alinea 1.7.0 → 2.0.0-preview.1

package/dist/backend/api/DatabaseApi.d.ts

@@ -1,10 +1,11 @@
-import type { DraftsApi, RequestContext, UploadResponse, UploadsApi } from 'alinea/core/Connection';
+import type { DraftsApi, RequestContext, UploadResponse, UploadsApi, UserApi } from 'alinea/core/Connection';
 import { type Draft, type DraftKey } from 'alinea/core/Draft';
+import type { User, UserInput } from 'alinea/core/User';
 import { type Database } from 'rado';
 export interface DatabaseOptions {
     db: Database;
 }
-export declare class DatabaseApi implements DraftsApi, UploadsApi {
+export declare class DatabaseApi implements DraftsApi, UploadsApi, UserApi {
     #private;
     constructor(context: RequestContext, { db }: DatabaseOptions);
     getDraft(draftKey: DraftKey): Promise<Draft | undefined>;
@@ -12,4 +13,9 @@ export declare class DatabaseApi implements DraftsApi, UploadsApi {
     prepareUpload(file: string): Promise<UploadResponse>;
     handleUpload(entryId: string, file: Blob): Promise<void>;
     previewUpload(entryId: string): Promise<Response>;
+    enrichUser(user: User): Promise<User>;
+    listUsers(): Promise<Array<User>>;
+    createUser(user: UserInput): Promise<User>;
+    updateUser(user: UserInput): Promise<User>;
+    removeUser(email: string): Promise<void>;
 }

package/dist/backend/api/DatabaseApi.js

@@ -1,114 +1,85 @@
 import {
+  Builder,
+  Column,
+  ColumnType,
   column,
   eq,
+  jsonAggregateArray,
+  jsonArray,
+  querySelection,
+  selectQuery,
   table
-} from "../../chunks/chunk-SKF4L7JN.js";
+} from "../../chunks/chunk-G6E35DMJ.js";
 import {
   getData,
-  getField,
-  internalConstraint,
   internalData,
+  internalSql,
   sql
-} from "../../chunks/chunk-PNILF4WM.js";
+} from "../../chunks/chunk-NWQXN4SB.js";
 import {
   PLazy
 } from "../../chunks/chunk-IKINPSS5.js";
-import "../../chunks/chunk-NZLE2WMY.js";
+import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/backend/api/DatabaseApi.ts
-import { parseDraftKey } from "alinea/core/Draft";
 import { createId } from "alinea/core/Id";
+import { assert } from "alinea/core/util/Assert";
 import { basename, extname } from "alinea/core/util/Paths";
 import { slugify } from "alinea/core/util/Slugs";
 
-// node_modules/rado/dist/core/Constraint.js
-var UniqueConstraint = class _UniqueConstraint {
-  [internalData];
-  constructor(data) {
-    this[internalData] = data;
-  }
-  on(...columns) {
-    const fields = columns.map(getField);
-    return new _UniqueConstraint({ ...getData(this), fields });
-  }
-  nullsNotDistinct() {
-    return new _UniqueConstraint({ ...getData(this), nullsNotDistinct: true });
-  }
-  get [internalConstraint]() {
-    const { fields, nullsNotDistinct } = getData(this);
-    return sql.join([
-      sql`unique`,
-      nullsNotDistinct ? sql`nulls not distinct` : void 0,
-      sql`(${sql.join(
-        fields.map((field) => sql.identifier(field.fieldName)),
-        sql`, `
-      )})`
-    ]);
-  }
-};
-var PrimaryKeyConstraint = class {
-  constructor(data) {
-    this.data = data;
-    this[internalData] = data;
-  }
-  [internalData];
-  get [internalConstraint]() {
-    const { fields } = getData(this);
-    return sql`primary key (${sql.join(
-      fields.map((field) => sql.identifier(field.fieldName)),
-      sql`, `
-    )})`;
-  }
-};
-function primaryKey(...fields) {
-  return new PrimaryKeyConstraint({ fields: fields.map(getField) });
-}
-var ForeignKeyConstraint = class _ForeignKeyConstraint {
-  [internalData];
-  constructor(data) {
-    this[internalData] = data;
-  }
-  references(...fields) {
-    return new _ForeignKeyConstraint({
-      ...getData(this),
-      references: fields.map(getField)
-    });
-  }
-  get [internalConstraint]() {
-    const { fields, references } = getData(this);
-    return sql`foreign key (${sql.join(
-      fields.map((field) => sql.identifier(field.fieldName)),
-      sql`, `
-    )}) references ${sql.identifier(references[0].targetName)} (${sql.join(
-      references.map((field) => sql.identifier(field.fieldName)),
-      sql`, `
-    )})`;
-  }
-};
-
 // node_modules/rado/dist/universal/columns.js
-var idType = sql.universal({
-  sqlite: sql`integer`,
-  postgres: sql`integer generated always as identity`,
-  mysql: sql`int not null auto_increment`
-});
-var blobType = sql.universal({
-  postgres: sql`bytea`,
-  default: sql`blob`
-});
-var numberType = sql.universal({
-  mysql: sql`double`,
-  default: sql`numeric`
-});
-var jsonbType = sql.universal({
-  mysql: sql`json`,
-  default: sql`jsonb`
-});
+var idType = new ColumnType(
+  "id",
+  [],
+  sql.universal({
+    sqlite: sql`integer`,
+    postgres: sql`integer generated always as identity`,
+    mysql: sql`int not null auto_increment`
+  })
+);
+var blobType = new ColumnType(
+  "blob",
+  [],
+  sql.universal({
+    postgres: sql`bytea`,
+    default: sql`blob`
+  })
+);
+var numberType = new ColumnType(
+  "number",
+  [],
+  sql.universal({
+    mysql: sql`double`,
+    default: sql`numeric`
+  })
+);
+var jsonbType = new ColumnType(
+  "json",
+  [],
+  sql.universal({
+    mysql: sql`json`,
+    default: sql`jsonb`
+  })
+);
+function id(name) {
+  return new Column({
+    name,
+    type: idType,
+    primary: true,
+    notNull: true
+  });
+}
 function text(name) {
-  return column({ name, type: column.text() });
+  return new Column({ name, type: column.text() });
+}
+function varchar(name, options) {
+  return new Column({ name, type: column.varchar(options?.length) });
+}
+function integer(name) {
+  return new Column({ name, type: column.integer() });
 }
 function blob(name) {
-  return column({
+  return new Column({
     name,
     type: blobType,
     mapFromDriverValue(value) {
@@ -117,53 +88,99 @@ function blob(name) {
   });
 }
 
-// src/backend/api/DatabaseApi.ts
-import { HandleAction } from "../HandleAction.js";
-import { is } from "../util/ORM.js";
-var DraftTable = table(
-  "alinea_draft",
-  {
-    entryId: text().notNull(),
-    locale: text(),
-    fileHash: text().notNull(),
-    draft: blob().notNull()
-  },
-  (Draft) => {
-    return {
-      primary: primaryKey(Draft.entryId, Draft.locale)
+// node_modules/rado/dist/core/expr/Include.js
+var Include = class {
+  [internalData];
+  constructor(data) {
+    this[internalData] = data;
+  }
+  #mapFromDriverValue = (value, specs) => {
+    const query = getData(this);
+    const parsed = specs.parsesJson ? value : JSON.parse(value);
+    const selected = querySelection(query);
+    if (query.first) {
+      const result = parsed ? selected.mapRow({ values: parsed, index: 0, specs }) : null;
+      return result;
+    }
+    if (!parsed) return [];
+    const rows = parsed;
+    const ctx = {
+      values: void 0,
+      index: 0,
+      specs
     };
+    for (let i = 0; i < rows.length; i++) {
+      ctx.values = rows[i];
+      ctx.index = 0;
+      rows[i] = selected.mapRow(ctx);
+    }
+    return rows ?? [];
+  };
+  get [internalSql]() {
+    return includeQuery(getData(this)).mapWith({
+      mapFromDriverValue: this.#mapFromDriverValue
+    });
   }
-);
+};
+function include(select) {
+  return new Include({ ...getData(select), first: false });
+}
+((include2) => {
+  function one(select) {
+    return new Include({
+      ...getData(select),
+      first: true
+    });
+  }
+  include2.one = one;
+})(include || (include = {}));
+function includeQuery(query) {
+  const { first, limit, offset, orderBy } = query;
+  const wrapQuery = Boolean(limit || offset || orderBy);
+  const innerQuery = selectQuery(query);
+  const inner = wrapQuery ? sql`select * from (${innerQuery}) as __` : innerQuery;
+  const fields = querySelection(query).fieldNames();
+  const subject = jsonArray(
+    ...fields.map((name) => sql`_.${sql.identifier(name)}`)
+  );
+  return sql`(select ${first ? subject : jsonAggregateArray(subject)} from (${inner}) as _)`;
+}
+
+// src/backend/api/DatabaseApi.ts
+import { HandleAction } from "../HandleAction.js";
 var UploadTable = table("alinea_upload", {
-  entryId: text().primaryKey(),
+  entryId: varchar(void 0, { length: 27 }).primaryKey(),
   content: blob().notNull()
 });
+var UserTable = table("alinea_user", {
+  id: id(),
+  email: text().notNull().unique(),
+  name: text()
+});
+var UserRoleTable = table("alinea_user_role", {
+  userId: integer().notNull().references(UserTable.id),
+  role: text().notNull()
+});
+var tables = [UploadTable, UserTable, UserRoleTable];
+var preparedDatabases = /* @__PURE__ */ new WeakMap();
+var selectUser = {
+  ...UserTable,
+  roles: include(
+    new Builder().select(UserRoleTable.role).from(UserRoleTable).where(eq(UserRoleTable.userId, UserTable.id))
+  )
+};
 var DatabaseApi = class {
   #context;
   #db;
   constructor(context, { db }) {
     this.#context = context;
-    this.#db = PLazy.from(async () => {
-      await db.create(DraftTable, UploadTable).catch(() => {
-      });
-      return db;
-    });
+    this.#db = prepareDatabase(db);
   }
   async getDraft(draftKey) {
-    const db = await this.#db;
-    const { entryId, locale } = parseDraftKey(draftKey);
-    const found = await db.select().from(DraftTable).where(eq(DraftTable.entryId, entryId), is(DraftTable.locale, locale)).get();
-    return found ?? void 0;
+    throw new Error("Not longer supported");
   }
   async storeDraft(draft) {
-    const db = await this.#db;
-    const query = db.dialect.runtime === "mysql" ? db.insert(DraftTable).values(draft).onDuplicateKeyUpdate({
-      set: draft
-    }) : db.insert(DraftTable).values(draft).onConflictDoUpdate({
-      target: DraftTable.entryId,
-      set: draft
-    });
-    await query;
+    throw new Error("Not longer supported");
   }
   async prepareUpload(file) {
     const ctx = this.#context;
@@ -204,7 +221,119 @@ var DatabaseApi = class {
       }
     });
   }
+  async enrichUser(user) {
+    const normalized = normalizeUser(user);
+    const found = await this.#getUser(normalized.email);
+    if (!found) return { ...normalized, sub: normalized.sub ?? normalized.email };
+    return { ...normalized, ...found };
+  }
+  async listUsers() {
+    const db = await this.#db;
+    const users = await db.select(selectUser).from(UserTable);
+    return users.map(userFromRow);
+  }
+  async createUser(user) {
+    const normalized = normalizeUser(user);
+    const db = await this.#db;
+    const existing = await this.#getUser(normalized.email);
+    if (existing) return this.updateUser(normalized);
+    await db.transaction(async (tx) => {
+      await tx.insert(UserTable).values({
+        email: normalized.email,
+        name: normalized.name
+      });
+      const inserted = await tx.select().from(UserTable).where(eq(UserTable.email, normalized.email)).get();
+      assert(inserted, `Failed to insert user`);
+      await this.#replaceRoles(tx, inserted.id, normalized.roles ?? []);
+    });
+    const result = await this.#getUser(normalized.email);
+    assert(result, `Failed to retrieve user after creation`);
+    return result;
+  }
+  async updateUser(user) {
+    const normalized = normalizeUser(user);
+    const db = await this.#db;
+    await db.transaction(async (tx) => {
+      const row = await tx.select().from(UserTable).where(eq(UserTable.email, normalized.email)).get();
+      assert(row, `User with email ${normalized.email} not found`);
+      await tx.update(UserTable).set({
+        email: normalized.email,
+        name: normalized.name
+      }).where(eq(UserTable.id, row.id));
+      await this.#replaceRoles(tx, row.id, normalized.roles ?? []);
+    });
+    const updatedUser = await this.#getUser(normalized.email);
+    assert(updatedUser, `Failed to retrieve user after update`);
+    return updatedUser;
+  }
+  async removeUser(email) {
+    const normalized = normalizeEmail(email);
+    const db = await this.#db;
+    await db.transaction(async (tx) => {
+      const row = await tx.select().from(UserTable).where(eq(UserTable.email, normalized)).get();
+      assert(row, `User with email ${normalized} not found`);
+      await tx.delete(UserRoleTable).where(eq(UserRoleTable.userId, row.id));
+      await tx.delete(UserTable).where(eq(UserTable.id, row.id));
+    });
+  }
+  async #getUser(email) {
+    const db = await this.#db;
+    const user = await db.select(selectUser).from(UserTable).where(eq(UserTable.email, email)).get();
+    if (user) return userFromRow(user);
+    return void 0;
+  }
+  async #replaceRoles(db, userId, roles) {
+    const uniqueRoles = Array.from(new Set(roles));
+    await db.delete(UserRoleTable).where(eq(UserRoleTable.userId, userId));
+    if (uniqueRoles.length === 0) return;
+    await db.insert(UserRoleTable).values(
+      uniqueRoles.map((role) => {
+        return { userId, role };
+      })
+    );
+  }
 };
+function prepareDatabase(db) {
+  const existing = preparedDatabases.get(db);
+  if (existing) return existing;
+  const prepared = PLazy.from(async () => {
+    await db.migrate(...tables);
+    await enablePostgresRowLevelSecurity(db);
+    return db;
+  });
+  preparedDatabases.set(db, prepared);
+  return prepared;
+}
+async function enablePostgresRowLevelSecurity(db) {
+  if (db.dialect.runtime !== "postgres") return;
+  for (const table2 of tables) {
+    await db.run(sql`alter table ${table2} enable row level security`);
+  }
+}
+function userFromRow(row) {
+  return {
+    ...row,
+    sub: row.email,
+    name: row.name ?? void 0
+  };
+}
+function normalizeUser(user) {
+  const email = normalizeEmail(user.email);
+  const name = user.name?.trim() || void 0;
+  const roles = Array.from(new Set(user.roles ?? []));
+  return {
+    sub: user.sub,
+    email,
+    name,
+    roles
+  };
+}
+function normalizeEmail(email) {
+  assert(email, "User email is required");
+  const normalized = email.trim().toLowerCase();
+  assert(normalized, "User email is required");
+  return normalized;
+}
 export {
   DatabaseApi
 };

package/dist/backend/api/GithubApi.d.ts

@@ -3,10 +3,6 @@ import type { EntryRecord } from 'alinea/core/EntryRecord';
 import type { CommitRequest } from 'alinea/core/db/CommitRequest';
 import { GithubSource, type GithubSourceOptions } from 'alinea/core/source/GithubSource';
 export interface GithubOptions extends GithubSourceOptions {
-    author?: {
-        name: string;
-        email: string;
-    };
 }
 export declare class GithubApi extends GithubSource implements HistoryApi, CommitApi, SyncApi {
     #private;

package/dist/backend/api/GithubApi.js

@@ -1,10 +1,11 @@
-import "../../chunks/chunk-NZLE2WMY.js";
+import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/backend/api/GithubApi.ts
 import { parseCoAuthoredBy } from "alinea/cli/util/CommitMessage";
 import { HttpError } from "alinea/core/HttpError";
 import {
-  GithubSource
+  GithubSource,
+  normalizeGithubSourceOptions
 } from "alinea/core/source/GithubSource";
 import { ShaMismatchError } from "alinea/core/source/ShaMismatchError";
 import { base64, btoa } from "alinea/core/util/Encoding";
@@ -13,20 +14,21 @@ import { join } from "alinea/core/util/Paths";
 var GithubApi = class extends GithubSource {
   #options;
   constructor(options) {
-    super(options);
-    this.#options = options;
+    const normalized = normalizeGithubSourceOptions(options);
+    super(normalized);
+    this.#options = normalized;
   }
   async write(request) {
     const currentCommit = await this.#getLatestCommitOid();
     const currentSha = await this.shaAt(currentCommit);
     if (currentSha !== request.fromSha)
       throw new ShaMismatchError(currentSha, request.fromSha);
-    const { author } = this.#options;
+    const { user } = request;
     let commitMessage = request.description;
-    if (author) {
+    if (user?.name && user.email) {
       commitMessage += `
 
-Co-authored-by: ${author.name} <${author.email}>`;
+Co-authored-by: ${user.name} <${user.email}>`;
     }
     const newCommit = await this.#applyChangesToRepo(
       currentCommit,
@@ -248,6 +250,8 @@ Co-authored-by: ${author.name} <${author.email}>`;
   }
   async #fetchUploadedContent(url) {
     const response = await fetch(url);
+    if (!response.ok)
+      throw new HttpError(response.status, await response.text());
     return base64.stringify(new Uint8Array(await response.arrayBuffer()));
   }
 };

package/dist/backend/api/OAuth2.d.ts

@@ -1,7 +1,7 @@
-import { Request, Response } from '@alinea/iso';
 import { Config } from 'alinea/core/Config';
-import type { AuthApi, AuthedContext, RequestContext } from 'alinea/core/Connection';
+import type { AuthApi, AuthOptions, AuthedContext, RequestContext } from 'alinea/core/Connection';
 import { JWTPayload } from 'alinea/core/util/JWT';
+import { Request, Response } from '@alinea/iso';
 export interface OAuth2Options {
     /**
      * OAuth2 clientId
@@ -46,6 +46,6 @@ export interface OAuth2Options {
 export declare class OAuth2 implements AuthApi {
     #private;
     constructor(context: RequestContext, config: Config, options: OAuth2Options);
-    authenticate(request: Request): Promise<Response>;
+    authenticate(request: Request, options?: AuthOptions): Promise<Response>;
     verify(request: Request): Promise<AuthedContext>;
 }

package/dist/backend/api/OAuth2.js

@@ -1,12 +1,19 @@
 import {
   parse
-} from "../../chunks/chunk-5LTN67OE.js";
+} from "../../chunks/chunk-BYJRQTFR.js";
 import {
   PLazy
 } from "../../chunks/chunk-IKINPSS5.js";
-import "../../chunks/chunk-NZLE2WMY.js";
+import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/backend/api/OAuth2.ts
+import { AuthResultType } from "alinea/cloud/AuthResult";
+import { Config } from "alinea/core/Config";
+import { HttpError } from "alinea/core/HttpError";
+import { createId } from "alinea/core/Id";
+import { outcome } from "alinea/core/Outcome";
+import { assert } from "alinea/core/util/Assert";
+import { decode, verify } from "alinea/core/util/JWT";
 import { Request as Request2, Response } from "@alinea/iso";
 
 // node_modules/@badgateway/oauth2-client/dist/error.js
@@ -141,7 +148,7 @@ async function getWebCrypto() {
   if (typeof self !== "undefined" && self.crypto) {
     return self.crypto;
   }
-  const crypto = await import("../../chunks/crypto-HZTUU327.js");
+  const crypto = await import("../../chunks/crypto-UO2XRCJS.js");
   return crypto.webcrypto;
 }
 function stringToBuffer(input) {
@@ -158,7 +165,6 @@ function base64Url(buf) {
 // node_modules/@badgateway/oauth2-client/dist/client.js
 var OAuth2Client = class {
   constructor(clientSettings) {
-    this.discoveryDone = false;
     this.serverMetadata = null;
     if (!(clientSettings === null || clientSettings === void 0 ? void 0 : clientSettings.fetch)) {
       clientSettings.fetch = fetch.bind(globalThis);
@@ -291,14 +297,19 @@ var OAuth2Client = class {
         return resolve("/revoke", this.settings.server);
     }
   }
+  discover() {
+    if (this.discoveryPromise === void 0) {
+      this.discoveryPromise = this.doDiscover();
+    }
+    return this.discoveryPromise;
+  }
   /**
    * Fetches the OAuth2 discovery document
+   *
+   * Should not call this directly, call `discover()` instead
    */
-  async discover() {
+  async doDiscover() {
     var _a;
-    if (this.discoveryDone)
-      return;
-    this.discoveryDone = true;
     let discoverUrl;
     try {
       discoverUrl = await this.getEndpoint("discoveryEndpoint");
@@ -400,19 +411,25 @@ var OAuth2Client = class {
    * Converts the JSON response body from the token endpoint to an OAuth2Token type.
    */
   async tokenResponseToOAuth2Token(resp) {
-    var _a;
     const body = await resp;
     if (!(body === null || body === void 0 ? void 0 : body.access_token)) {
       console.warn("Invalid OAuth2 Token Response: ", body);
       throw new TypeError("We received an invalid token response from an OAuth2 server.");
     }
+    const { access_token, refresh_token, expires_in, id_token, scope, token_type, ...extraParams } = body;
     const result = {
-      accessToken: body.access_token,
-      expiresAt: body.expires_in ? Date.now() + body.expires_in * 1e3 : null,
-      refreshToken: (_a = body.refresh_token) !== null && _a !== void 0 ? _a : null
+      accessToken: access_token,
+      expiresAt: expires_in ? Date.now() + expires_in * 1e3 : null,
+      refreshToken: refresh_token !== null && refresh_token !== void 0 ? refresh_token : null
     };
-    if (body.id_token) {
-      result.idToken = body.id_token;
+    if (id_token) {
+      result.idToken = id_token;
+    }
+    if (scope) {
+      result.scope = scope.split(" ");
+    }
+    if (Object.keys(extraParams).length > 0) {
+      result.extraParams = extraParams;
     }
     return result;
   }
@@ -436,13 +453,6 @@ function legacyFormUrlEncode(value) {
 }
 
 // src/backend/api/OAuth2.ts
-import { AuthResultType } from "alinea/cloud/AuthResult";
-import { Config } from "alinea/core/Config";
-import { HttpError } from "alinea/core/HttpError";
-import { createId } from "alinea/core/Id";
-import { outcome } from "alinea/core/Outcome";
-import { assert } from "alinea/core/util/Assert";
-import { decode, verify } from "alinea/core/util/JWT";
 import {
   AuthAction,
   InvalidCredentialsError,
@@ -465,7 +475,7 @@ var OAuth2 = class {
     this.#client = new OAuth2Client({
       ...options,
       authenticationMethod: "client_secret_basic_interop",
-      fetch: async (input, init) => {
+      fetch: (async (input, init) => {
         const request = new Request2(input, init);
         const response = await fetch(request);
         if (!response.ok) {
@@ -473,7 +483,7 @@ var OAuth2 = class {
           throw new HttpError(response.status, text);
         }
         return response;
-      }
+      })
     });
     const loadJwks = async () => {
       try {
@@ -494,7 +504,7 @@ var OAuth2 = class {
     url.searchParams.set("auth", "login");
     return url;
   }
-  async authenticate(request) {
+  async authenticate(request, options) {
     try {
       const url = new URL(request.url);
       const action = url.searchParams.get("auth");
@@ -504,9 +514,10 @@ var OAuth2 = class {
           const [ctx, err] = await outcome(this.verify(request));
           if (err instanceof Response) return err;
           if (ctx) {
+            const user = options?.enrichUser ? await options.enrichUser(ctx.user) : ctx.user;
             return Response.json({
               type: AuthResultType.Authenticated,
-              user: ctx.user
+              user
             });
           }
           const codeVerifier = await generateCodeVerifier();