db-model-router 1.0.5 → 1.0.7

package/dbmr.schema.json

@@ -2,35 +2,13 @@
   "adapter": "sqlite3",
   "framework": "express",
   "options": {
-    "session": "redis",
+    "session": "memory",
     "rateLimiting": true,
     "helmet": true,
     "logger": true,
     "loki": false
   },
   "tables": {
-    "users": {
-      "columns": {
-        "user_id": "auto_increment",
-        "name": "required|string",
-        "email": "required|string",
-        "password_hash": "required|string",
-        "phone": "string",
-        "avatar_url": "string",
-        "role": "required|string",
-        "is_deleted": "boolean",
-        "created_at": "datetime",
-        "updated_at": "datetime"
-      },
-      "pk": "user_id",
-      "unique": ["email"],
-      "softDelete": "is_deleted",
-      "timestamps": {
-        "created_at": "created_at",
-        "modified_at": "updated_at"
-      },
-      "parent": null
-    },
     "addresses": {
       "columns": {
         "address_id": "auto_increment",
@@ -44,13 +22,13 @@
         "country": "required|string",
         "is_default": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "address_id",
       "unique": ["address_id"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -65,13 +43,13 @@
         "sort_order": "integer",
         "is_active": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "category_id",
       "unique": ["slug"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -97,14 +75,14 @@
         "is_deleted": "boolean",
         "meta": "object",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "product_id",
       "unique": ["sku", "slug"],
       "softDelete": "is_deleted",
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -136,13 +114,13 @@
         "attributes": "object",
         "is_active": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "variant_id",
       "unique": ["sku"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "products"
     },
@@ -157,13 +135,13 @@
         "is_verified": "boolean",
         "is_approved": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "review_id",
       "unique": ["review_id"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "products"
     },
@@ -174,13 +152,13 @@
         "session_id": "string",
         "currency": "required|string",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "cart_id",
       "unique": ["cart_id"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -193,13 +171,13 @@
         "quantity": "required|integer",
         "unit_price": "required|numeric",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "cart_item_id",
       "unique": ["cart_item_id"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "carts"
     },
@@ -219,13 +197,13 @@
         "billing_address_id": "integer",
         "notes": "string",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "order_id",
       "unique": ["order_number"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -261,13 +239,13 @@
         "status": "required|string",
         "paid_at": "datetime",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "payment_id",
       "unique": ["payment_id"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "orders"
     },
@@ -281,13 +259,13 @@
         "shipped_at": "datetime",
         "delivered_at": "datetime",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "shipment_id",
       "unique": ["shipment_id"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "orders"
     },
@@ -305,13 +283,13 @@
         "expires_at": "datetime",
         "is_active": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "coupon_id",
       "unique": ["code"],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },

package/demo/.env.example

@@ -1,5 +1,6 @@
 # Server
 PORT=3000
+API_BASE_PATH=/api
 
 # Database
 DB_NAME=./data/data.db

package/demo/app.js

@@ -4,7 +4,9 @@ import configureSession from "./commons/session.js";
 import applySecurity from "./commons/security.js";
 import logger from "./middleware/logger.js";
 import route from "./routes/index.js";
-
+import { fileURLToPath } from 'node:url';
+import path from "path";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const app = express();
 const PORT = process.env.PORT || 3000;
 

package/demo/commons/db.js

@@ -9,6 +9,17 @@ dbModelRouter.db.connect({
   database: process.env.DB_NAME || "./data/data.db",
 });
 
+// Initialize Kafka if KAFKA_BROKER is configured
+if (process.env.KAFKA_BROKER) {
+  dbModelRouter.kafka.init().then((connected) => {
+    if (connected) {
+      console.log("[kafka] Producer connected to", process.env.KAFKA_BROKER);
+    } else {
+      console.warn("[kafka] Failed to connect to Kafka broker");
+    }
+  });
+}
+
 // Make db available globally across the application
 const db = dbModelRouter.db;
 global.db = db;

package/demo/commons/migrate.js

@@ -58,6 +58,9 @@ if (isMain) {
   const pkg = await import("db-model-router");
   const mod = pkg.default || pkg;
   mod.init("sqlite3");
+  mod.db.connect({
+    database: process.env.DB_NAME || "./data/data.db",
+});
   const migrationsDir = path.join(__dirname, "../migrations");
   runMigrations(mod.db, migrationsDir)
     .then(() => process.exit(0))

package/demo/commons/modules.js

@@ -0,0 +1,18 @@
+/**
+ * Registry of all SaaS module names.
+ * This is the single source of truth for valid module identifiers
+ * used by the permission system.
+ *
+ * @type {string[]}
+ */
+export const modules = ["users", "tenants", "roles", "permissions", "webhooks"];
+
+/**
+ * Check whether a given name is a registered module.
+ *
+ * @param {string} name - The module name to validate
+ * @returns {boolean} True if the name exists in the modules registry
+ */
+export function isValidModule(name) {
+  return modules.includes(name);
+}

package/demo/commons/password.js

@@ -0,0 +1,36 @@
+import crypto from "crypto";
+
+/**
+ * Hash a password using scrypt with a random salt.
+ * Returns a string in the format "salt:derivedKey" (both hex-encoded).
+ *
+ * @param {string} password - The plaintext password to hash
+ * @returns {Promise<string>} The hashed password string
+ */
+export function hashPassword(password) {
+  const salt = crypto.randomBytes(16).toString("hex");
+  return new Promise((resolve, reject) => {
+    crypto.scrypt(password, salt, 64, (err, derivedKey) => {
+      if (err) reject(err);
+      resolve(salt + ":" + derivedKey.toString("hex"));
+    });
+  });
+}
+
+/**
+ * Verify a password against a previously hashed value.
+ * Uses timing-safe comparison to prevent timing attacks.
+ *
+ * @param {string} password - The plaintext password to verify
+ * @param {string} hash - The stored hash in "salt:derivedKey" format
+ * @returns {Promise<boolean>} True if the password matches, false otherwise
+ */
+export function verifyPassword(password, hash) {
+  const [salt, key] = hash.split(":");
+  return new Promise((resolve, reject) => {
+    crypto.scrypt(password, salt, 64, (err, derivedKey) => {
+      if (err) reject(err);
+      resolve(crypto.timingSafeEqual(Buffer.from(key, "hex"), derivedKey));
+    });
+  });
+}

package/demo/commons/webhook.js

@@ -0,0 +1,81 @@
+import crypto from "crypto";
+
+/**
+ * Retry delay schedule in seconds.
+ * Attempt 0: immediate, 1: 1 min, 2: 5 min, 3: 1 hour, 4: 1 day.
+ *
+ * @type {number[]}
+ */
+export const RETRY_DELAYS = [0, 60, 300, 3600, 86400];
+
+/**
+ * Sign a webhook payload using HMAC-SHA256.
+ *
+ * @param {object} payload - The payload object to sign
+ * @param {string} secret - The tenant's webhook secret
+ * @returns {string} Hex-encoded HMAC-SHA256 signature
+ */
+export function signPayload(payload, secret) {
+  const body = JSON.stringify(payload);
+  return crypto.createHmac("sha256", secret).update(body).digest("hex");
+}
+
+/**
+ * Look up the configured webhook for a tenant.
+ * TODO: Replace this stub with actual database lookup.
+ */
+export async function lookupWebhook(tenantId) {
+  return null;
+}
+
+/**
+ * Log a webhook delivery event.
+ * TODO: Replace this stub with actual database insert into webhook_logs.
+ */
+export async function logWebhookEvent(webhookId, tenantId, eventType, payload, status, responseBody, responseStatusCode) {
+  // Stub: replace with actual DB insert
+}
+
+/**
+ * Delay execution for the specified number of milliseconds.
+ */
+export function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Send a webhook notification to the configured endpoint for a tenant.
+ * Retries delivery up to 5 times with exponential backoff.
+ */
+export async function sendWebhook(tenantId, event, context) {
+  const webhook = await lookupWebhook(tenantId);
+  if (!webhook) return;
+
+  const payload = { context, event, timestamp: new Date().toISOString() };
+  payload.signature = signPayload(payload, webhook.secret);
+
+  for (let attempt = 0; attempt < RETRY_DELAYS.length; attempt++) {
+    if (attempt > 0) {
+      await delay(RETRY_DELAYS[attempt] * 1000);
+      console.log(`Webhook retry attempt ${attempt}, delay: ${RETRY_DELAYS[attempt]}s`);
+    }
+    try {
+      const response = await fetch(webhook.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Webhook-Key": webhook.key },
+        body: JSON.stringify(payload),
+      });
+      await logWebhookEvent(
+        webhook.id, tenantId, event.type, payload,
+        response.ok ? "success" : "failed",
+        await response.text(), response.status
+      );
+      if (response.ok) return;
+    } catch (err) {
+      await logWebhookEvent(
+        webhook.id, tenantId, event.type, payload,
+        "error", err.message, null
+      );
+    }
+  }
+}

package/demo/dbmr.schema.json

@@ -7,30 +7,6 @@
     "logger": true
   },
   "tables": {
-    "users": {
-      "columns": {
-        "user_id": "auto_increment",
-        "name": "required|string",
-        "email": "required|string",
-        "password_hash": "required|string",
-        "phone": "string",
-        "avatar_url": "string",
-        "role": "required|string",
-        "is_deleted": "boolean",
-        "created_at": "datetime",
-        "updated_at": "datetime"
-      },
-      "pk": "user_id",
-      "unique": [
-        "email"
-      ],
-      "softDelete": "is_deleted",
-      "timestamps": {
-        "created_at": "created_at",
-        "modified_at": "updated_at"
-      },
-      "parent": null
-    },
     "addresses": {
       "columns": {
         "address_id": "auto_increment",
@@ -44,7 +20,7 @@
         "country": "required|string",
         "is_default": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "address_id",
       "unique": [
@@ -52,7 +28,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -67,7 +43,7 @@
         "sort_order": "integer",
         "is_active": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "category_id",
       "unique": [
@@ -75,7 +51,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -101,7 +77,7 @@
         "is_deleted": "boolean",
         "meta": "object",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "product_id",
       "unique": [
@@ -111,7 +87,7 @@
       "softDelete": "is_deleted",
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -145,7 +121,7 @@
         "attributes": "object",
         "is_active": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "variant_id",
       "unique": [
@@ -153,7 +129,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "products"
     },
@@ -168,7 +144,7 @@
         "is_verified": "boolean",
         "is_approved": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "review_id",
       "unique": [
@@ -176,7 +152,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "products"
     },
@@ -187,7 +163,7 @@
         "session_id": "string",
         "currency": "required|string",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "cart_id",
       "unique": [
@@ -195,7 +171,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -208,7 +184,7 @@
         "quantity": "required|integer",
         "unit_price": "required|numeric",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "cart_item_id",
       "unique": [
@@ -216,7 +192,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "carts"
     },
@@ -236,7 +212,7 @@
         "billing_address_id": "integer",
         "notes": "string",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "order_id",
       "unique": [
@@ -244,7 +220,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },
@@ -282,7 +258,7 @@
         "status": "required|string",
         "paid_at": "datetime",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "payment_id",
       "unique": [
@@ -290,7 +266,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "orders"
     },
@@ -304,7 +280,7 @@
         "shipped_at": "datetime",
         "delivered_at": "datetime",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "shipment_id",
       "unique": [
@@ -312,7 +288,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": "orders"
     },
@@ -330,7 +306,7 @@
         "expires_at": "datetime",
         "is_active": "boolean",
         "created_at": "datetime",
-        "updated_at": "datetime"
+        "modified_at": "datetime"
       },
       "pk": "coupon_id",
       "unique": [
@@ -338,7 +314,7 @@
       ],
       "timestamps": {
         "created_at": "created_at",
-        "modified_at": "updated_at"
+        "modified_at": "modified_at"
       },
       "parent": null
     },

package/demo/middleware/authenticate.js

@@ -0,0 +1,14 @@
+/**
+ * Authentication middleware.
+ *
+ * Validates that the request has an active session with a user object.
+ * Responds with 401 Unauthorized if no valid session exists.
+ */
+function authenticate(req, res, next) {
+  if (!req.session || !req.session.user) {
+    return res.status(401).json({ message: "Unauthorized" });
+  }
+  next();
+}
+
+export default authenticate;

package/demo/middleware/hasPermission.js

@@ -0,0 +1,30 @@
+import { isValidModule } from "#commons/modules.js";
+
+/**
+ * Permission validation middleware factory.
+ *
+ * Returns a middleware function that checks whether the authenticated user
+ * has the required permission for the specified module and action.
+ * A permission entry with action "global" grants access to any action
+ * on that module.
+ *
+ * @param {string} module - The module name to check permission for
+ * @param {string} action - The required action
+ * @returns {function} Express middleware function
+ */
+function hasPermission(module, action) {
+  return (req, res, next) => {
+    if (!isValidModule(module)) {
+      return res.status(403).json({ message: "Invalid module" });
+    }
+    const match = req.session.permission.find(
+      (p) => p.module === module && (p.action === action || p.action === "global")
+    );
+    if (!match) {
+      return res.status(403).json({ message: "Forbidden" });
+    }
+    next();
+  };
+}
+
+export default hasPermission;

package/demo/middleware/tenantIsolation.js

@@ -0,0 +1,17 @@
+/**
+ * Tenant isolation middleware.
+ *
+ * Restricts data access to the user's own tenant unless the user
+ * has a global-scoped permission. Injects tenant_id into query
+ * and body parameters for non-global users.
+ */
+function tenantIsolation(req, res, next) {
+  const hasGlobal = req.session.permission.some((p) => p.scope === "global");
+  if (!hasGlobal) {
+    req.query.tenant_id = req.session.user.tenant_id;
+    req.body.tenant_id = req.session.user.tenant_id;
+  }
+  next();
+}
+
+export default tenantIsolation;