOBS_PREFIX });
-		queue = q;
-		onShutdown("queue", () => q.close());
-	}
-	return queue;
-}
-
-/** Enqueues a job for the consumer with this topic. The consumer validates the payload. */
-export async function enqueue(topic: string, data: unknown, options: JobsOptions = {}): Promise<string> {
-	const job = await getQueue().add(topic, data, {
-		attempts: 3,
-		backoff: { type: "exponential", delay: 1000 },
-		removeOnComplete: 1000,
-		removeOnFail: 5000,
-		...options,
-	});
-	return job.id ?? "";
-}

package/templates/features/jobs/files/src/core/jobs/redis.ts

@@ -1,17 +0,0 @@
-import { Redis } from "ioredis";
-import { env } from "#core/config/env";
-import { onShutdown } from "@tatara/core";
-
-let client: Redis | undefined;
-
-/** Shared connection (BullMQ requires maxRetriesPerRequest: null). */
-export function redis(): Redis {
-	if (!client) {
-		const connection = new Redis(env.REDIS_URL, { maxRetriesPerRequest: null });
-		client = connection;
-		onShutdown("redis", async () => {
-			await connection.quit();
-		});
-	}
-	return client;
-}

package/templates/features/storage/files/src/core/storage/local.ts

@@ -1,34 +0,0 @@
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, resolve, sep } from "node:path";
-import { env } from "#core/config/env";
-import { assertKey, type Storage } from "#core/storage/storage";
-
-/** Files on disk; for development and tests. */
-export function localStorage(root = env.STORAGE_LOCAL_DIR): Storage {
-	const base = resolve(root);
-	const path = (key: string) => {
-		const full = resolve(base, assertKey(key));
-		if (!full.startsWith(base + sep)) throw new Error(`Invalid storage key "${key}"`);
-		return full;
-	};
-	return {
-		async put(key, body) {
-			await mkdir(dirname(path(key)), { recursive: true });
-			await writeFile(path(key), body);
-		},
-		async get(key) {
-			try {
-				return new Uint8Array(await readFile(path(key)));
-			} catch (error) {
-				if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
-				throw error;
-			}
-		},
-		async delete(key) {
-			await rm(path(key), { force: true });
-		},
-		async url(key) {
-			return `file://${path(key)}`;
-		},
-	};
-}

package/templates/features/storage/files/src/core/storage/s3.ts

@@ -1,66 +0,0 @@
-import {
-	CreateBucketCommand,
-	DeleteObjectCommand,
-	GetObjectCommand,
-	HeadBucketCommand,
-	NoSuchKey,
-	PutObjectCommand,
-	S3Client,
-} from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { env } from "#core/config/env";
-import { assertKey, type Storage } from "#core/storage/storage";
-
-export const s3 = new S3Client({
-	region: env.S3_REGION,
-	...(env.S3_ENDPOINT ? { endpoint: env.S3_ENDPOINT } : {}),
-	forcePathStyle: env.S3_FORCE_PATH_STYLE,
-	...(env.S3_ACCESS_KEY_ID && env.S3_SECRET_ACCESS_KEY
-		? { credentials: { accessKeyId: env.S3_ACCESS_KEY_ID, secretAccessKey: env.S3_SECRET_ACCESS_KEY } }
-		: {}),
-});
-
-/** Any S3-compatible store (AWS S3, R2, RustFS locally). */
-export function s3Storage(bucket = env.S3_BUCKET): Storage {
-	let bucketReady: Promise<boolean> | undefined;
-	return {
-		async put(key, body, contentType) {
-			// local development: create the bucket on first write
-			if (env.NODE_ENV === "development") {
-				bucketReady ??= ensureBucket(bucket);
-				await bucketReady;
-			}
-			await s3.send(
-				new PutObjectCommand({ Bucket: bucket, Key: assertKey(key), Body: body, ContentType: contentType }),
-			);
-		},
-		async get(key) {
-			try {
-				const res = await s3.send(new GetObjectCommand({ Bucket: bucket, Key: assertKey(key) }));
-				return res.Body ? await res.Body.transformToByteArray() : null;
-			} catch (error) {
-				if (error instanceof NoSuchKey) return null;
-				throw error;
-			}
-		},
-		async delete(key) {
-			await s3.send(new DeleteObjectCommand({ Bucket: bucket, Key: assertKey(key) }));
-		},
-		async url(key, expiresInSeconds = 900) {
-			return getSignedUrl(s3, new GetObjectCommand({ Bucket: bucket, Key: assertKey(key) }), {
-				expiresIn: expiresInSeconds,
-			});
-		},
-	};
-}
-
-/** Creates the bucket when it does not exist (local development). */
-export async function ensureBucket(bucket = env.S3_BUCKET): Promise<boolean> {
-	try {
-		await s3.send(new HeadBucketCommand({ Bucket: bucket }));
-		return false;
-	} catch {
-		await s3.send(new CreateBucketCommand({ Bucket: bucket }));
-		return true;
-	}
-}

package/templates/features/storage/files/src/core/storage/storage.ts

@@ -1,21 +0,0 @@
-/** Object storage used by modules; pick the driver with STORAGE_DRIVER. */
-export interface Storage {
-	put(key: string, body: Uint8Array | string, contentType?: string): Promise<void>;
-	get(key: string): Promise<Uint8Array | null>;
-	delete(key: string): Promise<void>;
-	/** a URL clients can fetch the object from (signed for S3) */
-	url(key: string, expiresInSeconds?: number): Promise<string>;
-}
-
-/** Keys are relative, forward-slash paths without "..", backslashes, NUL bytes or drive prefixes. */
-export function assertKey(key: string): string {
-	const invalid =
-		!key ||
-		key.startsWith("/") ||
-		key.includes("\\") ||
-		key.includes("\0") ||
-		/^[A-Za-z]:/.test(key) ||
-		key.split("/").some((segment) => segment === ".." || segment === ".");
-	if (invalid) throw new Error(`Invalid storage key "${key}"`);
-	return key;
-}