@yunsoft/yuncms-core 0.1.0

package/src/services/auth-service.js

@@ -0,0 +1,164 @@
+import { createPublicAccountability } from '../accountability.js';
+import { verifyPassword } from '../auth/password.js';
+import { hashToken, tokenType } from '../auth/tokens.js';
+import { readAuthenticationUserByEmail } from '../auth/users-repository.js';
+import { BaseService } from './base-service.js';
+import { SessionsService } from './sessions-service.js';
+
+const DUMMY_PASSWORD_HASH = 'scrypt$N=65536,r=8,p=1,keyLength=64$AAAAAAAAAAAAAAAAAAAAAA$wPIB-ojIevW9SJ6ou99EIix5AukscH1McxhCNVsi1eVkhsxb5QzXquW0YeAFglU5Vh-NthiqKH90soC0JgEJPQ';
+
+function invalidLogin() {
+  const error = new Error('Invalid email or password');
+  error.code = 'INVALID_CREDENTIALS';
+  return error;
+}
+
+function invalidToken() {
+  const error = new Error('Invalid or expired authentication token');
+  error.code = 'INVALID_CREDENTIALS';
+  return error;
+}
+
+function normalizeLoginEmail(email) {
+  if (typeof email !== 'string') return null;
+  const normalized = email.trim().toLowerCase();
+  if (!normalized || normalized.length > 191 || !normalized.includes('@')) return null;
+  return normalized;
+}
+
+function publicUser(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    role: user.role ?? null,
+    status: user.status,
+    email_verified_at: user.email_verified_at ?? null,
+  };
+}
+
+export class AuthService extends BaseService {
+  createSessionsService() {
+    return new SessionsService({
+      accountability: this.accountability,
+      database: this.database,
+      schema: this.schema,
+      emitter: this.emitter,
+      logger: this.logger,
+    });
+  }
+
+  async resolvePublicAccountability() {
+    const [rows] = await this.database.query(
+      `SELECT id
+       FROM yuncms_roles
+       WHERE public = 1
+       ORDER BY created_at ASC
+       LIMIT 2`,
+    );
+
+    if (rows.length > 1) {
+      const error = new Error('Multiple public roles are configured');
+      error.code = 'PUBLIC_ROLE_AMBIGUOUS';
+      throw error;
+    }
+
+    return createPublicAccountability({ role: rows[0]?.id ?? null });
+  }
+
+  async login({ email, password, ip = null, userAgent = null } = {}) {
+    const normalizedEmail = normalizeLoginEmail(email);
+    const user = normalizedEmail
+      ? await readAuthenticationUserByEmail(this.database, normalizedEmail)
+      : null;
+
+    const passwordMatches = await verifyPassword(
+      typeof password === 'string' ? password : '',
+      user?.password_hash ?? DUMMY_PASSWORD_HASH,
+    );
+
+    if (!user || !passwordMatches || user.status !== 'active') {
+      throw invalidLogin();
+    }
+
+    const tokens = await this.createSessionsService().createForUser(user, { ip, userAgent });
+    return {
+      user: publicUser(user),
+      ...tokens,
+    };
+  }
+
+  async authenticateAccessToken(token) {
+    return this.createSessionsService().authenticateAccessToken(token);
+  }
+
+  async authenticateApiToken(token) {
+    if (tokenType(token) !== 'api') throw invalidToken();
+    const [rows] = await this.database.query(
+      `SELECT t.id AS api_token_id, t.user, u.email, u.role, u.status,
+              r.admin AS role_admin
+       FROM yuncms_api_tokens t
+       INNER JOIN yuncms_users u ON u.id = t.user
+       LEFT JOIN yuncms_roles r ON r.id = u.role
+       WHERE t.token_hash = ?
+         AND (t.expires_at IS NULL OR t.expires_at > CURRENT_TIMESTAMP(3))
+         AND u.status = 'active'
+       LIMIT 1`,
+      [hashToken(token)],
+    );
+    const row = rows[0];
+    if (!row) throw invalidToken();
+
+    await this.database.query(
+      `UPDATE yuncms_api_tokens t
+       INNER JOIN yuncms_users u ON u.id = t.user
+       SET t.last_used_at = CURRENT_TIMESTAMP(3), u.last_access = CURRENT_TIMESTAMP(3)
+       WHERE t.id = ?`,
+      [row.api_token_id],
+    );
+
+    return {
+      user: row.user,
+      role: row.role ?? null,
+      admin: Boolean(row.role_admin),
+      email: row.email,
+      session: null,
+      apiToken: row.api_token_id,
+      authMethod: 'api_token',
+    };
+  }
+
+  async authenticateBearerToken(token) {
+    const type = tokenType(token);
+    if (type === 'access') return this.authenticateAccessToken(token);
+    if (type === 'api') return this.authenticateApiToken(token);
+    throw invalidToken();
+  }
+
+  async refresh(refreshToken) {
+    const result = await this.createSessionsService().rotateRefreshToken(refreshToken);
+    return {
+      user: {
+        id: result.user,
+        email: result.email,
+        role: result.role,
+      },
+      access_token: result.access_token,
+      access_expires_at: result.access_expires_at,
+      refresh_token: result.refresh_token,
+      refresh_expires_at: result.refresh_expires_at,
+    };
+  }
+
+  async logout(accessToken) {
+    return this.createSessionsService().revokeByAccessToken(accessToken);
+  }
+
+  async logoutAll() {
+    if (!this.accountability.user) {
+      const error = new Error('Authenticated user is required');
+      error.code = 'UNAUTHORIZED';
+      throw error;
+    }
+    return this.createSessionsService().revokeAllForUser(this.accountability.user);
+  }
+}

package/src/services/auth-tokens-service.js

@@ -0,0 +1,215 @@
+import { randomUUID } from 'node:crypto';
+
+import { hashPassword } from '../auth/password.js';
+import { createOpaqueToken, hashToken, tokenType } from '../auth/tokens.js';
+import { readAuthenticationUserByEmail } from '../auth/users-repository.js';
+import { BaseService } from './base-service.js';
+import { normalizeEmail } from './users-service.js';
+
+const TOKEN_TYPES = Object.freeze({
+  reset: 'password_reset',
+  verify: 'email_verification',
+});
+
+const DEFAULT_TTL_MS = Object.freeze({
+  reset: 60 * 60 * 1000,
+  verify: 24 * 60 * 60 * 1000,
+});
+
+function invalidActionToken() {
+  const error = new Error('Invalid or expired action token');
+  error.code = 'INVALID_TOKEN';
+  return error;
+}
+
+function assertPositiveTtl(ttlMs) {
+  if (!Number.isInteger(ttlMs) || ttlMs < 60_000 || ttlMs > 7 * 24 * 60 * 60 * 1000) {
+    const error = new Error('Token TTL must be between 1 minute and 7 days');
+    error.code = 'INVALID_PAYLOAD';
+    throw error;
+  }
+}
+
+export class AuthTokensService extends BaseService {
+  async createForUser(userId, type, { ttlMs = DEFAULT_TTL_MS[type] } = {}) {
+    if (!TOKEN_TYPES[type]) {
+      const error = new Error(`Unsupported auth token type: ${type}`);
+      error.code = 'INVALID_PAYLOAD';
+      throw error;
+    }
+    assertPositiveTtl(ttlMs);
+
+    const [users] = await this.database.query(
+      'SELECT id, status FROM yuncms_users WHERE id = ? LIMIT 1',
+      [userId],
+    );
+    if (!users[0] || users[0].status !== 'active') {
+      const error = new Error(`Active user not found: ${userId}`);
+      error.code = 'USER_NOT_FOUND';
+      throw error;
+    }
+
+    const generated = createOpaqueToken(type);
+    const expiresAt = new Date(Date.now() + ttlMs);
+    const connection = await this.database.getConnection();
+
+    try {
+      await connection.beginTransaction();
+      await connection.query(
+        `DELETE FROM yuncms_auth_tokens
+         WHERE user = ? AND type = ? AND used_at IS NULL`,
+        [userId, TOKEN_TYPES[type]],
+      );
+      await connection.query(
+        `INSERT INTO yuncms_auth_tokens (id, user, type, token_hash, expires_at)
+         VALUES (?, ?, ?, ?, ?)`,
+        [randomUUID(), userId, TOKEN_TYPES[type], generated.hash, expiresAt],
+      );
+      await connection.commit();
+    } catch (error) {
+      try {
+        await connection.rollback();
+      } catch (rollbackError) {
+        error.rollbackError = rollbackError;
+      }
+      throw error;
+    } finally {
+      connection.release();
+    }
+
+    return {
+      token: generated.token,
+      expires_at: expiresAt,
+    };
+  }
+
+  async requestPasswordReset(email, options = {}) {
+    let normalized;
+    try {
+      normalized = normalizeEmail(email);
+    } catch {
+      return null;
+    }
+
+    const user = await readAuthenticationUserByEmail(this.database, normalized);
+    if (!user || user.status !== 'active') return null;
+    return this.createForUser(user.id, 'reset', options);
+  }
+
+  async resetPassword(token, password) {
+    if (tokenType(token) !== 'reset') throw invalidActionToken();
+    const passwordHash = await hashPassword(password);
+    const connection = await this.database.getConnection();
+
+    try {
+      await connection.beginTransaction();
+      const [rows] = await connection.query(
+        `SELECT id, user
+         FROM yuncms_auth_tokens
+         WHERE token_hash = ?
+           AND type = ?
+           AND used_at IS NULL
+           AND expires_at > CURRENT_TIMESTAMP(3)
+         LIMIT 1
+         FOR UPDATE`,
+        [hashToken(token), TOKEN_TYPES.reset],
+      );
+      const actionToken = rows[0];
+      if (!actionToken) throw invalidActionToken();
+
+      const [result] = await connection.query(
+        `UPDATE yuncms_users
+         SET password_hash = ?
+         WHERE id = ? AND status = 'active'`,
+        [passwordHash, actionToken.user],
+      );
+      if (result.affectedRows !== 1) throw invalidActionToken();
+
+      await connection.query(
+        'UPDATE yuncms_auth_tokens SET used_at = CURRENT_TIMESTAMP(3) WHERE id = ?',
+        [actionToken.id],
+      );
+      await connection.query('DELETE FROM yuncms_sessions WHERE user = ?', [actionToken.user]);
+      await connection.query(
+        `DELETE FROM yuncms_auth_tokens
+         WHERE user = ? AND type = ? AND id <> ?`,
+        [actionToken.user, TOKEN_TYPES.reset, actionToken.id],
+      );
+      await connection.commit();
+      return true;
+    } catch (error) {
+      try {
+        await connection.rollback();
+      } catch (rollbackError) {
+        error.rollbackError = rollbackError;
+      }
+      throw error;
+    } finally {
+      connection.release();
+    }
+  }
+
+  async createEmailVerification(userId, options = {}) {
+    const canIssue =
+      this.accountability.system === true ||
+      this.accountability.admin === true ||
+      this.accountability.user === userId;
+    if (!canIssue) {
+      const error = new Error('Email verification token can only be issued for the authenticated user');
+      error.code = 'FORBIDDEN';
+      throw error;
+    }
+    return this.createForUser(userId, 'verify', options);
+  }
+
+  async verifyEmail(token) {
+    if (tokenType(token) !== 'verify') throw invalidActionToken();
+    const connection = await this.database.getConnection();
+
+    try {
+      await connection.beginTransaction();
+      const [rows] = await connection.query(
+        `SELECT id, user
+         FROM yuncms_auth_tokens
+         WHERE token_hash = ?
+           AND type = ?
+           AND used_at IS NULL
+           AND expires_at > CURRENT_TIMESTAMP(3)
+         LIMIT 1
+         FOR UPDATE`,
+        [hashToken(token), TOKEN_TYPES.verify],
+      );
+      const actionToken = rows[0];
+      if (!actionToken) throw invalidActionToken();
+
+      const [result] = await connection.query(
+        `UPDATE yuncms_users
+         SET email_verified_at = COALESCE(email_verified_at, CURRENT_TIMESTAMP(3))
+         WHERE id = ? AND status = 'active'`,
+        [actionToken.user],
+      );
+      if (result.affectedRows !== 1) throw invalidActionToken();
+
+      await connection.query(
+        'UPDATE yuncms_auth_tokens SET used_at = CURRENT_TIMESTAMP(3) WHERE id = ?',
+        [actionToken.id],
+      );
+      await connection.query(
+        `DELETE FROM yuncms_auth_tokens
+         WHERE user = ? AND type = ? AND id <> ?`,
+        [actionToken.user, TOKEN_TYPES.verify, actionToken.id],
+      );
+      await connection.commit();
+      return true;
+    } catch (error) {
+      try {
+        await connection.rollback();
+      } catch (rollbackError) {
+        error.rollbackError = rollbackError;
+      }
+      throw error;
+    } finally {
+      connection.release();
+    }
+  }
+}

package/src/services/base-service.js

@@ -0,0 +1,26 @@
+import { requireAccountability } from '../accountability.js';
+
+export class BaseService {
+  constructor({
+    accountability,
+    database,
+    schema = null,
+    emitter = null,
+    logger = console,
+    storage = null,
+    permissionCache = null,
+    requestId = null,
+  } = {}) {
+    requireAccountability(accountability);
+    if (!database) throw new Error('Database handle is required');
+
+    this.accountability = accountability;
+    this.database = database;
+    this.schema = schema;
+    this.emitter = emitter;
+    this.logger = logger;
+    this.storage = storage;
+    this.permissionCache = permissionCache;
+    this.requestId = requestId;
+  }
+}

package/src/services/collections-service.js

@@ -0,0 +1,249 @@
+import { randomUUID } from 'node:crypto';
+
+import { withAdvisoryLock } from '../advisory-lock.js';
+import { assertIdentifier, quoteIdentifier } from '../identifier.js';
+import { SchemaMetadataRepository } from '../schema-metadata-repository.js';
+import { incrementSchemaVersion } from '../schema-version.js';
+import { withConnectionTransaction } from '../transaction.js';
+import { BaseService } from './base-service.js';
+import { assertSchemaManager } from './schema-access.js';
+
+const COLLECTION_METADATA_KEYS = new Set(['note', 'singleton', 'hidden', 'metadata']);
+
+function assertUserCollectionName(collection) {
+  assertIdentifier(collection, 'collection name');
+  if (collection.length > 64) throw new Error('Collection name cannot exceed 64 characters');
+  if (collection.toLowerCase().startsWith('yuncms_')) {
+    const error = new Error('The yuncms_ prefix is reserved for system tables');
+    error.code = 'RESERVED_COLLECTION_NAME';
+    throw error;
+  }
+  return collection;
+}
+
+function assertCollectionMetadataPatch(patch) {
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
+    const error = new Error('Collection metadata patch must be an object');
+    error.code = 'INVALID_SCHEMA_PAYLOAD';
+    throw error;
+  }
+  for (const key of Object.keys(patch)) {
+    if (!COLLECTION_METADATA_KEYS.has(key)) {
+      const error = new Error(`Collection property cannot be updated in V1: ${key}`);
+      error.code = 'UNSUPPORTED_SCHEMA_UPDATE';
+      throw error;
+    }
+  }
+  if (Object.keys(patch).length === 0) {
+    const error = new Error('Collection metadata patch cannot be empty');
+    error.code = 'INVALID_SCHEMA_PAYLOAD';
+    throw error;
+  }
+}
+
+function temporaryDropName() {
+  return `_yuncms_drop_${randomUUID().replaceAll('-', '').slice(0, 24)}`;
+}
+
+export class CollectionsService extends BaseService {
+  async readMany() {
+    assertSchemaManager(this.accountability);
+    return new SchemaMetadataRepository(this.database).listCollections();
+  }
+
+  async readOne(collection) {
+    assertSchemaManager(this.accountability);
+    assertIdentifier(collection, 'collection name');
+    return new SchemaMetadataRepository(this.database).readCollection(collection);
+  }
+
+  async createOne(input = {}) {
+    assertSchemaManager(this.accountability);
+    const collection = assertUserCollectionName(input.collection);
+    const primaryKey = input.primaryKey ?? 'id';
+
+    if (primaryKey !== 'id') {
+      const error = new Error('V1 collection creation currently requires the primary key field to be named id');
+      error.code = 'UNSUPPORTED_PRIMARY_KEY';
+      throw error;
+    }
+
+    return withAdvisoryLock(this.database, 'yuncms:schema', async (connection) => {
+      const metadata = new SchemaMetadataRepository(connection);
+      const existing = await metadata.readCollection(collection);
+      if (existing) {
+        const error = new Error(`Collection already exists: ${collection}`);
+        error.code = 'COLLECTION_EXISTS';
+        throw error;
+      }
+
+      const table = quoteIdentifier(collection, 'collection name');
+      let tableCreated = false;
+
+      try {
+        await connection.query(
+          `CREATE TABLE ${table} (
+            id CHAR(36) NOT NULL PRIMARY KEY
+          ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+        );
+        tableCreated = true;
+
+        return await withConnectionTransaction(connection, async () => {
+          const created = await metadata.createCollection({
+            collection,
+            primaryKey,
+            note: input.note ?? null,
+            singleton: input.singleton === true,
+            hidden: input.hidden === true,
+            metadata: input.metadata ?? null,
+          });
+
+          await metadata.createField({
+            collection,
+            field: 'id',
+            type: 'uuid',
+            required: true,
+            readonly: true,
+            interface: 'input',
+            schemaMetadata: { primaryKey: true, length: 36 },
+          });
+
+          const schemaVersion = await incrementSchemaVersion(connection);
+          return { ...created, schemaVersion };
+        });
+      } catch (error) {
+        const cleanupErrors = [];
+
+        try {
+          await metadata.deleteCollection(collection);
+        } catch (cleanupError) {
+          cleanupErrors.push(cleanupError);
+        }
+
+        if (tableCreated) {
+          try {
+            await connection.query(`DROP TABLE IF EXISTS ${table}`);
+          } catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+          }
+        }
+
+        if (cleanupErrors.length > 0) {
+          error.cleanupErrors = cleanupErrors;
+          error.code ||= 'SCHEMA_PARTIAL_FAILURE';
+        }
+        throw error;
+      }
+    });
+  }
+
+  async updateOne(collection, patch) {
+    assertSchemaManager(this.accountability);
+    assertIdentifier(collection, 'collection name');
+    assertCollectionMetadataPatch(patch);
+
+    return withAdvisoryLock(this.database, 'yuncms:schema', async (connection) => {
+      const metadata = new SchemaMetadataRepository(connection);
+      const existing = await metadata.readCollection(collection);
+      if (!existing) {
+        const error = new Error(`Unknown collection: ${collection}`);
+        error.code = 'COLLECTION_NOT_FOUND';
+        throw error;
+      }
+      if (existing.system) {
+        const error = new Error('System collection metadata cannot be changed through the dynamic schema API');
+        error.code = 'SYSTEM_SCHEMA_READ_ONLY';
+        throw error;
+      }
+
+      return withConnectionTransaction(connection, async () => {
+        const updated = await metadata.updateCollectionMetadata(collection, patch);
+        const schemaVersion = await incrementSchemaVersion(connection);
+        return { ...updated, schemaVersion };
+      });
+    });
+  }
+
+  async deleteOne(collection, { destructive = false } = {}) {
+    assertSchemaManager(this.accountability);
+    assertIdentifier(collection, 'collection name');
+    if (destructive !== true) {
+      const error = new Error('Collection deletion requires destructive: true');
+      error.code = 'DESTRUCTIVE_OPERATION_REQUIRED';
+      throw error;
+    }
+
+    return withAdvisoryLock(this.database, 'yuncms:schema', async (connection) => {
+      const metadata = new SchemaMetadataRepository(connection);
+      const existing = await metadata.readCollection(collection);
+      if (!existing) {
+        const error = new Error(`Unknown collection: ${collection}`);
+        error.code = 'COLLECTION_NOT_FOUND';
+        throw error;
+      }
+      if (existing.system) {
+        const error = new Error('System collections cannot be deleted through the dynamic schema API');
+        error.code = 'SYSTEM_SCHEMA_READ_ONLY';
+        throw error;
+      }
+
+      const relations = await metadata.listRelations();
+      const blockingRelations = relations.filter((relation) =>
+        relation.many_collection === collection ||
+        relation.one_collection === collection ||
+        relation.junction_collection === collection);
+      if (blockingRelations.length > 0) {
+        const error = new Error(`Collection has relations and cannot be deleted: ${collection}`);
+        error.code = 'COLLECTION_HAS_RELATIONS';
+        error.relations = blockingRelations.map((relation) => ({
+          many_collection: relation.many_collection,
+          many_field: relation.many_field,
+          one_collection: relation.one_collection,
+        }));
+        throw error;
+      }
+
+      const originalTable = quoteIdentifier(collection, 'collection name');
+      const tombstoneName = temporaryDropName();
+      const tombstoneTable = quoteIdentifier(tombstoneName, 'temporary collection name');
+
+      await connection.query(`RENAME TABLE ${originalTable} TO ${tombstoneTable}`);
+
+      let result;
+      try {
+        result = await withConnectionTransaction(connection, async () => {
+          await connection.query('DELETE FROM yuncms_permissions WHERE collection = ?', [collection]);
+          const deleted = await metadata.deleteCollection(collection);
+          if (deleted !== 1) {
+            const error = new Error(`Collection metadata disappeared during delete: ${collection}`);
+            error.code = 'SCHEMA_METADATA_DRIFT';
+            throw error;
+          }
+          const schemaVersion = await incrementSchemaVersion(connection);
+          return { deleted: true, collection, schemaVersion };
+        });
+      } catch (error) {
+        try {
+          await connection.query(`RENAME TABLE ${tombstoneTable} TO ${originalTable}`);
+        } catch (restoreError) {
+          error.restoreError = restoreError;
+          error.code ||= 'SCHEMA_PARTIAL_FAILURE';
+        }
+        throw error;
+      }
+
+      try {
+        await connection.query(`DROP TABLE ${tombstoneTable}`);
+      } catch (cleanupError) {
+        const error = new Error(`Collection was logically deleted but physical cleanup failed: ${collection}`);
+        error.code = 'SCHEMA_PARTIAL_FAILURE';
+        error.cleanupError = cleanupError;
+        error.cleanupTable = tombstoneName;
+        error.logicalDelete = result;
+        throw error;
+      }
+
+      return result;
+    });
+  }
+}

package/src/services/core-services.js

@@ -0,0 +1,32 @@
+import { ApiTokensService } from './api-tokens-service.js';
+import { AuditService } from './audit-service.js';
+import { AuthService } from './auth-service.js';
+import { AuthTokensService } from './auth-tokens-service.js';
+import { CollectionsService } from './collections-service.js';
+import { FieldsService } from './fields-service.js';
+import { FileReconciliationService } from './file-reconciliation-service.js';
+import { FilesService } from './files-service.js';
+import { ItemsService } from './items-service.js';
+import { PermissionsService } from './permissions-service.js';
+import { RelationsService } from './relations-service.js';
+import { RolesService } from './roles-service.js';
+import { UsersService } from './users-service.js';
+import { createServiceRegistry } from './service-registry.js';
+
+export function createCoreServiceRegistry() {
+  return createServiceRegistry({
+    AuthService,
+    AuthTokensService,
+    ApiTokensService,
+    AuditService,
+    ItemsService,
+    CollectionsService,
+    FieldsService,
+    RelationsService,
+    UsersService,
+    RolesService,
+    PermissionsService,
+    FilesService,
+    FileReconciliationService,
+  });
+}