bunderstack 0.15.2 → 0.17.0-beta.0

package/src/crud.ts

@@ -1,408 +0,0 @@
-import { eq, getTableColumns, getTableName, isTable } from 'drizzle-orm'
-import { Hono } from 'hono'
-
-import type { AnyDb } from './dialect'
-import type { RealtimeFacade } from './realtime/facade'
-
-import {
-  checkAccess,
-  resolveSession,
-  rowMatchesScope,
-  stampScope,
-  sanitizeWriteBody,
-  type AccessUser,
-  type AuthSessionResolver,
-  type CrudOperation,
-  type ResolvedAccess,
-  type ResolvedTableAccess,
-  type ScopeMap,
-  type ScopeResolver,
-  type AccessContext,
-} from './access'
-import { ErrorCode, apiError, ListQueryError } from './errors'
-import {
-  lookupIdempotency,
-  resolveIdempotencyConfig,
-  storeIdempotency,
-  type IdempotencyConfig,
-} from './idempotency'
-import { executeList, parseListParams } from './list-query'
-import { buildScopeWhere } from './scope'
-
-export type CrudRouterOptions<
-  TSchema extends Record<string, unknown> = Record<string, unknown>,
-> = {
-  auth?: AuthSessionResolver
-  access: ResolvedAccess
-  idempotency?: boolean | IdempotencyConfig
-  realtime?: RealtimeFacade<TSchema>
-}
-
-function tableEntryForName(
-  access: ResolvedAccess,
-  tableName: string,
-): ResolvedTableAccess | undefined {
-  for (const entry of access.values()) {
-    if (entry.tableName === tableName) return entry
-  }
-  return undefined
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-}
-
-async function enforce(
-  operation: CrudOperation,
-  access: ResolvedTableAccess,
-  ctx: Parameters<typeof checkAccess>[1],
-) {
-  const rule = access[operation]
-  const result = await checkAccess(rule, ctx, access.ownerColumn)
-  return result
-}
-
-export function buildCrudRouter<TSchema extends Record<string, unknown>>(
-  schema: TSchema,
-  db: AnyDb,
-  options: CrudRouterOptions<TSchema>,
-): Hono {
-  const router = new Hono()
-  const { auth, access, realtime } = options
-  const idempotency = resolveIdempotencyConfig(options.idempotency)
-
-  const scopeFor = (
-    resolver: ScopeResolver | undefined,
-    ctx: AccessContext,
-  ): ScopeMap | undefined => (resolver ? resolver(ctx) : undefined)
-
-  for (const table of Object.values(schema)) {
-    if (!isTable(table)) continue
-
-    const name = getTableName(table)
-    const tableAccess = tableEntryForName(access, name)
-    if (!tableAccess?.enabled) continue
-
-    const idCol = getTableColumns(table)['id']
-    if (!idCol) continue
-
-    router.get(`/${name}`, async (c) => {
-      const { user, activeOrganizationId } = await resolveSession(
-        auth,
-        c.req.raw.headers,
-      )
-      const session = { activeOrganizationId }
-      const denied = await enforce('list', tableAccess, {
-        user,
-        session,
-        request: c.req.raw,
-      })
-      if (!denied.allowed) {
-        return apiError(
-          c,
-          ErrorCode.FORBIDDEN,
-          'Forbidden',
-          denied.status === 401 ? 401 : 403,
-        )
-      }
-
-      try {
-        const params = parseListParams(new URL(c.req.url), tableAccess)
-        const scope = scopeFor(tableAccess.readScope, {
-          user,
-          session,
-          request: c.req.raw,
-        })
-        const scopeWhere = scope ? buildScopeWhere(table, scope) : undefined
-        const result = await executeList(
-          db,
-          table,
-          tableAccess,
-          params,
-          idCol,
-          scopeWhere,
-        )
-        return c.json(result)
-      } catch (err) {
-        if (err instanceof ListQueryError) {
-          return apiError(c, err.code, err.message, 400, err.details)
-        }
-        throw err
-      }
-    })
-
-    router.get(`/${name}/:id`, async (c) => {
-      const { user, activeOrganizationId } = await resolveSession(
-        auth,
-        c.req.raw.headers,
-      )
-      const session = { activeOrganizationId }
-      const rawId = c.req.param('id')
-      const id = isNaN(Number(rawId)) ? rawId : Number(rawId)
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const rows = await (db as any)
-        .select()
-        .from(table)
-        .where(eq(idCol as any, id))
-      if (!rows[0]) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-
-      const denied = await enforce('get', tableAccess, {
-        user,
-        session,
-        request: c.req.raw,
-        row: rows[0] as Record<string, unknown>,
-      })
-      if (!denied.allowed) {
-        return apiError(
-          c,
-          ErrorCode.FORBIDDEN,
-          'Forbidden',
-          denied.status === 401 ? 401 : 403,
-        )
-      }
-
-      const scope = scopeFor(tableAccess.readScope, {
-        user,
-        session,
-        request: c.req.raw,
-      })
-      if (
-        scope &&
-        !rowMatchesScope(rows[0] as Record<string, unknown>, scope)
-      ) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-
-      return c.json(rows[0])
-    })
-
-    router.post(`/${name}`, async (c) => {
-      const { user, activeOrganizationId } = await resolveSession(
-        auth,
-        c.req.raw.headers,
-      )
-      const session = { activeOrganizationId }
-      const denied = await enforce('create', tableAccess, {
-        user,
-        session,
-        request: c.req.raw,
-      })
-      if (!denied.allowed) {
-        return apiError(
-          c,
-          ErrorCode.FORBIDDEN,
-          'Forbidden',
-          denied.status === 401 ? 401 : 403,
-        )
-      }
-
-      const rawBody = await c.req.text()
-      let body: unknown
-      try {
-        body = rawBody ? JSON.parse(rawBody) : null
-      } catch {
-        return apiError(c, ErrorCode.VALIDATION_ERROR, 'Invalid JSON', 400)
-      }
-      if (!isRecord(body)) {
-        return apiError(c, ErrorCode.VALIDATION_ERROR, 'Invalid JSON body', 400)
-      }
-
-      const idempotencyKey = c.req.header('Idempotency-Key')?.trim()
-      if (idempotency && idempotencyKey) {
-        const lookup = await lookupIdempotency(
-          db,
-          name,
-          idempotencyKey,
-          rawBody,
-          idempotency,
-        )
-        if (lookup.type === 'conflict') {
-          return apiError(
-            c,
-            ErrorCode.IDEMPOTENCY_CONFLICT,
-            'Idempotency key reused with different body',
-            409,
-          )
-        }
-        if (lookup.type === 'replay') {
-          return new Response(lookup.response, {
-            status: lookup.status,
-            headers: {
-              'Content-Type': 'application/json',
-              'Idempotency-Replayed': 'true',
-            },
-          })
-        }
-      }
-
-      const values = sanitizeWriteBody(
-        body,
-        tableAccess,
-        'create',
-        user?.id ?? null,
-      )
-
-      const scope = scopeFor(tableAccess.writeScope, {
-        user,
-        session,
-        request: c.req.raw,
-        body: body as Record<string, unknown>,
-      })
-      const stamped = scope ? stampScope(values, scope) : values
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const rows = await (db as any).insert(table).values(stamped).returning()
-      const created = rows[0]
-      void realtime?.publish(table as never, 'create', created as never)
-
-      if (idempotency && idempotencyKey) {
-        await storeIdempotency(
-          db,
-          name,
-          idempotencyKey,
-          rawBody,
-          201,
-          created,
-          idempotency,
-        )
-      }
-
-      return c.json(created, 201)
-    })
-
-    router.patch(`/${name}/:id`, async (c) => {
-      const { user, activeOrganizationId } = await resolveSession(
-        auth,
-        c.req.raw.headers,
-      )
-      const session = { activeOrganizationId }
-      const rawId = c.req.param('id')
-      const id = isNaN(Number(rawId)) ? rawId : Number(rawId)
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const existing = await (db as any)
-        .select()
-        .from(table)
-        .where(eq(idCol as any, id))
-      if (!existing[0]) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-
-      const readScope = scopeFor(tableAccess.readScope, {
-        user,
-        session,
-        request: c.req.raw,
-      })
-      if (
-        readScope &&
-        !rowMatchesScope(existing[0] as Record<string, unknown>, readScope)
-      ) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-
-      const denied = await enforce('update', tableAccess, {
-        user,
-        session,
-        request: c.req.raw,
-        row: existing[0] as Record<string, unknown>,
-      })
-      if (!denied.allowed) {
-        return apiError(
-          c,
-          ErrorCode.FORBIDDEN,
-          'Forbidden',
-          denied.status === 401 ? 401 : 403,
-        )
-      }
-
-      let body: unknown
-      try {
-        body = await c.req.json()
-      } catch {
-        return apiError(c, ErrorCode.VALIDATION_ERROR, 'Invalid JSON', 400)
-      }
-      if (!isRecord(body)) {
-        return apiError(c, ErrorCode.VALIDATION_ERROR, 'Invalid JSON body', 400)
-      }
-
-      const values = sanitizeWriteBody(
-        body,
-        tableAccess,
-        'update',
-        user?.id ?? null,
-      )
-
-      const writeScope = scopeFor(tableAccess.writeScope, {
-        user,
-        session,
-        request: c.req.raw,
-        body: body as Record<string, unknown>,
-      })
-      const stamped = writeScope ? stampScope(values, writeScope) : values
-
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const rows = await (db as any)
-        .update(table)
-        .set(stamped)
-        .where(eq(idCol as any, id))
-        .returning()
-      if (!rows[0]) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-      void realtime?.publish(table as never, 'update', rows[0] as never)
-      return c.json(rows[0])
-    })
-
-    router.delete(`/${name}/:id`, async (c) => {
-      const { user, activeOrganizationId } = await resolveSession(
-        auth,
-        c.req.raw.headers,
-      )
-      const session = { activeOrganizationId }
-      const rawId = c.req.param('id')
-      const id = isNaN(Number(rawId)) ? rawId : Number(rawId)
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const existing = await (db as any)
-        .select()
-        .from(table)
-        .where(eq(idCol as any, id))
-      if (!existing[0]) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-
-      const scope = scopeFor(tableAccess.readScope, {
-        user,
-        session,
-        request: c.req.raw,
-      })
-      if (
-        scope &&
-        !rowMatchesScope(existing[0] as Record<string, unknown>, scope)
-      ) {
-        return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
-      }
-
-      const denied = await enforce('delete', tableAccess, {
-        user,
-        session,
-        request: c.req.raw,
-        row: existing[0] as Record<string, unknown>,
-      })
-      if (!denied.allowed) {
-        return apiError(
-          c,
-          ErrorCode.FORBIDDEN,
-          'Forbidden',
-          denied.status === 401 ? 401 : 403,
-        )
-      }
-
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      await (db as any).delete(table).where(eq(idCol as any, id))
-      void realtime?.publish(table as never, 'delete', existing[0] as never)
-      return new Response(null, { status: 204 })
-    })
-  }
-
-  return router
-}

package/src/jobs/cron-auth.ts

@@ -1,28 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
-
-function canonical(taskId: string, slot: number): string {
-  return `${taskId}\n${slot}`
-}
-
-export function signScheduleRequest(
-  secret: string,
-  taskId: string,
-  slot: number,
-): string {
-  const digest = createHmac('sha256', secret)
-    .update(canonical(taskId, slot))
-    .digest('hex')
-  return `sha256=${digest}`
-}
-
-export function verifyScheduleRequest(
-  secret: string,
-  taskId: string,
-  slot: number,
-  signature: string,
-): boolean {
-  if (!/^sha256=[0-9a-f]{64}$/.test(signature)) return false
-  const expected = Buffer.from(signScheduleRequest(secret, taskId, slot))
-  const received = Buffer.from(signature)
-  return timingSafeEqual(expected, received)
-}

package/src/jobs/cron-router.ts

@@ -1,135 +0,0 @@
-import { and, eq, lt } from 'drizzle-orm'
-import { Hono } from 'hono'
-
-import type { AnyDb } from '../dialect'
-import type { BackgroundDefs } from './define'
-
-import { cronRunsTableFor } from '../internal-tables'
-import { verifyScheduleRequest } from './cron-auth'
-import { runCronSlot, runScheduledSlot } from './cron-runner'
-
-const MAX_SLOT_AGE_MS = 60 * 60_000
-const MAX_FUTURE_SLOT_MS = 60_000
-const STORAGE_SWEEP_SCHEDULE = '0 4 * * *'
-const SCHEDULED_RUN_RETENTION_MS = 30 * 24 * 60 * 60_000
-
-export function buildCronRouter(args: {
-  db: AnyDb
-  defs: BackgroundDefs
-  ctx: Record<string, unknown>
-  secret: string
-  storage: { sweep: () => Promise<unknown> }
-  now?: () => number
-}): Hono {
-  const app = new Hono()
-  const now = args.now ?? Date.now
-
-  app.post('/cron/:name', async (c) => {
-    const name = c.req.param('name')
-    const slotText = c.req.header('X-Bunderstack-Cron-Slot')
-    const signature = c.req.header('X-Bunderstack-Cron-Signature')
-    const slot = Number(slotText)
-    if (!slotText || !Number.isSafeInteger(slot) || !signature) {
-      return c.json({ error: 'invalid schedule signature' }, 401)
-    }
-    if (!verifyScheduleRequest(args.secret, `cron:${name}`, slot, signature)) {
-      return c.json({ error: 'invalid schedule signature' }, 401)
-    }
-    const definition = args.defs[name]
-    if (!definition || definition.kind !== 'cron') {
-      return c.json({ error: 'unknown cron' }, 404)
-    }
-    const current = now()
-    if (
-      slot % 60_000 !== 0 ||
-      slot < current - MAX_SLOT_AGE_MS ||
-      slot > current + MAX_FUTURE_SLOT_MS
-    ) {
-      return c.json({ error: 'invalid cron slot' }, 400)
-    }
-    try {
-      const result = await runCronSlot({
-        db: args.db,
-        defs: args.defs,
-        ctx: args.ctx,
-        name,
-        slot,
-        now: current,
-      })
-      return c.json(result, result.status === 'running' ? 202 : 200)
-    } catch (error) {
-      if (
-        error instanceof Error &&
-        error.message === '[bunderstack] cron slot does not match its schedule'
-      ) {
-        return c.json({ error: 'invalid cron slot' }, 400)
-      }
-      return c.json({ error: 'cron handler failed' }, 500)
-    }
-  })
-
-  app.post('/maintenance/:name', async (c) => {
-    const name = c.req.param('name')
-    const slotText = c.req.header('X-Bunderstack-Cron-Slot')
-    const signature = c.req.header('X-Bunderstack-Cron-Signature')
-    const slot = Number(slotText)
-    if (!slotText || !Number.isSafeInteger(slot) || !signature) {
-      return c.json({ error: 'invalid schedule signature' }, 401)
-    }
-    if (
-      !verifyScheduleRequest(
-        args.secret,
-        `maintenance:${name}`,
-        slot,
-        signature,
-      )
-    ) {
-      return c.json({ error: 'invalid schedule signature' }, 401)
-    }
-    if (name !== 'storage-sweep') {
-      return c.json({ error: 'unknown maintenance task' }, 404)
-    }
-    const current = now()
-    if (
-      slot % 60_000 !== 0 ||
-      slot < current - MAX_SLOT_AGE_MS ||
-      slot > current + MAX_FUTURE_SLOT_MS
-    ) {
-      return c.json({ error: 'invalid cron slot' }, 400)
-    }
-    try {
-      const result = await runScheduledSlot({
-        db: args.db,
-        taskId: 'maintenance:storage-sweep',
-        schedule: STORAGE_SWEEP_SCHEDULE,
-        slot,
-        now: current,
-        run: async () => {
-          await args.storage.sweep()
-        },
-      })
-      if (result.status === 'succeeded') {
-        const t = cronRunsTableFor(args.db)
-        await args.db
-          .delete(t)
-          .where(
-            and(
-              eq(t.status, 'succeeded'),
-              lt(t.finishedAt, current - SCHEDULED_RUN_RETENTION_MS),
-            ),
-          )
-      }
-      return c.json(result, result.status === 'running' ? 202 : 200)
-    } catch (error) {
-      if (
-        error instanceof Error &&
-        error.message === '[bunderstack] cron slot does not match its schedule'
-      ) {
-        return c.json({ error: 'invalid cron slot' }, 400)
-      }
-      return c.json({ error: 'maintenance handler failed' }, 500)
-    }
-  })
-
-  return app
-}