@terreno/api 0.0.17 → 0.1.0

package/dist/auth.js

@@ -377,7 +377,9 @@ function addAuthRoutes(app, userModel, authOptions) {
                                 logger_1.logger.warn("Invalid login: ".concat(info));
                                 return [2 /*return*/, res.status(401).json({ message: info === null || info === void 0 ? void 0 : info.message })];
                             }
-                            logger_1.logger.info("User logged in: ".concat(user._id, ", type: ").concat(user.type || "N/A"));
+                            if (process.env.NODE_ENV !== "test") {
+                                logger_1.logger.info("User logged in: ".concat(user._id, ", type: ").concat(user.type || "N/A"));
+                            }
                             return [4 /*yield*/, (0, exports.generateTokens)(user, authOptions)];
                         case 1:
                             tokens = _a.sent();

package/dist/errors.js

@@ -67,7 +67,7 @@ exports.getAPIErrorBody = getAPIErrorBody;
 exports.apiUnauthorizedMiddleware = apiUnauthorizedMiddleware;
 exports.apiErrorMiddleware = apiErrorMiddleware;
 // https://jsonapi.org/format/#errors
-var Sentry = __importStar(require("@sentry/node"));
+var Sentry = __importStar(require("@sentry/bun"));
 var mongoose_1 = require("mongoose");
 var logger_1 = require("./logger");
 /**
@@ -125,21 +125,24 @@ exports.APIError = APIError;
 // model.
 function errorsPlugin(schema) {
     var errorSchema = new mongoose_1.Schema({
-        code: String,
-        detail: String,
-        id: String,
+        code: { description: "Application-specific error code", type: String },
+        detail: { description: "Human-readable explanation of the error", type: String },
+        id: { description: "Unique identifier for this error occurrence", type: String },
         links: {
-            about: String,
-            type: String,
+            about: { description: "Link to documentation about this error", type: String },
+            type: { description: "Link describing the error type", type: String },
         },
-        meta: mongoose_1.Schema.Types.Mixed,
+        meta: { description: "Non-standard meta information about the error", type: mongoose_1.Schema.Types.Mixed },
         source: {
-            header: String,
-            parameter: String,
-            pointer: String,
+            header: { description: "HTTP header that caused the error", type: String },
+            parameter: { description: "Query parameter that caused the error", type: String },
+            pointer: {
+                description: "JSON pointer to the request field that caused the error",
+                type: String,
+            },
         },
-        status: Number,
-        title: { required: true, type: String },
+        status: { description: "HTTP status code for this error", type: Number },
+        title: { description: "Short summary of the error", required: true, type: String },
     });
     schema.add({ apiErrors: errorSchema });
 }

package/dist/example.js

@@ -65,19 +65,19 @@ mongoose_1.default
     logger_1.logger.error("Error connecting to mongo ".concat(err));
 });
 var userSchema = new mongoose_1.Schema({
-    admin: { default: false, type: Boolean },
-    username: String,
+    admin: { default: false, description: "Whether the user has admin privileges", type: Boolean },
+    username: { description: "The user's username", type: String },
 });
 userSchema.plugin(passport_local_mongoose_1.default, { usernameField: "email" });
 userSchema.plugin(plugins_1.createdUpdatedPlugin);
 userSchema.plugin(plugins_1.baseUserPlugin);
 var UserModel = (0, mongoose_1.model)("User", userSchema);
 var schema = new mongoose_1.Schema({
-    calories: Number,
-    created: Date,
-    hidden: { default: false, type: Boolean },
-    name: String,
-    ownerId: { ref: "User", type: "ObjectId" },
+    calories: { description: "Number of calories in the food", type: Number },
+    created: { description: "When this food was created", type: Date },
+    hidden: { default: false, description: "Whether this food is hidden from listings", type: Boolean },
+    name: { description: "The name of the food", type: String },
+    ownerId: { description: "The user who owns this food entry", ref: "User", type: "ObjectId" },
 });
 var FoodModel = (0, mongoose_1.model)("Food", schema);
 function getBaseServer() {

package/dist/expressServer.d.ts

@@ -1,8 +1,9 @@
-import * as Sentry from "@sentry/node";
+import * as Sentry from "@sentry/bun";
 import express, { type Router } from "express";
 import type jwt from "jsonwebtoken";
 import type { ModelRouterOptions } from "./api";
 import { type UserModel as UserMongooseModel } from "./auth";
+import { type GitHubAuthOptions } from "./githubAuth";
 import { type LoggingOptions } from "./logger";
 export declare function setupEnvironment(): void;
 export type AddRoutes = (router: Router, options?: Partial<ModelRouterOptions<any>>) => void;
@@ -19,11 +20,16 @@ export interface SetupServerOptions {
     addRoutes: AddRoutes;
     loggingOptions?: LoggingOptions;
     authOptions?: AuthOptions;
+    /**
+     * GitHub OAuth configuration. When provided, enables GitHub authentication.
+     * Requires the user schema to have GitHub fields (use githubUserPlugin).
+     */
+    githubAuth?: GitHubAuthOptions;
     skipListen?: boolean;
     corsOrigin?: string | boolean | RegExp | Array<boolean | string | RegExp> | ((requestOrigin: string | undefined, callback: (err: Error | null, origin?: boolean | string | RegExp | Array<boolean | string | RegExp>) => void) => void);
     addMiddleware?: AddRoutes;
     ignoreTraces?: string[];
-    sentryOptions?: Sentry.NodeOptions;
+    sentryOptions?: Sentry.BunOptions;
 }
 export declare function setupServer(options: SetupServerOptions): express.Application;
 export declare function cronjob(name: string, schedule: "hourly" | "minutely" | string, callback: () => void): void;

package/dist/expressServer.js

@@ -104,7 +104,7 @@ exports.createRouterWithAuth = createRouterWithAuth;
 exports.setupServer = setupServer;
 exports.cronjob = cronjob;
 exports.wrapScript = wrapScript;
-var Sentry = __importStar(require("@sentry/node"));
+var Sentry = __importStar(require("@sentry/bun"));
 var openapi_1 = __importDefault(require("@wesleytodd/openapi"));
 var cors_1 = __importDefault(require("cors"));
 var cron_1 = __importDefault(require("cron"));
@@ -115,6 +115,7 @@ var passport_1 = __importDefault(require("passport"));
 var qs_1 = __importDefault(require("qs"));
 var auth_1 = require("./auth");
 var errors_1 = require("./errors");
+var githubAuth_1 = require("./githubAuth");
 var logger_1 = require("./logger");
 var notifiers_1 = require("./notifiers");
 var openApiEtag_1 = require("./openApiEtag");
@@ -284,6 +285,11 @@ function initializeRoutes(UserModel, addRoutes, options) {
         app.use("/swagger", oapi.swaggerui());
     }
     (0, auth_1.addMeRoutes)(app, UserModel, options === null || options === void 0 ? void 0 : options.authOptions);
+    // Set up GitHub OAuth if configured
+    if (options.githubAuth) {
+        (0, githubAuth_1.setupGitHubAuth)(app, UserModel, options.githubAuth);
+        (0, githubAuth_1.addGitHubAuthRoutes)(app, UserModel, options.githubAuth, options.authOptions);
+    }
     addRoutes(app, { openApi: oapi });
     Sentry.setupExpressErrorHandler(app);
     // Catch any thrown APIErrors and return them in an OpenAPI compatible format
@@ -308,6 +314,7 @@ function setupServer(options) {
             addMiddleware: options.addMiddleware,
             authOptions: options.authOptions,
             corsOrigin: options.corsOrigin,
+            githubAuth: options.githubAuth,
         });
     }
     catch (error) {

package/dist/githubAuth.d.ts

@@ -0,0 +1,64 @@
+import type express from "express";
+import { type Profile } from "passport-github2";
+import { type UserModel } from "./auth";
+import type { AuthOptions } from "./expressServer";
+/** Options for configuring GitHub OAuth authentication */
+export interface GitHubAuthOptions {
+    /** GitHub OAuth Client ID */
+    clientId: string;
+    /** GitHub OAuth Client Secret */
+    clientSecret: string;
+    /** Callback URL for GitHub OAuth (e.g., https://yourapp.com/auth/github/callback) */
+    callbackURL: string;
+    /** OAuth scopes to request from GitHub. Defaults to ["user:email"] */
+    scope?: string[];
+    /**
+     * Whether to allow linking GitHub to existing accounts.
+     * If true, authenticated users can link their GitHub account.
+     * Defaults to true.
+     */
+    allowAccountLinking?: boolean;
+    /**
+     * Custom function to handle user creation or lookup from GitHub profile.
+     * If not provided, a default implementation will be used.
+     */
+    findOrCreateUser?: (profile: Profile, accessToken: string, refreshToken: string, existingUser?: any) => Promise<any>;
+}
+/** Fields added to user documents for GitHub authentication */
+export interface GitHubUserFields {
+    /** GitHub user ID */
+    githubId?: string;
+    /** GitHub username */
+    githubUsername?: string;
+    /** GitHub profile URL */
+    githubProfileUrl?: string;
+    /** GitHub avatar URL */
+    githubAvatarUrl?: string;
+}
+/**
+ * Plugin to add GitHub authentication fields to a user schema.
+ * Apply this plugin to your User schema if you want to enable GitHub auth.
+ *
+ * @example
+ * ```typescript
+ * import {githubUserPlugin} from "@terreno/api";
+ *
+ * userSchema.plugin(githubUserPlugin);
+ * ```
+ */
+export declare function githubUserPlugin(schema: any): void;
+/**
+ * Sets up GitHub OAuth authentication strategy.
+ * Call this after setupAuth() in your server initialization.
+ */
+export declare function setupGitHubAuth(_app: express.Application, userModel: UserModel, githubOptions: GitHubAuthOptions): void;
+/**
+ * Adds GitHub OAuth routes to the Express application.
+ *
+ * Routes added:
+ * - GET /auth/github - Initiates GitHub OAuth flow
+ * - GET /auth/github/callback - Handles GitHub OAuth callback
+ * - POST /auth/github/link - Links GitHub account to authenticated user (requires JWT auth)
+ * - DELETE /auth/github/unlink - Unlinks GitHub account from authenticated user (requires JWT auth)
+ */
+export declare function addGitHubAuthRoutes(app: express.Application, userModel: UserModel, githubOptions: GitHubAuthOptions, authOptions?: AuthOptions): void;

package/dist/githubAuth.js

@@ -0,0 +1,293 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubUserPlugin = githubUserPlugin;
+exports.setupGitHubAuth = setupGitHubAuth;
+exports.addGitHubAuthRoutes = addGitHubAuthRoutes;
+var passport_1 = __importDefault(require("passport"));
+var passport_github2_1 = require("passport-github2");
+var auth_1 = require("./auth");
+var errors_1 = require("./errors");
+var logger_1 = require("./logger");
+/**
+ * Plugin to add GitHub authentication fields to a user schema.
+ * Apply this plugin to your User schema if you want to enable GitHub auth.
+ *
+ * @example
+ * ```typescript
+ * import {githubUserPlugin} from "@terreno/api";
+ *
+ * userSchema.plugin(githubUserPlugin);
+ * ```
+ */
+function githubUserPlugin(schema) {
+    schema.add({
+        githubAvatarUrl: { type: String },
+        githubId: { index: true, sparse: true, type: String, unique: true },
+        githubProfileUrl: { type: String },
+        githubUsername: { type: String },
+    });
+}
+/**
+ * Sets up GitHub OAuth authentication strategy.
+ * Call this after setupAuth() in your server initialization.
+ */
+function setupGitHubAuth(_app, userModel, githubOptions) {
+    var _this = this;
+    var _a;
+    var scope = (_a = githubOptions.scope) !== null && _a !== void 0 ? _a : ["user:email"];
+    passport_1.default.use("github", new passport_github2_1.Strategy({
+        callbackURL: githubOptions.callbackURL,
+        clientID: githubOptions.clientId,
+        clientSecret: githubOptions.clientSecret,
+        passReqToCallback: true,
+        scope: scope,
+    }, function (req, accessToken, refreshToken, profile, done) { return __awaiter(_this, void 0, void 0, function () {
+        var existingUser, user, githubId, existingGitHubUser, user, email, existingEmailUser, newUser, error_1;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        return __generator(this, function (_j) {
+            switch (_j.label) {
+                case 0:
+                    _j.trys.push([0, 13, , 14]);
+                    existingUser = req.user;
+                    if (!githubOptions.findOrCreateUser) return [3 /*break*/, 2];
+                    return [4 /*yield*/, githubOptions.findOrCreateUser(profile, accessToken, refreshToken, existingUser)];
+                case 1:
+                    user = _j.sent();
+                    return [2 /*return*/, done(null, user)];
+                case 2:
+                    githubId = profile.id;
+                    return [4 /*yield*/, userModel.findOne({ githubId: githubId })];
+                case 3:
+                    existingGitHubUser = _j.sent();
+                    if (!existingUser) return [3 /*break*/, 7];
+                    if (!githubOptions.allowAccountLinking) {
+                        return [2 /*return*/, done(new errors_1.APIError({ status: 400, title: "Account linking is disabled" }))];
+                    }
+                    if (existingGitHubUser &&
+                        existingGitHubUser._id.toString() !== existingUser._id.toString()) {
+                        return [2 /*return*/, done(new errors_1.APIError({
+                                status: 400,
+                                title: "This GitHub account is already linked to another user",
+                            }))];
+                    }
+                    return [4 /*yield*/, userModel.findById(existingUser._id)];
+                case 4:
+                    user = _j.sent();
+                    if (!user) return [3 /*break*/, 6];
+                    user.githubId = githubId;
+                    user.githubUsername = profile.username;
+                    user.githubProfileUrl = profile.profileUrl;
+                    user.githubAvatarUrl = (_b = (_a = profile.photos) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.value;
+                    return [4 /*yield*/, user.save()];
+                case 5:
+                    _j.sent();
+                    return [2 /*return*/, done(null, user)];
+                case 6: return [2 /*return*/, done(new errors_1.APIError({ status: 404, title: "User not found" }))];
+                case 7:
+                    // Case 2: User with this GitHub ID exists - log them in
+                    if (existingGitHubUser) {
+                        return [2 /*return*/, done(null, existingGitHubUser)];
+                    }
+                    email = (_d = (_c = profile.emails) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.value;
+                    if (!email) return [3 /*break*/, 11];
+                    return [4 /*yield*/, userModel.findOne({ email: email })];
+                case 8:
+                    existingEmailUser = _j.sent();
+                    if (!existingEmailUser) return [3 /*break*/, 11];
+                    if (!(githubOptions.allowAccountLinking !== false)) return [3 /*break*/, 10];
+                    existingEmailUser.githubId = githubId;
+                    existingEmailUser.githubUsername = profile.username;
+                    existingEmailUser.githubProfileUrl = profile.profileUrl;
+                    existingEmailUser.githubAvatarUrl = (_f = (_e = profile.photos) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.value;
+                    return [4 /*yield*/, existingEmailUser.save()];
+                case 9:
+                    _j.sent();
+                    return [2 /*return*/, done(null, existingEmailUser)];
+                case 10: return [2 /*return*/, done(new errors_1.APIError({
+                        status: 400,
+                        title: "An account with this email already exists. Please log in and link your GitHub account.",
+                    }))];
+                case 11:
+                    newUser = new userModel({
+                        admin: false,
+                        email: email,
+                        githubAvatarUrl: (_h = (_g = profile.photos) === null || _g === void 0 ? void 0 : _g[0]) === null || _h === void 0 ? void 0 : _h.value,
+                        githubId: githubId,
+                        githubProfileUrl: profile.profileUrl,
+                        githubUsername: profile.username,
+                    });
+                    return [4 /*yield*/, newUser.save()];
+                case 12:
+                    _j.sent();
+                    return [2 /*return*/, done(null, newUser)];
+                case 13:
+                    error_1 = _j.sent();
+                    logger_1.logger.error("GitHub auth error: ".concat(error_1));
+                    return [2 /*return*/, done(error_1)];
+                case 14: return [2 /*return*/];
+            }
+        });
+    }); }));
+}
+/**
+ * Adds GitHub OAuth routes to the Express application.
+ *
+ * Routes added:
+ * - GET /auth/github - Initiates GitHub OAuth flow
+ * - GET /auth/github/callback - Handles GitHub OAuth callback
+ * - POST /auth/github/link - Links GitHub account to authenticated user (requires JWT auth)
+ * - DELETE /auth/github/unlink - Unlinks GitHub account from authenticated user (requires JWT auth)
+ */
+function addGitHubAuthRoutes(app, userModel, githubOptions, authOptions) {
+    var _this = this;
+    var router = require("express").Router();
+    // Initiate GitHub OAuth flow
+    router.get("/github", function (req, _res, next) {
+        // Store the return URL in session or query for redirect after auth
+        var returnTo = req.query.returnTo;
+        if (returnTo) {
+            req.session = req.session || {};
+            req.session.returnTo = returnTo;
+        }
+        next();
+    }, passport_1.default.authenticate("github", { session: false }));
+    // GitHub OAuth callback
+    router.get("/github/callback", passport_1.default.authenticate("github", {
+        failureRedirect: "/auth/github/failure",
+        session: false,
+    }), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+        var tokens, returnTo, url, error_2;
+        var _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    _e.trys.push([0, 2, , 3]);
+                    return [4 /*yield*/, (0, auth_1.generateTokens)(req.user, authOptions)];
+                case 1:
+                    tokens = _e.sent();
+                    returnTo = (_a = req.session) === null || _a === void 0 ? void 0 : _a.returnTo;
+                    // If there's a return URL, redirect with tokens as query params
+                    if (returnTo) {
+                        url = new URL(returnTo);
+                        url.searchParams.set("token", tokens.token || "");
+                        if (tokens.refreshToken) {
+                            url.searchParams.set("refreshToken", tokens.refreshToken);
+                        }
+                        url.searchParams.set("userId", ((_c = (_b = req.user) === null || _b === void 0 ? void 0 : _b._id) === null || _c === void 0 ? void 0 : _c.toString()) || "");
+                        return [2 /*return*/, res.redirect(url.toString())];
+                    }
+                    // Otherwise return JSON response
+                    return [2 /*return*/, res.json({
+                            data: {
+                                refreshToken: tokens.refreshToken,
+                                token: tokens.token,
+                                userId: (_d = req.user) === null || _d === void 0 ? void 0 : _d._id,
+                            },
+                        })];
+                case 2:
+                    error_2 = _e.sent();
+                    logger_1.logger.error("GitHub callback error: ".concat(error_2));
+                    return [2 /*return*/, res.status(500).json({ message: "Authentication failed" })];
+                case 3: return [2 /*return*/];
+            }
+        });
+    }); });
+    // GitHub auth failure handler
+    router.get("/github/failure", function (_req, res) {
+        return res.status(401).json({ message: "GitHub authentication failed" });
+    });
+    // Link GitHub to existing authenticated user
+    if (githubOptions.allowAccountLinking !== false) {
+        router.get("/github/link", function (req, res, next) {
+            // Require JWT authentication for linking
+            passport_1.default.authenticate("jwt", { session: false }, function (err, user) {
+                if (err || !user) {
+                    res.status(401).json({ message: "Authentication required to link GitHub account" });
+                    return;
+                }
+                req.user = user;
+                next();
+            })(req, res, next);
+        }, passport_1.default.authenticate("github", { session: false }));
+        // Unlink GitHub from user account
+        router.delete("/github/unlink", passport_1.default.authenticate("jwt", { session: false }), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+            var user, hasPassword, error_3;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!req.user) {
+                            return [2 /*return*/, res.status(401).json({ message: "Authentication required" })];
+                        }
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 4, , 5]);
+                        return [4 /*yield*/, userModel.findById(req.user._id).select("+hash +salt")];
+                    case 2:
+                        user = _a.sent();
+                        if (!user) {
+                            return [2 /*return*/, res.status(404).json({ message: "User not found" })];
+                        }
+                        hasPassword = !!user.hash || !!user.salt;
+                        if (!hasPassword) {
+                            return [2 /*return*/, res.status(400).json({
+                                    message: "Cannot unlink GitHub account without another authentication method. Set a password first.",
+                                })];
+                        }
+                        user.githubId = undefined;
+                        user.githubUsername = undefined;
+                        user.githubProfileUrl = undefined;
+                        user.githubAvatarUrl = undefined;
+                        return [4 /*yield*/, user.save()];
+                    case 3:
+                        _a.sent();
+                        return [2 /*return*/, res.json({ data: { message: "GitHub account unlinked successfully" } })];
+                    case 4:
+                        error_3 = _a.sent();
+                        logger_1.logger.error("GitHub unlink error: ".concat(error_3));
+                        return [2 /*return*/, res.status(500).json({ message: "Failed to unlink GitHub account" })];
+                    case 5: return [2 /*return*/];
+                }
+            });
+        }); });
+    }
+    app.use("/auth", router);
+}

package/dist/githubAuth.test.d.ts

@@ -0,0 +1 @@
+export {};