@ultrst-armada/kloks 1.7.0 → 1.8.0

package/packages/backend/dist/chunk-KKRWZDMN.js

@@ -0,0 +1,237 @@
+// src/storage/BaseStorageAdapter.ts
+import { SkipoBase } from "@ultrst-armada/kloks/functions";
+var BaseStorageAdapter = class extends SkipoBase {
+  config;
+  constructor(config) {
+    super({ name: "BaseStorageAdapter" });
+    this.config = config;
+  }
+  async deleteFolder(pathStr) {
+    const items = await this.list(pathStr);
+    let count = 0;
+    for (const item of items) {
+      await this.delete(item.path);
+      count++;
+    }
+    return { success: true, deletedCount: count };
+  }
+  async renameFolder(oldPath, newPath) {
+    const items = await this.list(oldPath);
+    let count = 0;
+    for (const item of items) {
+      const rel = item.path.startsWith(oldPath) ? item.path.slice(oldPath.length).replace(/^\/+/, "") : item.path;
+      const target = `${newPath.replace(/\/+$/, "")}/${rel}`;
+      const data = await this.read(item.path);
+      await this.write(target, data);
+      await this.delete(item.path);
+      count++;
+    }
+    return { success: true, movedCount: count };
+  }
+  async ensureDirectory(pathStr) {
+    await this.mkdir(pathStr);
+  }
+  async testConnection() {
+    const start = performance.now();
+    try {
+      await this.list("");
+      return { ok: true, latencyMs: Math.round(performance.now() - start) };
+    } catch (e) {
+      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
+    }
+  }
+  normalizePath(p) {
+    return p.replace(/\\/g, "/").replace(/^\/+/, "");
+  }
+  getExtension(p) {
+    const parts = p.split(".");
+    return parts.length > 1 ? parts[parts.length - 1] : "";
+  }
+};
+
+// src/storage/GoogleDriveOAuth.ts
+var AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_URL = "https://oauth2.googleapis.com/token";
+function createGoogleDriveAuthorizationUrl(config, state, codeChallenge) {
+  const params = new URLSearchParams({
+    client_id: config.clientId,
+    redirect_uri: config.redirectUri,
+    response_type: "code",
+    access_type: "offline",
+    prompt: "consent",
+    scope: (config.scopes || ["https://www.googleapis.com/auth/drive.file"]).join(" "),
+    state
+  });
+  if (codeChallenge) {
+    params.set("code_challenge", codeChallenge);
+    params.set("code_challenge_method", "S256");
+  }
+  return `${AUTH_URL}?${params.toString()}`;
+}
+async function exchangeGoogleDriveCode(config, code, codeVerifier) {
+  const body = new URLSearchParams({
+    client_id: config.clientId,
+    redirect_uri: config.redirectUri,
+    code,
+    grant_type: "authorization_code"
+  });
+  if (config.clientSecret) body.set("client_secret", config.clientSecret);
+  if (codeVerifier) body.set("code_verifier", codeVerifier);
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!response.ok) throw new Error(`Google OAuth token exchange failed: ${response.status}`);
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
+    tokenType: data.token_type
+  };
+}
+async function refreshGoogleDriveAccessToken(clientId, refreshToken) {
+  const body = new URLSearchParams({
+    client_id: clientId,
+    refresh_token: refreshToken,
+    grant_type: "refresh_token"
+  });
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (!response.ok) throw new Error(`Google OAuth refresh failed: ${response.status}`);
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    expiresAt: data.expires_in ? Date.now() + Number(data.expires_in) * 1e3 : void 0,
+    tokenType: data.token_type
+  };
+}
+
+// src/storage/GoogleDriveAdapter.ts
+var GoogleDriveAdapter = class extends BaseStorageAdapter {
+  async token() {
+    const accessToken = this.config.googleAccessToken || this.config.accessKey;
+    const expiresAt = Number(this.config.googleAccessTokenExpiresAt || 0);
+    if (accessToken && (!expiresAt || expiresAt > Date.now() + 6e4)) return accessToken;
+    const refreshToken = this.config.googleRefreshToken;
+    const clientId = this.config.googleClientId;
+    if (!refreshToken || !clientId) throw new Error("Google Drive OAuth credentials are incomplete.");
+    const refreshed = await refreshGoogleDriveAccessToken(clientId, refreshToken);
+    this.config.googleAccessToken = refreshed.accessToken;
+    this.config.googleAccessTokenExpiresAt = refreshed.expiresAt;
+    return refreshed.accessToken;
+  }
+  async request(url, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${await this.token()}`);
+    return fetch(url, { ...init, headers });
+  }
+  async findChild(parentId, name) {
+    const q = `'${parentId}' in parents and name = '${name.replace(/'/g, "\\'")}' and trashed = false`;
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=10`);
+    if (!res.ok) throw new Error(`Google Drive lookup failed: ${res.status}`);
+    const data = await res.json();
+    return data.files?.[0] || null;
+  }
+  async resolveParent(relativeDir, create = false) {
+    let parent = this.config.googleRootFolderId || this.config.rootFolderId || "root";
+    for (const part of this.normalizePath(relativeDir).split("/").filter(Boolean)) {
+      let child = await this.findChild(parent, part);
+      if (!child && create) {
+        const res = await this.request("https://www.googleapis.com/drive/v3/files", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ name: part, mimeType: "application/vnd.google-apps.folder", parents: [parent] })
+        });
+        if (!res.ok) throw new Error(`Google Drive folder creation failed: ${res.status}`);
+        child = await res.json();
+      }
+      if (!child) throw new Error(`Google Drive directory not found: ${part}`);
+      parent = child.id;
+    }
+    return parent;
+  }
+  split(pathStr) {
+    const key = this.normalizePath(pathStr);
+    const i = key.lastIndexOf("/");
+    return i < 0 ? { dir: "", name: key } : { dir: key.slice(0, i), name: key.slice(i + 1) };
+  }
+  async read(pathStr) {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir);
+    const file = await this.findChild(parent, name);
+    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}?alt=media`);
+    if (!res.ok) throw new Error(`Google Drive download failed: ${res.status}`);
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  async write(pathStr, data, contentType = "application/octet-stream") {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir, true);
+    const existing = await this.findChild(parent, name);
+    const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+    const form = new FormData();
+    form.append("metadata", new Blob([JSON.stringify({ name, mimeType: contentType, ...existing ? {} : { parents: [parent] } })], { type: "application/json" }));
+    form.append("file", new Blob([bytes], { type: contentType }));
+    const url = existing ? `https://www.googleapis.com/upload/drive/v3/files/${existing.id}?uploadType=multipart` : "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart";
+    const res = await this.request(url, { method: existing ? "PATCH" : "POST", body: form });
+    if (!res.ok) throw new Error(`Google Drive upload failed: ${res.status}`);
+  }
+  async delete(pathStr) {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir);
+    const file = await this.findChild(parent, name);
+    if (!file) return;
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files/${file.id}`, { method: "DELETE" });
+    if (!res.ok && res.status !== 404) throw new Error(`Google Drive delete failed: ${res.status}`);
+  }
+  async exists(pathStr) {
+    try {
+      await this.stat(pathStr);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async list(pathStr = "") {
+    const parent = await this.resolveParent(pathStr);
+    const q = `'${parent}' in parents and trashed = false`;
+    const res = await this.request(`https://www.googleapis.com/drive/v3/files?q=${encodeURIComponent(q)}&fields=files(id,name,size,modifiedTime,mimeType)&pageSize=1000`);
+    if (!res.ok) throw new Error(`Google Drive list failed: ${res.status}`);
+    const data = await res.json();
+    return (data.files || []).map((f) => ({ path: this.normalizePath(pathStr ? `${pathStr}/${f.name}` : f.name), size: Number(f.size || 0), modifiedAt: f.modifiedTime ? Date.parse(f.modifiedTime) : 0 }));
+  }
+  async stat(pathStr) {
+    const { dir, name } = this.split(pathStr);
+    const parent = await this.resolveParent(dir);
+    const file = await this.findChild(parent, name);
+    if (!file) throw new Error(`Google Drive file not found: ${pathStr}`);
+    return { path: pathStr, size: Number(file.size || 0), modifiedAt: file.modifiedTime ? Date.parse(file.modifiedTime) : 0 };
+  }
+  async mkdir(pathStr) {
+    await this.resolveParent(pathStr, true);
+  }
+  async testConnection() {
+    const start = performance.now();
+    try {
+      const res = await this.request("https://www.googleapis.com/drive/v3/about?fields=user");
+      if (!res.ok) throw new Error(`Google Drive authorization failed: ${res.status}`);
+      const data = await res.json();
+      return { ok: true, latencyMs: Math.round(performance.now() - start), details: { email: data.user?.emailAddress } };
+    } catch (e) {
+      return { ok: false, latencyMs: Math.round(performance.now() - start), error: e.message };
+    }
+  }
+};
+
+export {
+  BaseStorageAdapter,
+  createGoogleDriveAuthorizationUrl,
+  exchangeGoogleDriveCode,
+  refreshGoogleDriveAccessToken,
+  GoogleDriveAdapter
+};

package/packages/backend/dist/chunk-M4GSR46Y.js

@@ -0,0 +1,205 @@
+// src/auth/SessionManager.ts
+var SessionManager = class {
+  ttl;
+  constructor(ttlMs = 864e5) {
+    this.ttl = ttlMs;
+  }
+  generateToken(userId) {
+    return `sess::${userId}::${Date.now()}::${Math.random().toString(36).substring(2, 9)}`;
+  }
+  createSession(userId, role) {
+    return {
+      token: this.generateToken(userId),
+      userId,
+      role,
+      expiresAt: Date.now() + this.ttl
+    };
+  }
+  isValid(session) {
+    return Date.now() < session.expiresAt;
+  }
+};
+
+// src/auth/RateLimiter.ts
+var RateLimiter = class {
+  attempts = /* @__PURE__ */ new Map();
+  windowMs;
+  maxUser;
+  maxAdmin;
+  constructor(windowMs = 9e5, maxUser = 5, maxAdmin = 3) {
+    this.windowMs = windowMs;
+    this.maxUser = maxUser;
+    this.maxAdmin = maxAdmin;
+  }
+  check(identifier, isAdminAttempt = false) {
+    const now = Date.now();
+    let record = this.attempts.get(identifier);
+    if (!record || now - record.windowStart > this.windowMs) {
+      record = { count: 0, windowStart: now };
+      this.attempts.set(identifier, record);
+    }
+    record.count++;
+    const limit = isAdminAttempt ? this.maxAdmin : this.maxUser;
+    if (record.count > limit) {
+      throw new Error("Too many requests. Please try again later.");
+    }
+  }
+  reset(identifier) {
+    this.attempts.delete(identifier);
+  }
+};
+
+// src/auth/CanonicalAuthClient.ts
+var cleanBaseUrl = (value) => value.trim().replace(/\/+$/, "");
+var CanonicalAuthClient = class {
+  baseUrl;
+  fetcher;
+  credentials;
+  constructor(options) {
+    if (!options.baseUrl?.trim()) throw new Error("Canonical auth base URL is required.");
+    this.baseUrl = cleanBaseUrl(options.baseUrl);
+    this.fetcher = options.fetcher ?? fetch;
+    this.credentials = options.credentials ?? "include";
+  }
+  async request(path, init = {}) {
+    const response = await this.fetcher(`${this.baseUrl}/api/auth${path}`, {
+      ...init,
+      credentials: this.credentials,
+      headers: { "Content-Type": "application/json", ...init.headers ?? {} }
+    });
+    const text = await response.text();
+    let data = {};
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      data = { message: text };
+    }
+    return { status: response.status, data };
+  }
+  async signInEmail(email, password) {
+    const result = await this.request("/sign-in/email", {
+      method: "POST",
+      body: JSON.stringify({ email: email.trim().toLowerCase(), password })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Authentication failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async signUpEmail(email, password, name) {
+    const result = await this.request("/sign-up/email", {
+      method: "POST",
+      body: JSON.stringify({ email: email.trim().toLowerCase(), password, name: name.trim() })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Registration failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async signInGoogle(callbackURL) {
+    const result = await this.request("/sign-in/social", {
+      method: "POST",
+      body: JSON.stringify({ provider: "google", callbackURL })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Google sign-in failed." };
+    }
+    return {
+      success: true,
+      status: result.status,
+      user: result.data?.user,
+      session: result.data?.session,
+      redirectUrl: result.data?.url ?? result.data?.redirect
+    };
+  }
+  async requestGoogleDriveAccess(callbackURL) {
+    const result = await this.request("/link-social", {
+      method: "POST",
+      body: JSON.stringify({
+        provider: "google",
+        scopes: ["https://www.googleapis.com/auth/drive.file"],
+        ...callbackURL ? { callbackURL } : {}
+      })
+    });
+    if (result.status >= 400 || result.data?.error) {
+      return { success: false, status: result.status, error: result.data?.error?.message ?? result.data?.message ?? "Google Drive authorization failed." };
+    }
+    return { success: true, status: result.status, user: result.data?.user, session: result.data?.session };
+  }
+  async getSession(cookie) {
+    const headers = {};
+    if (cookie) headers.Cookie = cookie;
+    const result = await this.request("/get-session", { headers });
+    if (result.status >= 400 || !result.data?.user) return null;
+    return result.data;
+  }
+  async signOut() {
+    const result = await this.request("/sign-out", { method: "POST", body: "{}" });
+    return result.status < 400 && !result.data?.error;
+  }
+};
+function createCanonicalAuthClient(baseUrl, fetcher) {
+  return new CanonicalAuthClient({ baseUrl, fetcher });
+}
+
+// src/auth/UnifiedAuthCore.ts
+function requireAuthBaseUrl(env) {
+  const baseUrl = String(env?.SRKL_AUTH_BASE_URL ?? (typeof process !== "undefined" ? process.env.SRKL_AUTH_BASE_URL : "") ?? "").trim();
+  if (!baseUrl) {
+    throw new Error("SRKL_AUTH_BASE_URL is required. Local application auth is not supported.");
+  }
+  return baseUrl;
+}
+async function loginSystemUser(email, rawPass, isAdmin, _queryDb, env) {
+  if (!email?.trim() || !rawPass) return { success: false, status: 400, error: "Email and password are required" };
+  try {
+    const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
+    const result = await client.signInEmail(email, rawPass);
+    if (!result.success || !result.user) {
+      return { success: false, status: result.status, error: result.error ?? "Invalid email or password" };
+    }
+    if (isAdmin && result.user.role !== "admin") {
+      return { success: false, status: 403, error: "Insufficient administrative privileges" };
+    }
+    return {
+      success: true,
+      status: result.status,
+      user: {
+        ...result.user,
+        username: result.user.username ?? result.user.email.split("@")[0],
+        role: result.user.role ?? "user",
+        status: result.user.status ?? "ACTIVE"
+      },
+      token: typeof result.session?.token === "string" ? result.session.token : void 0
+    };
+  } catch (error) {
+    return { success: false, status: 503, error: error instanceof Error ? error.message : "Canonical authentication service unavailable" };
+  }
+}
+async function resolveUserFromToken(tokenOrUserId, _queryDb, env) {
+  if (!tokenOrUserId) return null;
+  try {
+    const client = createCanonicalAuthClient(requireAuthBaseUrl(env));
+    const session = await client.getSession(
+      tokenOrUserId.startsWith("Bearer ") ? `better-auth.session_token=${tokenOrUserId.slice(7).trim()}` : void 0
+    );
+    if (!session?.user) return null;
+    return {
+      ...session.user,
+      username: session.user.username ?? session.user.email.split("@")[0],
+      role: session.user.role ?? "user",
+      status: session.user.status ?? "ACTIVE"
+    };
+  } catch {
+    return null;
+  }
+}
+
+export {
+  SessionManager,
+  RateLimiter,
+  CanonicalAuthClient,
+  createCanonicalAuthClient,
+  loginSystemUser,
+  resolveUserFromToken
+};

package/packages/backend/dist/chunk-RBQ4CW3T.js

@@ -0,0 +1,136 @@
+import {
+  ensureS3DirectoryMarker,
+  permanentDeleteS3Folder,
+  permanentDeleteS3Object,
+  renameS3Folder
+} from "./chunk-SHZAQTIT.js";
+import {
+  BaseStorageAdapter
+} from "./chunk-KKRWZDMN.js";
+
+// src/storage/S3Adapter.ts
+var S3Client;
+var PutObjectCommand;
+var GetObjectCommand;
+var ListObjectsV2Command;
+var HeadObjectCommand;
+var S3Adapter = class extends BaseStorageAdapter {
+  client;
+  bucket;
+  constructor(config) {
+    super(config);
+    this.bucket = config.bucket || "";
+  }
+  async ensureClient() {
+    if (this.client) return;
+    try {
+      const aws = await import("@aws-sdk/client-s3");
+      S3Client = aws.S3Client;
+      PutObjectCommand = aws.PutObjectCommand;
+      GetObjectCommand = aws.GetObjectCommand;
+      ListObjectsV2Command = aws.ListObjectsV2Command;
+      HeadObjectCommand = aws.HeadObjectCommand;
+      this.client = new S3Client({
+        region: this.config.region || "us-east-1",
+        endpoint: this.config.endpoint,
+        credentials: {
+          accessKeyId: this.config.accessKey,
+          secretAccessKey: this.config.secretKey
+        },
+        forcePathStyle: Boolean(this.config.endpoint)
+      });
+    } catch (e) {
+      throw new Error(`@aws-sdk/client-s3 failed to initialize: ${e.message}`);
+    }
+  }
+  async read(pathStr) {
+    await this.ensureClient();
+    const command = new GetObjectCommand({ Bucket: this.bucket, Key: this.normalizePath(pathStr) });
+    const response = await this.client.send(command);
+    return response.Body ? await response.Body.transformToByteArray() : new Uint8Array();
+  }
+  async write(pathStr, data, contentType = "application/octet-stream") {
+    await this.ensureClient();
+    const body = typeof data === "string" ? Buffer.from(data, "utf-8") : Buffer.from(data);
+    const command = new PutObjectCommand({
+      Bucket: this.bucket,
+      Key: this.normalizePath(pathStr),
+      Body: body,
+      ContentType: contentType
+    });
+    await this.client.send(command);
+  }
+  async delete(pathStr) {
+    await this.ensureClient();
+    await permanentDeleteS3Object(this.client, this.bucket, this.normalizePath(pathStr));
+  }
+  async deleteFolder(pathStr) {
+    await this.ensureClient();
+    return await permanentDeleteS3Folder(this.client, this.bucket, this.normalizePath(pathStr));
+  }
+  async renameFolder(oldPath, newPath) {
+    await this.ensureClient();
+    return await renameS3Folder(this.client, this.bucket, this.normalizePath(oldPath), this.normalizePath(newPath));
+  }
+  async ensureDirectory(pathStr) {
+    await this.ensureClient();
+    await ensureS3DirectoryMarker(this.client, this.bucket, this.normalizePath(pathStr));
+  }
+  async exists(pathStr) {
+    await this.ensureClient();
+    try {
+      const command = new HeadObjectCommand({ Bucket: this.bucket, Key: this.normalizePath(pathStr) });
+      await this.client.send(command);
+      return true;
+    } catch (e) {
+      if (e.name === "NotFound" || e.$metadata?.httpStatusCode === 404) return false;
+      throw e;
+    }
+  }
+  async list(pathStr = "") {
+    await this.ensureClient();
+    const prefix = pathStr ? this.normalizePath(pathStr).replace(/\/+$/, "") + "/" : "";
+    const command = new ListObjectsV2Command({ Bucket: this.bucket, Prefix: prefix });
+    const response = await this.client.send(command);
+    return (response.Contents || []).map((item) => ({
+      path: item.Key,
+      size: item.Size || 0,
+      modifiedAt: item.LastModified ? item.LastModified.getTime() : 0
+    }));
+  }
+  async stat(pathStr) {
+    await this.ensureClient();
+    const command = new HeadObjectCommand({ Bucket: this.bucket, Key: this.normalizePath(pathStr) });
+    const response = await this.client.send(command);
+    return {
+      path: pathStr,
+      size: response.ContentLength || 0,
+      modifiedAt: response.LastModified ? response.LastModified.getTime() : 0
+    };
+  }
+  async mkdir(pathStr) {
+    await this.ensureDirectory(pathStr);
+  }
+  async testConnection() {
+    const start = performance.now();
+    try {
+      await this.ensureClient();
+      const res = await this.client.send(new ListObjectsV2Command({ Bucket: this.bucket, MaxKeys: 1 }));
+      return {
+        ok: true,
+        latencyMs: Math.round(performance.now() - start),
+        details: { bucket: this.bucket, keyCount: res.KeyCount ?? 0 }
+      };
+    } catch (e) {
+      return {
+        ok: false,
+        latencyMs: Math.round(performance.now() - start),
+        error: e.message
+      };
+    }
+  }
+};
+
+export {
+  S3Adapter
+};