@teamscala/service-boot 0.23.529 → 0.23.531

package/package.json

@@ -5,10 +5,13 @@
     "edit": "edit src/ — dependencies and exports derive from imports; everything else preserved"
   },
   "dependencies": {
+    "@orpc/openapi": "*",
     "@orpc/server": "*",
     "@teamscala/agreement-generation": "*",
     "@teamscala/auth": "*",
+    "@teamscala/auth-factory": "*",
     "@teamscala/cache": "*",
+    "@teamscala/content-gate-token": "*",
     "@teamscala/db": "*",
     "@teamscala/db-validation": "*",
     "@teamscala/document-signing": "*",
@@ -290,5 +293,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.529"
+  "version": "0.23.531"
 }

package/src/attach-proposal-accept.ts

@@ -7,7 +7,7 @@ import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import { parseCookie } from "./content-gate/parse-cookie.ts";
-import { verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
+import { verifyAccessToken } from "@teamscala/content-gate-token";
 import { agTtlMs } from "./gate-ttls.ts";
 import { createAgreementFromProposal } from "@teamscala/agreement-generation/create-agreement-from-proposal";
 import { getCookieDomain } from "@teamscala/db/registry/cookie-domain";

package/src/attach-proposal-magic.ts

@@ -5,7 +5,7 @@
 
 import type { Hono } from "hono";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
+import { verifyAccessToken } from "@teamscala/content-gate-token";
 import { propTtlMs } from "./gate-ttls.ts";
 
 const PROP_COOKIE = "prop_token";

package/src/auth/sign-out.ts

@@ -20,7 +20,7 @@ export async function signOut(context: SignOutContext): Promise<SignOutResult> {
 	// call, so a per-request registration would rebuild the whole better-auth
 	// module graph on each sign-out. getAuth() throws if no factory is
 	// registered, which the authed middleware has already excluded.
-	const { getAuth } = await import("@teamscala/auth/auth-registry.ts");
+	const { getAuth } = await import("@teamscala/auth-factory/auth-registry.ts");
 	const auth = await getAuth();
 	const headers = context?.headers ?? new Headers();
 

package/src/auth-gate.ts

@@ -75,9 +75,9 @@ export async function attachAuthGate(
 	// never pulled from a singleton inside a per-request handler.
 	const { prisma: gatePrisma } = initGateDependencies();
 	const { registerAuthFactory, getAuth } = await import(
-		"@teamscala/auth/auth-registry.ts"
+		"@teamscala/auth-factory/auth-registry.ts"
 	);
-	const { createAuth } = await import("@teamscala/auth/auth-factory.ts");
+	const { createAuth } = await import("@teamscala/auth-factory/auth-factory.ts");
 	registerAuthFactory(createAuth);
 
 	// Bridge the SAME factory into @teamscala/orpc's configure surface so the ORPC

package/src/content-gate/config-types.ts

@@ -3,7 +3,7 @@
  * @status handwritten
  */
 
-import type { GateSegmentation } from "@teamscala/agreement-generation/content-gate-token";
+import type { GateSegmentation } from "@teamscala/content-gate-token";
 
 type Resolved = Record<string, unknown>;
 

package/src/gpt-gate.ts

@@ -4,7 +4,7 @@
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/agreement-generation/content-gate-token";
+import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/content-gate-token";
 import { gptTtlMs } from "./gate-ttls.ts";
 
 const GPT_COOKIE = "gpt_token";

package/src/mount-orpc-router.ts

@@ -89,6 +89,10 @@ export async function mountOrpcRouter(
 		const handler = new RPCHandler(router as never, {
 			interceptors: [procedureErrorReportInterceptor()] as never,
 		});
+		const { OpenAPIHandler } = await import("@orpc/openapi/fetch");
+		const openApiHandler = new OpenAPIHandler(router as never, {
+			interceptors: [procedureErrorReportInterceptor()] as never,
+		});
 
 		const { getPrisma: getConfiguredPrisma } = await import(
 			"@teamscala/orpc/configure"
@@ -146,6 +150,21 @@ export async function mountOrpcRouter(
 		}
 
 		const resolveUser = async (headers: Headers) => {
+			if (
+				openApiContractAuthorised({
+					authorization: headers.get("authorization"),
+					key: process.env.SCALA_DEV_KEY,
+					forwardedProto: headers.get("x-forwarded-proto"),
+					forwardedFor: headers.get("x-forwarded-for"),
+				})
+			) {
+				return {
+					id: "service",
+					role: "super_admin" as const,
+					isSuperAdmin: true,
+					organisationId: null,
+				};
+			}
 			if (isLocalhostRequest(headers)) {
 				return {
 					id: "localhost",
@@ -196,6 +215,21 @@ export async function mountOrpcRouter(
 			},
 		);
 
+		app.all(
+			"/api/openapi/*",
+			bodyLimit({
+				maxSize: 10 * 1024 * 1024,
+				onError: (c) => c.json({ error: "Request body too large" }, 413),
+			}),
+			async (c) => {
+				const result = await openApiHandler.handle(c.req.raw, {
+					prefix: "/api/openapi",
+					context: { prisma: getConfiguredPrisma(), db8, headers: c.req.raw.headers, resolveUser },
+				});
+				return result.matched ? result.response : c.notFound();
+			},
+		);
+
 		app.get("/api/rpc/openapi.json", async (c) => {
 			const header = (name: string) => c.req.header(name) ?? null;
 			if (

package/src/orpc-openapi-document.ts

@@ -17,7 +17,7 @@ export function openApiContractOptions(
 		title: `${serviceSlug} oRPC procedures`,
 		servers: [
 			{
-				url: `${forwardedProto || FALLBACK_PROTO}://${host || FALLBACK_HOST}/api/rpc`,
+				url: `${forwardedProto || FALLBACK_PROTO}://${host || FALLBACK_HOST}/api/openapi`,
 			},
 		],
 	};

package/src/proposal-gate.ts

@@ -4,7 +4,7 @@
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessToken } from "@teamscala/agreement-generation/content-gate-token";
+import { signAccessToken, verifyAccessToken } from "@teamscala/content-gate-token";
 import { resolveProposalAuthorizedEmails } from "./proposal-authorized-emails.ts";
 import { propTtlMs } from "./gate-ttls.ts";
 import { getAppLogger } from "@teamscala/logger/app-loggers";

package/src/quiz-gate.ts

@@ -4,7 +4,7 @@
  */
 
 import type { AccessConfig, ContentGateConfig } from "./content-gate/config-types.ts";
-import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/agreement-generation/content-gate-token";
+import { signAccessToken, verifyAccessTokenIdentity } from "@teamscala/content-gate-token";
 import { quizTtlMs } from "./gate-ttls.ts";
 
 const QUIZ_COOKIE = "quiz_token";