@yunsoft/yuncms-api 0.1.24 → 0.1.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-api",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Express API runtime and bundled Studio server for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -35,10 +35,11 @@
     "@modelcontextprotocol/node": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@node-saml/node-saml": "5.1.0",
-    "@yunsoft/yuncms-core": "0.1.24",
+    "@yunsoft/yuncms-core": "0.1.26",
     "express": "5.2.1",
     "ldapts": "9.0.0",
     "openid-client": "6.8.7",
+    "proxy-addr": "2.0.8",
     "zod": "4.4.3"
   },
   "funding": {

package/src/audit-hooks.js

@@ -0,0 +1,27 @@
+import { createSystemAccountability } from '@yunsoft/yuncms-core';
+import { INTERNAL_AUDIT_EVENTS } from './audit-events.js';
+
+export function registerInternalAudit({ emitter, services, database, logger }) {
+  const AuditService = services.AuditService;
+  const systemAccountability = createSystemAccountability();
+  for (const event of INTERNAL_AUDIT_EVENTS) {
+    emitter.registerAction(event, async (payload, context) => {
+      try {
+        const audit = new AuditService({ accountability: systemAccountability,
+          database: context.database ?? database, logger, requestId: context.requestId ?? null });
+        await audit.record({
+          user: context.accountability?.user ?? null,
+          action: event,
+          collection: context.collection ?? null,
+          itemKey: payload?.key ?? null,
+          requestId: context.requestId ?? null,
+          payload,
+        });
+      } catch (error) {
+        logger.error('YunCMS audit write failed after committed mutation', {
+          event, requestId: context.requestId ?? null, code: error?.code, error,
+        });
+      }
+    }, { extensionId: 'core.audit', priority: 1000 });
+  }
+}

package/src/automations/service.js

@@ -146,7 +146,8 @@ export class AiAutomationsService {
   async enqueue(event, payload, context) {
     if (!context.collection || context.collection.startsWith('yuncms_')
       || context[AI_AUTOMATION_ORIGIN] === true) return;
-    const [rows] = await this.database.query('SELECT * FROM yuncms_ai_automations WHERE collection = ? AND enabled = 1', [context.collection]);
+    const database = context.database ?? this.database;
+    const [rows] = await database.query('SELECT * FROM yuncms_ai_automations WHERE collection = ? AND enabled = 1', [context.collection]);
     for (const row of rows) {
       const rule = automationFromRow(row);
       if (!matchesAutomation(rule, event, payload, context)) continue;
@@ -154,7 +155,7 @@ export class AiAutomationsService {
       if (payload.key == null) continue;
       const key = String(payload.key);
       if (!key || key.length > 191) continue;
-      await withTransaction(this.database, async (connection) => {
+      await withTransaction(database, async (connection) => {
         const current = await this.read(rule.id, connection, { lock: true });
         if (!current || current.revision !== rule.revision || !current.enabled) return;
         const [pending] = await connection.query(

package/src/error-response.js

@@ -39,6 +39,22 @@ const STATUS_BY_CODE = new Map([
   ['INVALID_PAYLOAD', 400],
   ['INVALID_PASSWORD', 400],
   ['INVALID_TOKEN', 400],
+  ['INVALID_AUTH_TRANSACTION', 400],
+  ['INVALID_AUTH_PROVIDER', 400],
+  ['INVALID_EXTERNAL_IDENTITY', 400],
+  ['INVALID_REDIRECT_TARGET', 400],
+  ['AUTH_PROVIDER_FLOW_MISMATCH', 400],
+  ['AUTH_PROVIDER_NOT_FOUND', 404],
+  ['VERIFIED_EXTERNAL_EMAIL_REQUIRED', 403],
+  ['EXTERNAL_USER_INACTIVE', 403],
+  ['EXTERNAL_ADMIN_LINK_FORBIDDEN', 403],
+  ['EXTERNAL_IDENTITY_NOT_LINKED', 403],
+  ['EXTERNAL_EMAIL_CONFLICT', 409],
+  ['INVALID_AUTH_PROVIDER_CONFIG', 503],
+  ['EXTERNAL_JIT_ROLE_REQUIRED', 503],
+  ['INVALID_EXTERNAL_JIT_ROLE', 503],
+  ['EXTERNAL_IDENTITY_INVALID', 502],
+  ['EXTERNAL_USERINFO_FAILED', 502],
   ['INVALID_ROLE', 400],
   ['INVALID_PERMISSION', 400],
   ['INVALID_SCHEMA_PAYLOAD', 400],

package/src/server.js

@@ -23,7 +23,7 @@ import { createApp } from './app.js';
 import { AiAssistantService } from './ai/service.js';
 import { loadOrCreateAiSettingsKey } from './ai/secret-key.js';
 import { AiSettingsStore } from './ai/settings-store.js';
-import { INTERNAL_AUDIT_EVENTS } from './audit-events.js';
+import { registerInternalAudit } from './audit-hooks.js';
 import { loadExternalAuthConfig } from './external-auth/config.js';
 import { ExternalAuthProviderRegistry } from './external-auth/providers.js';
 import { loadExtensionRuntime } from './extensions/runtime.js';
@@ -88,28 +88,6 @@ let extensionRuntime = null;
 let automationWorker = null;
 let shuttingDown = false;
 
-function registerInternalAudit({ emitter, services }) {
-  const AuditService = services.AuditService;
-  const systemAccountability = createSystemAccountability();
-  for (const event of INTERNAL_AUDIT_EVENTS) {
-    emitter.registerAction(event, async (payload, context) => {
-      try {
-        const audit = new AuditService({ accountability: systemAccountability, database: pool, logger, requestId: context.requestId ?? null });
-        await audit.record({
-          user: context.accountability?.user ?? null,
-          action: event,
-          collection: context.collection ?? null,
-          itemKey: payload?.key ?? null,
-          requestId: context.requestId ?? null,
-          payload,
-        });
-      } catch (error) {
-        logger.error('YunCMS audit write failed after committed mutation', { event, requestId: context.requestId ?? null, code: error?.code, error });
-      }
-    }, { extensionId: 'core.audit', priority: 1000 });
-  }
-}
-
 async function start() {
   await assertDatabaseCompatible(pool);
   const aiKey = await loadOrCreateAiSettingsKey();
@@ -141,7 +119,7 @@ async function start() {
   const aiRouter = createAiRouter({ assistant: aiAssistant, settingsStore: aiSettingsStore });
   const mcpSettingsStore = new McpSettingsStore({ database: pool });
   mailer?.setEmitter(emitter);
-  registerInternalAudit({ emitter, services });
+  registerInternalAudit({ emitter, services, database: pool, logger });
   const automationOptions = { assistant: aiAssistant, settingsStore: aiSettingsStore, schemaCache };
   const automations = new AiAutomationsService({ ...automationOptions, database: pool,
     accountability: createSystemAccountability(), services, emitter, storage, logger });
@@ -183,7 +161,11 @@ async function start() {
 
   await extensionRuntime.init('app.beforeStart');
   server = await new Promise((resolve, reject) => {
-    const listeningServer = app.listen(config.server.port, config.server.host, () => {
+    const listeningServer = app.listen(config.server.port, config.server.host, (error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
       logger.info('YunCMS API listening', { host: config.server.host, port: config.server.port });
       resolve(listeningServer);
     });
@@ -233,7 +215,8 @@ for (const signal of ['SIGINT', 'SIGTERM']) {
 
 start().catch(async (error) => {
   logger.error('YunCMS API failed to start', { code: error?.code, error });
-  await redisClient?.close().catch(() => {});
-  await closeDatabasePool(pool).catch(() => {});
+  await shutdown('startup-failure').catch((cleanupError) => {
+    logger.error('YunCMS API startup cleanup failed', { code: cleanupError?.code, error: cleanupError });
+  });
   process.exit(1);
 });