insforge 1.2.10 → 1.4.8

package/auth/tsconfig.json

@@ -1,32 +1,33 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "useDefineForClassFields": true,
-    "lib": ["ES2020", "DOM", "DOM.Iterable"],
-    "module": "ESNext",
-    "skipLibCheck": true,
-
-    /* Bundler mode */
-    "moduleResolution": "bundler",
-    "allowImportingTsExtensions": true,
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "noEmit": true,
-    "jsx": "react-jsx",
-
-    /* Linting */
-    "strict": true,
-    "noUnusedLocals": true,
-    "noUnusedParameters": true,
-    "noFallthroughCasesInSwitch": true,
-
-    /* Path mapping */
-    "baseUrl": ".",
-    "paths": {
-      "@/*": ["./src/*"]
-    }
-  },
-  "include": ["src"],
-  "references": [{ "path": "./tsconfig.node.json" }]
-}
-
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+
+    /* Path mapping */
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"],
+      "@insforge/shared-schemas": ["../shared-schemas/src/index.ts"],
+    }
+  },
+  "include": ["src"],
+  "references": [{ "path": "./tsconfig.node.json" }]
+}
+

package/auth/tsconfig.node.json

@@ -1,11 +1,11 @@
-{
-  "compilerOptions": {
-    "composite": true,
-    "skipLibCheck": true,
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "allowSyntheticDefaultImports": true
-  },
-  "include": ["vite.config.ts"]
-}
-
+{
+  "compilerOptions": {
+    "composite": true,
+    "skipLibCheck": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true
+  },
+  "include": ["vite.config.ts"]
+}
+

package/backend/package.json

@@ -1,75 +1,82 @@
-{
-  "name": "insforge-backend",
-  "version": "1.0.0",
-  "author": "Insforge",
-  "description": "Open source backend-as-a-service with PostgreSQL and MCP integration",
-  "type": "module",
-  "main": "../dist/server.js",
-  "scripts": {
-    "start": "node ../dist/server.js",
-    "dev": "tsx watch src/server.ts",
-    "build": "tsup",
-    "clean": "rimraf dist",
-    "prebuild": "npm run clean",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "test:ui": "vitest --ui",
-    "test:e2e": "./tests/run-all-tests.sh",
-    "migrate:up": "node-pg-migrate up --migrations-dir src/infra/database/migrations --migrations-table _migrations",
-    "migrate:down": "node-pg-migrate down --migrations-dir src/infra/database/migrations --migrations-table _migrations",
-    "migrate:create": "node-pg-migrate create --migrations-dir src/infra/database/migrations --migrations-table _migrations",
-    "migrate:redo": "node-pg-migrate redo --migrations-dir src/infra/database/migrations --migrations-table _migrations",
-    "migrate:up:local": "dotenv -e ../.env -- node-pg-migrate up --migrations-dir src/infra/database/migrations --migrations-table _migrations",
-    "migrate:down:local": "dotenv -e ../.env -- node-pg-migrate down --migrations-dir src/infra/database/migrations --migrations-table _migrations"
-  },
-  "keywords": [
-    "backend-as-a-service",
-    "postgresql",
-    "jwt"
-  ],
-  "dependencies": {
-    "@asteasolutions/zod-to-openapi": "^7.3.4",
-    "@aws-sdk/client-cloudwatch-logs": "^3.713.0",
-    "@aws-sdk/client-s3": "^3.713.0",
-    "@aws-sdk/cloudfront-signer": "^3.901.0",
-    "@aws-sdk/s3-presigned-post": "^3.879.0",
-    "@aws-sdk/s3-request-presigner": "^3.879.0",
-    "@databases/split-sql-query": "^1.0.4",
-    "@databases/sql": "^3.3.0",
-    "@types/multer": "^1.4.13",
-    "@types/pg": "^8.15.4",
-    "axios": "^1.11.0",
-    "bcryptjs": "^3.0.2",
-    "cors": "^2.8.5",
-    "csv-parse": "^6.1.0",
-    "dotenv": "^16.4.5",
-    "express": "^4.19.2",
-    "express-rate-limit": "^7.1.5",
-    "google-auth-library": "^10.1.0",
-    "jose": "^6.1.0",
-    "jsonwebtoken": "^9.0.2",
-    "multer": "^2.0.2",
-    "node-fetch": "^3.3.2",
-    "node-pg-migrate": "^8.0.3",
-    "openai": "^5.19.1",
-    "pg": "^8.16.3",
-    "pg-format": "^1.0.4",
-    "socket.io": "^4.8.1",
-    "winston": "^3.17.0",
-    "zod": "^3.23.8"
-  },
-  "devDependencies": {
-    "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
-    "@types/jsonwebtoken": "^9.0.9",
-    "@types/node": "^20.11.24",
-    "@types/pg-format": "^1.0.5",
-    "dotenv-cli": "^10.0.0",
-    "tsup": "^8.5.0",
-    "tsx": "^4.7.1",
-    "typescript": "^5.3.3",
-    "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.4"
-  }
-}
+{
+  "name": "insforge-backend",
+  "version": "1.0.0",
+  "author": "Insforge",
+  "description": "Open source backend-as-a-service with PostgreSQL and MCP integration",
+  "type": "module",
+  "main": "../dist/server.js",
+  "scripts": {
+    "start": "node ../dist/server.js",
+    "dev": "tsx watch src/server.ts",
+    "build": "tsup",
+    "clean": "rimraf dist",
+    "prebuild": "npm run clean",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:ui": "vitest --ui",
+    "test:bootstrap-import": "tsx tests/verify-bootstrap-import.js",
+    "test:e2e": "./tests/run-all-tests.sh",
+    "migrate:bootstrap": "tsx src/infra/database/migrations/bootstrap/bootstrap-migrations.js",
+    "migrate:up": "npm run migrate:bootstrap && node-pg-migrate up --migrations-dir src/infra/database/migrations --migrations-schema system --migrations-table migrations",
+    "migrate:down": "node-pg-migrate down --migrations-dir src/infra/database/migrations --migrations-schema system --migrations-table migrations",
+    "migrate:create": "node-pg-migrate create --migrations-dir src/infra/database/migrations --migrations-schema system --migrations-table migrations",
+    "migrate:redo": "npm run migrate:bootstrap && node-pg-migrate redo --migrations-dir src/infra/database/migrations --migrations-schema system --migrations-table migrations",
+    "migrate:up:local": "dotenv -e ../.env -- npm run migrate:bootstrap && dotenv -e ../.env -- node-pg-migrate up --migrations-dir src/infra/database/migrations --migrations-schema system --migrations-table migrations",
+    "migrate:down:local": "dotenv -e ../.env -- node-pg-migrate down --migrations-dir src/infra/database/migrations --migrations-schema system --migrations-table migrations"
+  },
+  "keywords": [
+    "backend-as-a-service",
+    "postgresql",
+    "jwt"
+  ],
+  "dependencies": {
+    "@asteasolutions/zod-to-openapi": "^7.3.4",
+    "@aws-sdk/client-cloudwatch-logs": "^3.713.0",
+    "@aws-sdk/client-s3": "^3.713.0",
+    "@aws-sdk/cloudfront-signer": "^3.901.0",
+    "@aws-sdk/s3-presigned-post": "^3.879.0",
+    "@aws-sdk/s3-request-presigner": "^3.879.0",
+    "@databases/split-sql-query": "^1.0.4",
+    "@databases/sql": "^3.3.0",
+    "@types/multer": "^1.4.13",
+    "@types/pg": "^8.15.4",
+    "adm-zip": "^0.5.16",
+    "axios": "^1.11.0",
+    "bcryptjs": "^3.0.2",
+    "cookie-parser": "^1.4.7",
+    "cors": "^2.8.5",
+    "csv-parse": "^6.1.0",
+    "dotenv": "^16.4.5",
+    "express": "^4.19.2",
+    "express-rate-limit": "^7.1.5",
+    "google-auth-library": "^10.1.0",
+    "jose": "^6.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "libpg-query": "^17.6.0",
+    "multer": "^2.0.2",
+    "node-fetch": "^3.3.2",
+    "node-pg-migrate": "^8.0.3",
+    "openai": "^5.19.1",
+    "pg": "^8.16.3",
+    "pg-format": "^1.0.4",
+    "socket.io": "^4.8.1",
+    "winston": "^3.17.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/adm-zip": "^0.5.7",
+    "@types/cookie-parser": "^1.4.8",
+    "@types/cors": "^2.8.17",
+    "@types/express": "^4.17.21",
+    "@types/jsonwebtoken": "^9.0.9",
+    "@types/node": "^20.11.24",
+    "@types/pg-format": "^1.0.5",
+    "dotenv-cli": "^10.0.0",
+    "tsup": "^8.5.0",
+    "tsx": "^4.7.1",
+    "typescript": "^5.3.3",
+    "vite-tsconfig-paths": "^5.1.4",
+    "vitest": "^3.2.4"
+  }
+}

package/backend/src/api/middlewares/rate-limiters.ts

@@ -1,127 +1,127 @@
-import rateLimit from 'express-rate-limit';
-import { Request, Response, NextFunction } from 'express';
-import { AppError } from './error.js';
-import { ERROR_CODES } from '@/types/error-constants.js';
-
-/**
- * Store for tracking per-email cooldowns
- * Maps email -> last request timestamp
- */
-const emailCooldowns = new Map<string, number>();
-
-/**
- * Cleanup old cooldown entries every 5 minutes
- */
-setInterval(
-  () => {
-    const now = Date.now();
-    const fiveMinutes = 5 * 60 * 1000;
-
-    for (const [email, timestamp] of emailCooldowns.entries()) {
-      if (now - timestamp > fiveMinutes) {
-        emailCooldowns.delete(email);
-      }
-    }
-  },
-  5 * 60 * 1000
-);
-
-/**
- * Per-IP rate limiter for email otp requests
- * Prevents brute-force attacks, resource exhaustion, and enumeration from single IP
- *
- * Limits: 5 requests per 15 minutes per IP
- * Counts ALL requests (both successful and failed) to prevent abuse
- */
-export const sendEmailOTPRateLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 5, // Limit each IP to 5 requests per windowMs
-  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
-  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
-  handler: (_req: Request, _res: Response, next: NextFunction) => {
-    next(
-      new AppError(
-        'Too many send email verification requests from this IP. Please try again in 15 minutes.',
-        429,
-        ERROR_CODES.TOO_MANY_REQUESTS
-      )
-    );
-  },
-  // Count all requests (both successes and failures) to prevent resource exhaustion and enumeration
-  skipSuccessfulRequests: false,
-  skipFailedRequests: false,
-});
-
-/**
- * Per-IP rate limiter for email OTP verification attempts
- * Prevents brute-force code guessing
- *
- * Limits: 10 attempts per 15 minutes per IP
- */
-export const verifyOTPRateLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 10, // Limit each IP to 10 verification attempts per windowMs
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req: Request, _res: Response, next: NextFunction) => {
-    next(
-      new AppError(
-        'Too many verification attempts from this IP. Please try again in 15 minutes.',
-        429,
-        ERROR_CODES.TOO_MANY_REQUESTS
-      )
-    );
-  },
-  skipSuccessfulRequests: true, // Don't count successful verifications
-  skipFailedRequests: false, // Count failed attempts to prevent brute force
-});
-
-/**
- * Per-email cooldown middleware
- * Prevents enumeration attacks by enforcing minimum time between requests for same email
- *
- * Cooldown: 60 seconds between requests for same email
- */
-export const perEmailCooldown = (cooldownMs: number = 60000) => {
-  return (req: Request, _res: Response, next: NextFunction) => {
-    const email = req.body?.email?.toLowerCase();
-
-    if (!email) {
-      // If no email in body, let it pass (will be caught by validation)
-      return next();
-    }
-
-    const now = Date.now();
-    const lastRequest = emailCooldowns.get(email);
-
-    if (lastRequest && now - lastRequest < cooldownMs) {
-      const remainingMs = cooldownMs - (now - lastRequest);
-      const remainingSec = Math.ceil(remainingMs / 1000);
-
-      throw new AppError(
-        `Please wait ${remainingSec} seconds before requesting another code for this email`,
-        429,
-        ERROR_CODES.TOO_MANY_REQUESTS
-      );
-    }
-
-    // Update last request time
-    emailCooldowns.set(email, now);
-    next();
-  };
-};
-
-/**
- * Combined rate limiter for sending email otp requests
- * Applies both per-IP and per-email limits
- */
-export const sendEmailOTPLimiter = [
-  sendEmailOTPRateLimiter,
-  perEmailCooldown(60000), // 60 second cooldown per email
-];
-
-/**
- * Rate limiter for OTP verification attempts (email OTP verification)
- * Only per-IP limit, no per-email limit (to allow legitimate retries)
- */
-export const verifyOTPLimiter = [verifyOTPRateLimiter];
+import rateLimit from 'express-rate-limit';
+import { Request, Response, NextFunction } from 'express';
+import { AppError } from './error.js';
+import { ERROR_CODES } from '@/types/error-constants.js';
+
+/**
+ * Store for tracking per-email cooldowns
+ * Maps email -> last request timestamp
+ */
+const emailCooldowns = new Map<string, number>();
+
+/**
+ * Cleanup old cooldown entries every 5 minutes
+ */
+setInterval(
+  () => {
+    const now = Date.now();
+    const fiveMinutes = 5 * 60 * 1000;
+
+    for (const [email, timestamp] of emailCooldowns.entries()) {
+      if (now - timestamp > fiveMinutes) {
+        emailCooldowns.delete(email);
+      }
+    }
+  },
+  5 * 60 * 1000
+);
+
+/**
+ * Per-IP rate limiter for email otp requests
+ * Prevents brute-force attacks, resource exhaustion, and enumeration from single IP
+ *
+ * Limits: 5 requests per 15 minutes per IP
+ * Counts ALL requests (both successful and failed) to prevent abuse
+ */
+export const sendEmailOTPRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 5, // Limit each IP to 5 requests per windowMs
+  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
+  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
+  handler: (_req: Request, _res: Response, next: NextFunction) => {
+    next(
+      new AppError(
+        'Too many send email verification requests from this IP. Please try again in 15 minutes.',
+        429,
+        ERROR_CODES.TOO_MANY_REQUESTS
+      )
+    );
+  },
+  // Count all requests (both successes and failures) to prevent resource exhaustion and enumeration
+  skipSuccessfulRequests: false,
+  skipFailedRequests: false,
+});
+
+/**
+ * Per-IP rate limiter for email OTP verification attempts
+ * Prevents brute-force code guessing
+ *
+ * Limits: 10 attempts per 15 minutes per IP
+ */
+export const verifyOTPRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10, // Limit each IP to 10 verification attempts per windowMs
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (_req: Request, _res: Response, next: NextFunction) => {
+    next(
+      new AppError(
+        'Too many verification attempts from this IP. Please try again in 15 minutes.',
+        429,
+        ERROR_CODES.TOO_MANY_REQUESTS
+      )
+    );
+  },
+  skipSuccessfulRequests: true, // Don't count successful verifications
+  skipFailedRequests: false, // Count failed attempts to prevent brute force
+});
+
+/**
+ * Per-email cooldown middleware
+ * Prevents enumeration attacks by enforcing minimum time between requests for same email
+ *
+ * Cooldown: 60 seconds between requests for same email
+ */
+export const perEmailCooldown = (cooldownMs: number = 60000) => {
+  return (req: Request, _res: Response, next: NextFunction) => {
+    const email = req.body?.email?.toLowerCase();
+
+    if (!email) {
+      // If no email in body, let it pass (will be caught by validation)
+      return next();
+    }
+
+    const now = Date.now();
+    const lastRequest = emailCooldowns.get(email);
+
+    if (lastRequest && now - lastRequest < cooldownMs) {
+      const remainingMs = cooldownMs - (now - lastRequest);
+      const remainingSec = Math.ceil(remainingMs / 1000);
+
+      throw new AppError(
+        `Please wait ${remainingSec} seconds before requesting another code for this email`,
+        429,
+        ERROR_CODES.TOO_MANY_REQUESTS
+      );
+    }
+
+    // Update last request time
+    emailCooldowns.set(email, now);
+    next();
+  };
+};
+
+/**
+ * Combined rate limiter for sending email otp requests
+ * Applies both per-IP and per-email limits
+ */
+export const sendEmailOTPLimiter = [
+  sendEmailOTPRateLimiter,
+  perEmailCooldown(60000), // 60 second cooldown per email
+];
+
+/**
+ * Rate limiter for OTP verification attempts (email OTP verification)
+ * Only per-IP limit, no per-email limit (to allow legitimate retries)
+ */
+export const verifyOTPLimiter = [verifyOTPRateLimiter];