@yunsoft/yuncms-api 0.1.3 → 0.1.6

package/src/routes/auth.js

@@ -7,21 +7,16 @@ function service(req, name) {
   const Service = req.context.services[name];
   return new Service(serviceOptionsFromRequest(req));
 }
-
-function authService(req) {
-  return service(req, 'AuthService');
-}
-
-function authTokensService(req) {
-  return service(req, 'AuthTokensService');
-}
-
-function apiTokensService(req) {
-  return service(req, 'ApiTokensService');
-}
-
-function usersService(req) {
-  return service(req, 'UsersService');
+function authService(req) { return service(req, 'AuthService'); }
+function authTokensService(req) { return service(req, 'AuthTokensService'); }
+function apiTokensService(req) { return service(req, 'ApiTokensService'); }
+function usersService(req) { return service(req, 'UsersService'); }
+function externalAuthService(req, registry) {
+  const Service = req.context.services.ExternalAuthService;
+  return new Service({
+    ...serviceOptionsFromRequest(req),
+    stateSecret: registry?.config?.stateSecret,
+  });
 }
 
 function requireSessionAuthentication(req) {
@@ -39,6 +34,13 @@ function requireMailer(mailer) {
   throw error;
 }
 
+function requireExternalAuth(registry) {
+  if (registry?.config?.enabled) return registry;
+  const error = new Error('External authentication is not configured');
+  error.code = 'AUTH_PROVIDER_NOT_FOUND';
+  throw error;
+}
+
 function actionUrl(config, action, token) {
   return `${config.auth.publicUrl}/?auth_action=${encodeURIComponent(action)}&token=${encodeURIComponent(token)}`;
 }
@@ -49,31 +51,126 @@ function noStore(req, res, next) {
   next();
 }
 
-export function createAuthRouter({ mailer = null, config = null, logger = console } = {}) {
+async function reportExternalFailure(serviceInstance, providerId, error) {
+  try {
+    await serviceInstance.loginFailed(providerId, error?.code ?? 'external_auth_failed');
+  } catch {}
+}
+
+export function createAuthRouter({
+  mailer = null,
+  config = null,
+  logger = console,
+  rateLimitStore = null,
+  externalAuthRegistry = null,
+} = {}) {
   const router = express.Router();
+  const samlBodyParser = express.urlencoded({ extended: false, limit: '1mb', parameterLimit: 20 });
   const limits = config?.auth?.rateLimit ?? {};
+  const sharedStore = limits.store === 'redis' ? rateLimitStore : null;
+  const common = { store: sharedStore, failureMode: limits.failureMode ?? 'best-effort', logger };
   const loginLimit = createFixedWindowRateLimit({
+    ...common,
+    scope: 'auth:login',
     windowMs: limits.loginWindowMs ?? 60_000,
     max: limits.loginMax ?? 10,
+    key: (req) => `${req.ip || req.socket?.remoteAddress || 'unknown'}:${String(req.body?.email ?? req.body?.username ?? '').trim().toLowerCase()}`,
   });
   const refreshLimit = createFixedWindowRateLimit({
+    ...common,
+    scope: 'auth:refresh',
     windowMs: limits.refreshWindowMs ?? 60_000,
     max: limits.refreshMax ?? 30,
+    key: (req) => `${req.ip || req.socket?.remoteAddress || 'unknown'}:${String(req.body?.refresh_token ?? '').slice(0, 24)}`,
   });
   const actionLimit = createFixedWindowRateLimit({
+    ...common,
+    scope: 'auth:action',
     windowMs: limits.actionWindowMs ?? 15 * 60_000,
     max: limits.actionMax ?? 5,
+    key: (req) => `${req.ip || req.socket?.remoteAddress || 'unknown'}:${String(req.body?.email ?? req.body?.user ?? req.params?.provider ?? '').trim().toLowerCase()}`,
   });
 
   router.use(noStore);
 
+  router.get('/providers', (req, res) => {
+    res.json({ data: externalAuthRegistry?.publicProviders?.() ?? [] });
+  });
+
   router.post('/login', loginLimit, async (req, res) => {
-    const result = await authService(req).login({
-      email: req.body?.email,
-      password: req.body?.password,
-      ip: req.ip ?? null,
-      userAgent: req.get('user-agent') ?? null,
-    });
+    const result = await authService(req).login({ email: req.body?.email, password: req.body?.password, ip: req.ip ?? null, userAgent: req.get('user-agent') ?? null });
+    res.json({ data: result });
+  });
+
+  router.get('/login/:provider', actionLimit, async (req, res) => {
+    const registry = requireExternalAuth(externalAuthRegistry);
+    const auth = externalAuthService(req, registry);
+    try {
+      const result = await registry.begin(auth, req.params.provider, {
+        redirectTarget: req.query?.redirect ?? '/',
+      });
+      res.redirect(302, result.url.toString());
+    } catch (error) {
+      await reportExternalFailure(auth, req.params.provider, error);
+      throw error;
+    }
+  });
+
+  router.post('/login/:provider', loginLimit, async (req, res) => {
+    const registry = requireExternalAuth(externalAuthRegistry);
+    const auth = externalAuthService(req, registry);
+    try {
+      const result = await registry.loginLdap(auth, req.params.provider, {
+        username: req.body?.username,
+        password: req.body?.password,
+        ip: req.ip ?? null,
+        userAgent: req.get('user-agent') ?? null,
+      });
+      res.json({ data: result });
+    } catch (error) {
+      await reportExternalFailure(auth, req.params.provider, error);
+      throw error;
+    }
+  });
+
+  router.get('/callback/:provider', actionLimit, async (req, res) => {
+    const registry = requireExternalAuth(externalAuthRegistry);
+    const auth = externalAuthService(req, registry);
+    try {
+      const completed = await registry.completeBrowser(auth, req.params.provider, {
+        query: req.query,
+        ip: req.ip ?? null,
+        userAgent: req.get('user-agent') ?? null,
+      });
+      const target = await registry.createBrowserHandoff(auth, completed.result, completed.redirectTarget);
+      res.redirect(303, target);
+    } catch (error) {
+      await reportExternalFailure(auth, req.params.provider, error);
+      throw error;
+    }
+  });
+
+  router.post('/callback/:provider', actionLimit, samlBodyParser, async (req, res) => {
+    const registry = requireExternalAuth(externalAuthRegistry);
+    const auth = externalAuthService(req, registry);
+    try {
+      const completed = await registry.completeBrowser(auth, req.params.provider, {
+        body: req.body,
+        ip: req.ip ?? null,
+        userAgent: req.get('user-agent') ?? null,
+      });
+      const target = await registry.createBrowserHandoff(auth, completed.result, completed.redirectTarget);
+      res.redirect(303, target);
+    } catch (error) {
+      await reportExternalFailure(auth, req.params.provider, error);
+      throw error;
+    }
+  });
+
+  router.post('/exchange', actionLimit, async (req, res) => {
+    const registry = requireExternalAuth(externalAuthRegistry);
+    const auth = externalAuthService(req, registry);
+    const result = await registry.exchangeBrowserHandoff(auth, req.body?.auth_code);
     res.json({ data: result });
   });
 
@@ -81,23 +178,19 @@ export function createAuthRouter({ mailer = null, config = null, logger = consol
     const result = await authService(req).refresh(req.body?.refresh_token);
     res.json({ data: result });
   });
-
   router.post('/logout', async (req, res) => {
     requireSessionAuthentication(req);
     await authService(req).logout(req.authToken);
     res.status(204).end();
   });
-
   router.post('/logout-all', async (req, res) => {
     requireSessionAuthentication(req);
     await authService(req).logoutAll();
     res.status(204).end();
   });
-
   router.post('/password-reset/request', actionLimit, async (req, res) => {
     const transport = requireMailer(mailer);
     const result = await authTokensService(req).requestPasswordReset(req.body?.email);
-
     if (result) {
       try {
         const url = actionUrl(config, 'reset', result.token);
@@ -105,24 +198,17 @@ export function createAuthRouter({ mailer = null, config = null, logger = consol
           to: String(req.body.email).trim(),
           subject: 'Reset your YunCMS password',
           text: `A password reset was requested for your YunCMS account.\n\nOpen this link to choose a new password:\n${url}\n\nIf you did not request this, you can ignore this message.`,
-        });
+        }, { accountability: req.accountability, requestId: req.id });
       } catch (error) {
-        logger.error?.('YunCMS password reset mail delivery failed', {
-          requestId: req.id,
-          code: error?.code,
-          message: error?.message,
-        });
+        logger.error?.('YunCMS password reset mail delivery failed', { requestId: req.id, code: error?.code, message: error?.message });
       }
     }
-
     res.status(202).json({ data: { accepted: true } });
   });
-
   router.post('/password-reset/confirm', actionLimit, async (req, res) => {
     await authTokensService(req).resetPassword(req.body?.token, req.body?.password);
     res.status(204).end();
   });
-
   router.post('/email-verification/request', actionLimit, async (req, res) => {
     const transport = requireMailer(mailer);
     if (!req.accountability?.user) {
@@ -130,7 +216,6 @@ export function createAuthRouter({ mailer = null, config = null, logger = consol
       error.code = 'UNAUTHORIZED';
       throw error;
     }
-
     const userId = req.body?.user ?? req.accountability.user;
     const user = await usersService(req).readOne(userId);
     if (!user) {
@@ -140,29 +225,15 @@ export function createAuthRouter({ mailer = null, config = null, logger = consol
     }
     const result = await authTokensService(req).createEmailVerification(userId);
     const url = actionUrl(config, 'verify', result.token);
-    await transport.send({
-      to: user.email,
-      subject: 'Verify your YunCMS email',
-      text: `Verify your YunCMS email address by opening this link:\n${url}\n\nIf you did not request this, you can ignore this message.`,
-    });
+    await transport.send({ to: user.email, subject: 'Verify your YunCMS email', text: `Verify your YunCMS email address by opening this link:\n${url}\n\nIf you did not request this, you can ignore this message.` }, { accountability: req.accountability, requestId: req.id });
     res.status(202).json({ data: { accepted: true } });
   });
-
   router.post('/email-verification/confirm', actionLimit, async (req, res) => {
     await authTokensService(req).verifyEmail(req.body?.token);
     res.status(204).end();
   });
-
-  router.get('/tokens', async (req, res) => {
-    const data = await apiTokensService(req).readMany();
-    res.json({ data });
-  });
-
-  router.post('/tokens', async (req, res) => {
-    const data = await apiTokensService(req).createOne(req.body ?? {});
-    res.status(201).json({ data });
-  });
-
+  router.get('/tokens', async (req, res) => { res.json({ data: await apiTokensService(req).readMany() }); });
+  router.post('/tokens', async (req, res) => { res.status(201).json({ data: await apiTokensService(req).createOne(req.body ?? {}) }); });
   router.delete('/tokens/:id', async (req, res) => {
     const deleted = await apiTokensService(req).deleteOne(req.params.id);
     if (!deleted) {
@@ -172,8 +243,14 @@ export function createAuthRouter({ mailer = null, config = null, logger = consol
     }
     res.status(204).end();
   });
-
   return router;
 }
 
-export { actionUrl, noStore, requireMailer, requireSessionAuthentication };
+export {
+  actionUrl,
+  noStore,
+  reportExternalFailure,
+  requireExternalAuth,
+  requireMailer,
+  requireSessionAuthentication,
+};

package/src/routes/schema.js

@@ -17,7 +17,39 @@ function destructiveRequested(req) {
   return String(req.query?.destructive ?? '').toLowerCase() === 'true';
 }
 
+function stableSchemaEvent(action) {
+  if (action.startsWith('schema.relation.')) {
+    return action.endsWith('.delete') ? 'schema.relation.delete' : 'schema.relation.create';
+  }
+  if (action === 'schema.field.alter') return 'schema.field.update';
+  return action;
+}
+
+async function emitSchemaLifecycle(req, { action, collection = null, itemKey = null, payload = null }) {
+  const emitter = req.context.emitter;
+  if (!emitter) return;
+  const event = stableSchemaEvent(action);
+  const context = {
+    accountability: req.accountability,
+    requestId: req.id,
+    collection,
+    operation: event,
+  };
+  await emitter.action(event, {
+    key: itemKey,
+    collection,
+    ...payload,
+  }, context);
+  await emitter.action('schema.changed', {
+    event,
+    key: itemKey,
+    collection,
+    schemaVersion: payload?.after?.schemaVersion ?? payload?.result?.schemaVersion ?? null,
+  }, context);
+}
+
 async function auditSchema(req, { action, collection = null, itemKey = null, payload = null }) {
+  await emitSchemaLifecycle(req, { action, collection, itemKey, payload });
   try {
     await service(req, 'AuditService').record({
       action,
@@ -88,7 +120,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
   router.delete('/collections/:collection', async (req, res) => {
     const collections = service(req, 'CollectionsService');
     const before = await collections.readOne(req.params.collection);
-    await collections.deleteOne(req.params.collection, {
+    const result = await collections.deleteOne(req.params.collection, {
       destructive: destructiveRequested(req),
     });
     clearSchemaCache();
@@ -96,7 +128,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
       action: 'schema.collection.delete',
       collection: req.params.collection,
       itemKey: req.params.collection,
-      payload: { before },
+      payload: { before, result },
     });
     res.status(204).end();
   });
@@ -172,7 +204,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
   router.delete('/collections/:collection/fields/:field', async (req, res) => {
     const fields = service(req, 'FieldsService');
     const before = await fields.readOne(req.params.collection, req.params.field);
-    await fields.deleteOne(
+    const result = await fields.deleteOne(
       req.params.collection,
       req.params.field,
       { destructive: destructiveRequested(req) },
@@ -182,7 +214,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
       action: 'schema.field.delete',
       collection: req.params.collection,
       itemKey: req.params.field,
-      payload: { before },
+      payload: { before, result },
     });
     res.status(204).end();
   });
@@ -225,7 +257,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
   router.delete('/relations/m2o/:manyCollection/:manyField', async (req, res) => {
     const relations = service(req, 'RelationsService');
     const before = await relations.readOne(req.params.manyCollection, req.params.manyField);
-    await relations.deleteM2O(
+    const result = await relations.deleteM2O(
       req.params.manyCollection,
       req.params.manyField,
     );
@@ -234,7 +266,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
       action: 'schema.relation.delete',
       collection: req.params.manyCollection,
       itemKey: req.params.manyField,
-      payload: { before },
+      payload: { before, result },
     });
     res.status(204).end();
   });
@@ -258,7 +290,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
   router.delete('/relations/o2o/:manyCollection/:manyField', async (req, res) => {
     const relations = service(req, 'RelationsService');
     const before = await relations.readOne(req.params.manyCollection, req.params.manyField);
-    await deleteO2ORelation({
+    const result = await deleteO2ORelation({
       database: req.context.database,
       accountability: req.accountability,
       manyCollection: req.params.manyCollection,
@@ -269,7 +301,7 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
       action: 'schema.relation.o2o.delete',
       collection: req.params.manyCollection,
       itemKey: req.params.manyField,
-      payload: { before },
+      payload: { before, result },
     });
     res.status(204).end();
   });
@@ -310,4 +342,9 @@ export function createSchemaRouter({ schemaCache = null } = {}) {
   return router;
 }
 
-export { auditSchema, destructiveRequested };
+export {
+  auditSchema,
+  destructiveRequested,
+  emitSchemaLifecycle,
+  stableSchemaEvent,
+};

package/src/server.js

@@ -1,5 +1,6 @@
 import {
   assertDatabaseCompatible,
+  assertMaintenanceStartupAllowed,
   closeDatabasePool,
   createCoreServiceRegistry,
   createDatabasePool,
@@ -10,20 +11,28 @@ import {
   loadConfig,
   loadEnvFileIfPresent,
   LocalStorageDriver,
+  MemoryCacheStore,
+  RedisCacheStore,
+  RedisClient,
+  RedisFixedWindowStore,
   S3StorageDriver,
   SchemaCache,
   SmtpMailer,
 } from '@yunsoft/yuncms-core';
 import { createApp } from './app.js';
+import { INTERNAL_AUDIT_EVENTS } from './audit-events.js';
+import { loadExternalAuthConfig } from './external-auth/config.js';
+import { ExternalAuthProviderRegistry } from './external-auth/providers.js';
 import { loadExtensionRuntime } from './extensions/runtime.js';
+import { createMcpRouter } from './mcp.js';
 
 loadEnvFileIfPresent();
+await assertMaintenanceStartupAllowed({ cwd: process.cwd(), env: process.env });
 const config = loadConfig();
+const externalAuthConfig = loadExternalAuthConfig(process.env);
 const logger = createJsonLogger({ level: config.logging.level });
 const pool = createDatabasePool(config.database);
-const storageDrivers = {
-  local: new LocalStorageDriver({ root: config.storage.localRoot }),
-};
+const storageDrivers = { local: new LocalStorageDriver({ root: config.storage.localRoot }) };
 if (config.storage.s3.bucket) {
   storageDrivers.s3 = new S3StorageDriver({
     bucket: config.storage.s3.bucket,
@@ -36,47 +45,47 @@ if (config.storage.s3.bucket) {
 }
 const storage = createStorageRegistry(storageDrivers);
 
-const hasAnyMailConfig = Boolean(
-  config.mail.host || config.mail.from || config.mail.user || config.mail.password,
-);
+const redisNeeded = config.cache.store === 'redis'
+  || config.server.rateLimit.store === 'redis'
+  || config.auth.rateLimit.store === 'redis';
+const redisClient = redisNeeded ? new RedisClient({
+  url: config.redis.url,
+  connectTimeoutMs: config.redis.connectTimeoutMs,
+  commandTimeoutMs: config.redis.commandTimeoutMs,
+  logger,
+}) : null;
+const permissionCache = !config.cache.enabled ? null
+  : config.cache.store === 'redis'
+    ? new RedisCacheStore({ client: redisClient, prefix: config.redis.prefix, namespace: 'permission', ttlMs: config.cache.ttlMs, logger })
+    : new MemoryCacheStore({ ttlMs: config.cache.ttlMs, maxEntries: config.cache.maxEntries });
+const rateLimitStore = redisClient
+  ? new RedisFixedWindowStore({ client: redisClient, prefix: config.redis.prefix, logger })
+  : null;
+
+const hasAnyMailConfig = Boolean(config.mail.host || config.mail.from || config.mail.user || config.mail.password);
 if (hasAnyMailConfig && (!config.mail.host || !config.mail.from)) {
   throw new Error('SMTP_HOST and SMTP_FROM are both required when SMTP delivery is configured');
 }
-const mailer = config.mail.host
-  ? new SmtpMailer({
-    host: config.mail.host,
-    port: config.mail.port,
-    secure: config.mail.secure,
-    user: config.mail.user,
-    password: config.mail.password,
-    from: config.mail.from,
-  })
-  : null;
+const mailer = config.mail.host ? new SmtpMailer({
+  host: config.mail.host,
+  port: config.mail.port,
+  secure: config.mail.secure,
+  user: config.mail.user,
+  password: config.mail.password,
+  from: config.mail.from,
+}) : null;
 
 let server = null;
+let extensionRuntime = null;
 let shuttingDown = false;
 
 function registerInternalAudit({ emitter, services }) {
   const AuditService = services.AuditService;
   const systemAccountability = createSystemAccountability();
-  const events = [
-    'items.create',
-    'items.update',
-    'items.delete',
-    'files.create',
-    'files.update',
-    'files.delete',
-  ];
-
-  for (const event of events) {
+  for (const event of INTERNAL_AUDIT_EVENTS) {
     emitter.registerAction(event, async (payload, context) => {
       try {
-        const audit = new AuditService({
-          accountability: systemAccountability,
-          database: pool,
-          logger,
-          requestId: context.requestId ?? null,
-        });
+        const audit = new AuditService({ accountability: systemAccountability, database: pool, logger, requestId: context.requestId ?? null });
         await audit.record({
           user: context.accountability?.user ?? null,
           action: event,
@@ -86,27 +95,40 @@ function registerInternalAudit({ emitter, services }) {
           payload,
         });
       } catch (error) {
-        logger.error('YunCMS audit write failed after committed mutation', {
-          event,
-          requestId: context.requestId ?? null,
-          code: error?.code,
-          error,
-        });
+        logger.error('YunCMS audit write failed after committed mutation', { event, requestId: context.requestId ?? null, code: error?.code, error });
       }
-    });
+    }, { extensionId: 'core.audit', priority: 1000 });
   }
 }
 
 async function start() {
   await assertDatabaseCompatible(pool);
+  if (redisClient) {
+    try {
+      await redisClient.connect();
+      if (!await redisClient.ping()) throw new Error('Unexpected Redis ping result');
+      logger.info('YunCMS shared Redis connected', { prefix: config.redis.prefix });
+    } catch (error) {
+      if (config.redis.required) throw error;
+      logger.warn('YunCMS Redis unavailable at startup; safe fallbacks remain active', { code: error?.code ?? null });
+    }
+  }
 
   const serviceRegistry = createCoreServiceRegistry();
   const services = serviceRegistry.toObject();
   const schemaCache = new SchemaCache();
-  const emitter = new HookEmitter();
+  const emitter = new HookEmitter({ logger });
+  const externalAuthRegistry = new ExternalAuthProviderRegistry({
+    config: externalAuthConfig,
+    publicUrl: config.auth.publicUrl,
+    database: pool,
+    logger,
+  });
+  const mcpRouter = createMcpRouter({ config, logger });
+  mailer?.setEmitter(emitter);
   registerInternalAudit({ emitter, services });
 
-  const extensionRuntime = await loadExtensionRuntime({
+  extensionRuntime = await loadExtensionRuntime({
     services,
     database: pool,
     schemaCache,
@@ -122,41 +144,50 @@ async function start() {
     logger,
     serviceRegistry,
     schemaCache,
+    permissionCache,
     emitter,
     storage,
     mailer,
+    rateLimitStore,
+    redisClient,
+    externalAuthRegistry,
     endpointExtensions: extensionRuntime.endpointExtensions,
+    mcpRouter,
   });
 
   await extensionRuntime.init('app.beforeStart');
   server = await new Promise((resolve, reject) => {
     const listeningServer = app.listen(config.server.port, config.server.host, () => {
-      logger.info('YunCMS API listening', {
-        host: config.server.host,
-        port: config.server.port,
-      });
+      logger.info('YunCMS API listening', { host: config.server.host, port: config.server.port });
       resolve(listeningServer);
     });
     listeningServer.once('error', reject);
   });
   await extensionRuntime.init('app.afterStart');
+  extensionRuntime.startSchedules();
 }
 
 async function shutdown(signal) {
   if (shuttingDown) return;
   shuttingDown = true;
   logger.info('YunCMS API shutting down', { signal });
-
   const forceExit = setTimeout(() => {
     logger.error('Graceful shutdown timed out', { signal });
     process.exit(1);
   }, 10_000);
   forceExit.unref();
 
-  if (server) {
-    await new Promise((resolve) => server.close(resolve));
+  const schedulesStopped = await extensionRuntime?.stopSchedules({ timeoutMs: 5_000 }).catch(() => false);
+  if (schedulesStopped === false) {
+    logger.warn('YunCMS extension jobs exceeded graceful shutdown budget', { signal });
   }
+  await extensionRuntime?.init('app.beforeStop').catch((error) => {
+    logger.error('YunCMS extension beforeStop hook failed', { code: error?.code ?? null });
+  });
+  if (server) await new Promise((resolve) => server.close(resolve));
+  await redisClient?.close().catch(() => {});
   await closeDatabasePool(pool);
+  await extensionRuntime?.init('app.afterStop').catch(() => {});
   clearTimeout(forceExit);
   logger.info('YunCMS API shutdown complete', { signal });
 }
@@ -173,10 +204,8 @@ for (const signal of ['SIGINT', 'SIGTERM']) {
 }
 
 start().catch(async (error) => {
-  logger.error('YunCMS API failed to start', {
-    code: error?.code,
-    error,
-  });
+  logger.error('YunCMS API failed to start', { code: error?.code, error });
+  await redisClient?.close().catch(() => {});
   await closeDatabasePool(pool).catch(() => {});
   process.exit(1);
 });