@teamblind/axeda-better-auth 0.0.0-stage → 0.1.0-alpha.0

package/dist/endpoints.js

@@ -0,0 +1,232 @@
+import { APIError, createAuthEndpoint, getIP, sessionMiddleware } from 'better-auth/api';
+import { z } from 'zod';
+import { AXEDA_PERMISSIONS, AxedaError, } from '@teamblind/axeda-core';
+import { toAssignmentDto, toAuditEventDto, toRoleDto } from './dto.js';
+import { toApiError } from './http-errors.js';
+import { currentUserRow, principalFromUser } from './principal.js';
+export const access = (requires, scope) => ({
+    axeda: { requires, scope },
+});
+const MAX_PAGE = 100;
+const DEFAULT_PAGE = 50;
+export const id = z.string().min(1).max(255);
+export const cursor = z.string().min(1).max(512);
+export const limit = z.coerce.number().int().min(1).max(MAX_PAGE);
+export const scopeBody = z.union([
+    z.strictObject({ type: z.literal('global') }),
+    z.strictObject({ type: z.enum(['company', 'business']), id }),
+]);
+export const scopeQuery = {
+    scopeType: z.enum(['global', 'company', 'business']).optional(),
+    scopeId: id.optional(),
+};
+export function scopeFromQuery(query) {
+    if (query.scopeType === undefined)
+        return undefined;
+    if (query.scopeType === 'global')
+        return { type: 'global' };
+    // Un alcance sin identificador queda fuera de la lista blanca y el núcleo lo rechaza.
+    return { type: query.scopeType, id: query.scopeId ?? '' };
+}
+export const pageOf = (query) => ({
+    limit: query.limit ?? DEFAULT_PAGE,
+    ...(query.cursor === undefined ? {} : { cursor: query.cursor }),
+});
+/**
+ * Quien actúa, a partir de la sesión: el `Principal` (ver `principalFromUser`) más los datos de la
+ * petición para la auditoría.
+ */
+export async function actorFromSession(ctx) {
+    const user = await currentUserRow(ctx.context.session.user, ctx.context.options, () => ctx.context.internalAdapter);
+    if (user === null) {
+        throw new APIError('UNAUTHORIZED', { code: 'AXEDA_UNAUTHENTICATED', message: 'Sign in.' });
+    }
+    const request = ctx.request;
+    const ip = request === undefined ? undefined : (getIP(request, {}) ?? undefined);
+    return {
+        ...principalFromUser(user),
+        ip,
+        userAgent: ctx.headers?.get('user-agent') ?? request?.headers.get('user-agent') ?? undefined,
+    };
+}
+/** Ejecuta un caso de uso con el actor de la sesión y traduce sus errores a respuestas HTTP. */
+export async function run(ctx, core, work) {
+    try {
+        return await work(core(), await actorFromSession(ctx));
+    }
+    catch (error) {
+        throw toApiError(error);
+    }
+}
+/**
+ * Los endpoints del plugin. Todos exigen sesión (`sessionMiddleware`) y declaran su permiso en
+ * `metadata.axeda`; el permiso lo impone el caso de uso, no el endpoint. Los endpoints de Better
+ * Auth solo admiten GET y POST.
+ */
+export function createEndpoints(core) {
+    return {
+        axedaMe: createAuthEndpoint('/axeda/me', { method: 'GET', use: [sessionMiddleware], metadata: access('(authenticated)', 'own') }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const [permissions, assignments] = await Promise.all([
+                axeda.effectivePermissions(actor),
+                axeda.assignments.listForUser(actor, actor.userId),
+            ]);
+            return ctx.json({
+                userId: actor.userId,
+                twoFactorEnabled: actor.twoFactorEnabled === true,
+                globalPermissions: [...permissions.keys],
+                assignments: assignments.map(toAssignmentDto),
+            });
+        })),
+        axedaPermissionList: createAuthEndpoint('/axeda/permission/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            metadata: access('axeda:role:manage | axeda:assignment:manage', 'any'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const allowed = (await axeda.canAnywhere(actor, AXEDA_PERMISSIONS.roleManage)) ||
+                (await axeda.canAnywhere(actor, AXEDA_PERMISSIONS.assignmentManage));
+            if (!allowed) {
+                throw new AxedaError('AXEDA_FORBIDDEN', 'You are not allowed to read the permission catalog.');
+            }
+            return ctx.json({ permissions: [...axeda.catalog] });
+        })),
+        axedaRoleList: createAuthEndpoint('/axeda/role/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({ cursor: cursor.optional(), limit: limit.optional() }),
+            metadata: access('axeda:role:manage | axeda:assignment:manage', 'any'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const page = await axeda.roles.list(actor, pageOf(ctx.query));
+            return ctx.json({ items: page.items.map(toRoleDto), nextCursor: page.nextCursor });
+        })),
+        axedaRoleGet: createAuthEndpoint('/axeda/role/get', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({ id }),
+            metadata: access('axeda:role:manage | axeda:assignment:manage', 'any'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toRoleDto(await axeda.roles.get(actor, ctx.query.id))))),
+        axedaRoleCreate: createAuthEndpoint('/axeda/role/create', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                key: z.string().min(1).max(64),
+                name: z.string().min(1).max(200),
+                description: z.string().max(1000).nullish(),
+                permissions: z.array(z.string().max(200)).max(1000),
+                requireMfa: z.boolean().optional(),
+            }),
+            metadata: access('axeda:role:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toRoleDto(await axeda.roles.create(actor, ctx.body))))),
+        axedaRoleUpdate: createAuthEndpoint('/axeda/role/update', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                id,
+                version: z.number().int().min(1),
+                name: z.string().min(1).max(200).optional(),
+                description: z.string().max(1000).nullish(),
+                permissions: z.array(z.string().max(200)).max(1000).optional(),
+                requireMfa: z.boolean().optional(),
+            }),
+            metadata: access('axeda:role:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { id: roleId, version, ...changes } = ctx.body;
+            return ctx.json(toRoleDto(await axeda.roles.update(actor, roleId, version, changes)));
+        })),
+        axedaRoleSetStatus: createAuthEndpoint('/axeda/role/set-status', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                id,
+                version: z.number().int().min(1),
+                status: z.enum(['active', 'inactive']),
+            }),
+            metadata: access('axeda:role:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => ctx.json(toRoleDto(await axeda.roles.setStatus(actor, ctx.body.id, ctx.body.version, ctx.body.status))))),
+        axedaRoleDelete: createAuthEndpoint('/axeda/role/delete', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id }),
+            metadata: access('axeda:role:manage', 'global'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            await axeda.roles.delete(actor, ctx.body.id);
+            return ctx.json({ deleted: true });
+        })),
+        axedaAssignmentList: createAuthEndpoint('/axeda/assignment/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                userId: id.optional(),
+                ...scopeQuery,
+                cursor: cursor.optional(),
+                limit: limit.optional(),
+            }),
+            metadata: access('axeda:assignment:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { userId } = ctx.query;
+            if (userId !== undefined) {
+                const items = await axeda.assignments.listForUser(actor, userId);
+                return ctx.json({ items: items.map(toAssignmentDto), nextCursor: null });
+            }
+            const scope = scopeFromQuery(ctx.query);
+            if (scope === undefined) {
+                throw new AxedaError('AXEDA_INVALID_INPUT', 'Pass userId, or scopeType (and scopeId).');
+            }
+            const page = await axeda.assignments.listForScope(actor, scope, pageOf(ctx.query));
+            return ctx.json({ items: page.items.map(toAssignmentDto), nextCursor: page.nextCursor });
+        })),
+        axedaAssignmentCreate: createAuthEndpoint('/axeda/assignment/create', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({
+                userId: id,
+                roleId: id,
+                scope: scopeBody,
+                expiresAt: z.iso.datetime().nullish(),
+            }),
+            metadata: access('axeda:assignment:manage', 'scope-parameter'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { expiresAt, ...rest } = ctx.body;
+            const created = await axeda.assignments.assign(actor, {
+                ...rest,
+                expiresAt: expiresAt === null || expiresAt === undefined ? null : new Date(expiresAt),
+            });
+            return ctx.json(toAssignmentDto(created));
+        })),
+        axedaAssignmentRevoke: createAuthEndpoint('/axeda/assignment/revoke', {
+            method: 'POST',
+            use: [sessionMiddleware],
+            body: z.strictObject({ id }),
+            metadata: access('axeda:assignment:manage', 'per-target'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            await axeda.assignments.revoke(actor, ctx.body.id);
+            return ctx.json({ revoked: true });
+        })),
+        axedaAuditList: createAuthEndpoint('/axeda/audit/list', {
+            method: 'GET',
+            use: [sessionMiddleware],
+            query: z.strictObject({
+                actorId: id.optional(),
+                action: z.string().max(64).optional(),
+                targetType: z.string().max(64).optional(),
+                targetId: id.optional(),
+                ...scopeQuery,
+                cursor: cursor.optional(),
+                limit: limit.optional(),
+            }),
+            metadata: access('axeda:audit:read', 'scope-parameter'),
+        }, (ctx) => run(ctx, core, async (axeda, actor) => {
+            const { action, targetType, scopeType, scopeId, cursor: after, limit: size, ...rest } = ctx.query;
+            const scope = scopeFromQuery({ scopeType, scopeId });
+            const filter = {
+                ...rest,
+                ...(action === undefined ? {} : { action: action }),
+                ...(targetType === undefined
+                    ? {}
+                    : { targetType: targetType }),
+                ...(scope === undefined ? {} : { scope }),
+            };
+            const page = await axeda.listAudit(actor, filter, pageOf({ cursor: after, limit: size }));
+            return ctx.json({ items: page.items.map(toAuditEventDto), nextCursor: page.nextCursor });
+        })),
+    };
+}

package/dist/errors.d.ts

@@ -0,0 +1,2 @@
+export declare const isUniqueViolation: (error: unknown) => boolean;
+export declare const isForeignKeyViolation: (error: unknown) => boolean;

package/dist/errors.js

@@ -0,0 +1,32 @@
+/** Códigos de error que los controladores de base de datos usan para una violación de restricción. */
+const UNIQUE_CODES = new Set([
+    '23505', // PostgreSQL
+    'ER_DUP_ENTRY', // MySQL / MariaDB
+    'SQLITE_CONSTRAINT_UNIQUE',
+    'SQLITE_CONSTRAINT_PRIMARYKEY',
+    '11000', // MongoDB
+]);
+const FOREIGN_KEY_CODES = new Set([
+    '23503', // PostgreSQL
+    'ER_NO_REFERENCED_ROW_2', // MySQL / MariaDB
+    'ER_NO_REFERENCED_ROW',
+    'SQLITE_CONSTRAINT_FOREIGNKEY',
+]);
+/** Recorre `error` y sus causas (Better Auth y Kysely envuelven los errores del controlador). */
+function codesOf(error) {
+    const codes = [];
+    const seen = new Set();
+    let current = error;
+    while (typeof current === 'object' && current !== null && !seen.has(current)) {
+        seen.add(current);
+        const { code, errno } = current;
+        if (typeof code === 'string' || typeof code === 'number')
+            codes.push(String(code));
+        if (typeof errno === 'number')
+            codes.push(String(errno));
+        current = current.cause;
+    }
+    return codes;
+}
+export const isUniqueViolation = (error) => codesOf(error).some((code) => UNIQUE_CODES.has(code));
+export const isForeignKeyViolation = (error) => codesOf(error).some((code) => FOREIGN_KEY_CODES.has(code));

package/dist/http-errors.d.ts

@@ -0,0 +1,12 @@
+import { APIError } from 'better-auth/api';
+import { type AxedaErrorCode } from '@teamblind/axeda-core';
+/** Los códigos que la API traduce a un estado concreto (para las pruebas). */
+export declare const MAPPED_CODES: AxedaErrorCode[];
+/**
+ * Convierte un error de Axeda en una respuesta de Better Auth con el código estable `AXEDA_*`.
+ *
+ * Solo los errores que se espera ver (validación, permisos, conflictos) llevan su mensaje al
+ * cliente. Cualquier otro (base de datos caída, datos corruptos, un fallo inesperado) devuelve
+ * un 500 genérico: el detalle puede revelar el esquema o la infraestructura (S17).
+ */
+export declare function toApiError(error: unknown): APIError;

package/dist/http-errors.js

@@ -0,0 +1,58 @@
+import { APIError } from 'better-auth/api';
+import { isAxedaError } from '@teamblind/axeda-core';
+/**
+ * Estado HTTP de CADA código estable. El mapa es exhaustivo a propósito: al añadir un código en el
+ * núcleo, el compilador obliga a decidir aquí qué responde la API (antes, un código olvidado
+ * acababa en un 500 sin que nadie lo notara). `'internal'` significa «error del servidor, sin
+ * detalles»: son fallos de configuración o de datos que el cliente no puede arreglar.
+ */
+const STATUS = {
+    AXEDA_INVALID_INPUT: 'BAD_REQUEST',
+    AXEDA_INVALID_PERMISSION: 'BAD_REQUEST',
+    AXEDA_UNKNOWN_PERMISSION: 'BAD_REQUEST',
+    AXEDA_INVITATION_INVALID: 'BAD_REQUEST',
+    AXEDA_FORBIDDEN: 'FORBIDDEN',
+    AXEDA_MFA_REQUIRED: 'FORBIDDEN',
+    AXEDA_ROLE_NOT_FOUND: 'NOT_FOUND',
+    AXEDA_ASSIGNMENT_NOT_FOUND: 'NOT_FOUND',
+    AXEDA_USER_NOT_FOUND: 'NOT_FOUND',
+    AXEDA_EMAIL_TAKEN: 'CONFLICT',
+    AXEDA_COMPANY_NOT_FOUND: 'NOT_FOUND',
+    AXEDA_BUSINESS_NOT_FOUND: 'NOT_FOUND',
+    AXEDA_ROLE_KEY_TAKEN: 'CONFLICT',
+    AXEDA_ROLE_MANAGED: 'CONFLICT',
+    AXEDA_VERSION_CONFLICT: 'CONFLICT',
+    AXEDA_ASSIGNMENT_EXISTS: 'CONFLICT',
+    AXEDA_LIMIT_EXCEEDED: 'CONFLICT',
+    AXEDA_ALREADY_BOOTSTRAPPED: 'CONFLICT',
+    AXEDA_SLUG_TAKEN: 'CONFLICT',
+    AXEDA_INVITATION_EXISTS: 'CONFLICT',
+    AXEDA_FEATURE_DISABLED: 'NOT_IMPLEMENTED',
+    AXEDA_DELIVERY_FAILED: 'BAD_GATEWAY',
+    AXEDA_INVALID_CONFIG: 'internal',
+    AXEDA_TRANSACTIONS_UNSUPPORTED: 'internal',
+    AXEDA_DATA_CORRUPT: 'internal',
+};
+/** Los códigos que la API traduce a un estado concreto (para las pruebas). */
+export const MAPPED_CODES = Object.keys(STATUS);
+/**
+ * Convierte un error de Axeda en una respuesta de Better Auth con el código estable `AXEDA_*`.
+ *
+ * Solo los errores que se espera ver (validación, permisos, conflictos) llevan su mensaje al
+ * cliente. Cualquier otro (base de datos caída, datos corruptos, un fallo inesperado) devuelve
+ * un 500 genérico: el detalle puede revelar el esquema o la infraestructura (S17).
+ */
+export function toApiError(error) {
+    if (error instanceof APIError)
+        return error;
+    if (isAxedaError(error)) {
+        const status = STATUS[error.code];
+        if (status !== 'internal') {
+            return new APIError(status, { code: error.code, message: error.message });
+        }
+    }
+    return new APIError('INTERNAL_SERVER_ERROR', {
+        code: 'AXEDA_INTERNAL_ERROR',
+        message: 'Internal error.',
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { axeda, type AxedaPlugin, type AxedaPluginOptions, type InvitationDeliveryOptions, } from './plugin.js';
+export type { AssignmentDto, AuditEventDto, BusinessDto, CompanyDto, InvitationDto, ManagedUserDto, RoleDto, } from './dto.js';
+export type { EndpointAccess } from './endpoints.js';
+export { MODELS, axedaSchema } from './schema.js';
+export { MAPPED_CODES } from './http-errors.js';
+export { createBetterAuthPersistence, type BetterAuthPersistenceOptions } from './stores.js';
+export { createBetterAuthUserDirectory } from './users.js';
+export { createBetterAuthUserAdmin } from './user-admin.js';
+export { actorFromSession as principalFromSession } from './endpoints.js';
+export { principalFromUser, sessionPrincipal, type SessionReader } from './principal.js';
+export { secureAuthOptions, type SecureAuthInput, type SecureAuthOptions } from './preset.js';

package/dist/index.js

@@ -0,0 +1,10 @@
+// @teamblind/axeda-better-auth — plugin de Better Auth y persistencia de Axeda sobre su adaptador.
+export { axeda, } from './plugin.js';
+export { MODELS, axedaSchema } from './schema.js';
+export { MAPPED_CODES } from './http-errors.js';
+export { createBetterAuthPersistence } from './stores.js';
+export { createBetterAuthUserDirectory } from './users.js';
+export { createBetterAuthUserAdmin } from './user-admin.js';
+export { actorFromSession as principalFromSession } from './endpoints.js';
+export { principalFromUser, sessionPrincipal } from './principal.js';
+export { secureAuthOptions } from './preset.js';