notifkit 0.1.7 → 0.1.9

package/dist/{src-CPMwsUCJ.mjs → src-CGmXRfsM.mjs}

@@ -7,7 +7,7 @@ import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import postgres from "postgres";
 import { drizzle } from "drizzle-orm/postgres-js";
 import { boolean, check, index, integer, jsonb, pgEnum, pgTable, primaryKey, text, time, timestamp, unique, uuid, varchar } from "drizzle-orm/pg-core";
-import { and, desc, eq, inArray, sql } from "drizzle-orm";
+import { and, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { createInsertSchema, createSelectSchema } from "drizzle-zod";
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 import { fileURLToPath } from "url";
@@ -69,6 +69,9 @@ const baseConfigSchema = z.object({
 	REDIS_URL: z.string().url().default("redis://localhost:6379"),
 	DATABASE_URL: z.string().url().default("postgres://platform:platform@localhost:5432/notifkit"),
 	ADMIN_API_KEY: z.string().trim().optional(),
+	ADMIN_EMAIL: z.string().trim().email().optional(),
+	ADMIN_PASSWORD: z.string().trim().min(6).optional(),
+	ADMIN_USERNAME: z.string().trim().optional(),
 	WORKER_CONCURRENCY: z.coerce.number().int().min(1).default(10),
 	QUEUE_MAX_LEN: z.coerce.number().int().min(1).default(1e7),
 	DB_MAX_CONNECTIONS: z.coerce.number().int().min(1).default(2),
@@ -87,7 +90,16 @@ const baseConfigSchema = z.object({
 	* permanent: a dead link means the recipient reaches for the spam button
 	* instead, which costs far more than the key ever protected.
 	*/
-	UNSUBSCRIBE_SECRET: z.string().min(16).optional()
+	UNSUBSCRIBE_SECRET: z.string().min(16).optional(),
+	/**
+	* When true, trusts X-Forwarded-For headers from reverse proxies for client IP resolution.
+	* Defaults to false to prevent client-spoofed headers from bypassing rate limits.
+	*/
+	TRUST_PROXY: z.coerce.boolean().default(false),
+	/**
+	* Comma-separated list of allowed origins for CORS on session-authenticated admin routes.
+	*/
+	CORS_ORIGIN: z.string().optional()
 });
 let globalConfig = null;
 function setGlobalConfig(config) {
@@ -673,10 +685,12 @@ registry.define("notification.ai_pending", NotificationAiPendingPayloadSchema);
 //#endregion
 //#region src/db/schema.ts
 var schema_exports = /* @__PURE__ */ __exportAll({
+	adminUsers: () => adminUsers,
 	apiKeyRoleEnum: () => apiKeyRoleEnum,
 	channelEnum: () => channelEnum,
 	contactTopicPreferences: () => contactTopicPreferences,
 	deliveryOutbox: () => deliveryOutbox,
+	insertAdminUserSchema: () => insertAdminUserSchema,
 	insertDeliveryOutboxSchema: () => insertDeliveryOutboxSchema,
 	insertMessageLogSchema: () => insertMessageLogSchema,
 	insertProjectApiKeySchema: () => insertProjectApiKeySchema,
@@ -696,6 +710,7 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	projects: () => projects,
 	quietHours: () => quietHours,
 	scheduledPayloads: () => scheduledPayloads,
+	selectAdminUserSchema: () => selectAdminUserSchema,
 	selectDeliveryOutboxSchema: () => selectDeliveryOutboxSchema,
 	selectMessageLogSchema: () => selectMessageLogSchema,
 	selectProjectApiKeySchema: () => selectProjectApiKeySchema,
@@ -941,6 +956,17 @@ const scheduledPayloads = pgTable("scheduled_payloads", {
 	payload: jsonb("payload").notNull(),
 	createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull()
 });
+const adminUsers = pgTable("admin_users", {
+	id: uuid("id").primaryKey().defaultRandom(),
+	email: varchar("email").notNull().unique(),
+	username: varchar("username").unique(),
+	passwordHash: varchar("password_hash").notNull(),
+	role: varchar("role").notNull().default("admin"),
+	createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull()
+});
+const insertAdminUserSchema = createInsertSchema(adminUsers);
+const selectAdminUserSchema = createSelectSchema(adminUsers);
 const insertProjectSchema = createInsertSchema(projects);
 const selectProjectSchema = createSelectSchema(projects);
 const insertProjectApiKeySchema = createInsertSchema(projectApiKeys);
@@ -2567,6 +2593,46 @@ var SegmentRepository = class {
     `)).map((r) => r.segment);
 	}
 };
+var AdminUserRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async findByEmailOrUsername(identifier) {
+		const normalized = identifier.trim().toLowerCase();
+		return (await this.db.select().from(adminUsers).where(or(eq(adminUsers.email, normalized), eq(adminUsers.username, identifier.trim()))).limit(1))[0] ?? null;
+	}
+	async findById(id) {
+		return (await this.db.select().from(adminUsers).where(eq(adminUsers.id, id)).limit(1))[0] ?? null;
+	}
+	async create(data) {
+		return (await this.db.insert(adminUsers).values({
+			email: data.email.trim().toLowerCase(),
+			username: data.username ? data.username.trim() : null,
+			passwordHash: data.passwordHash,
+			role: data.role || "admin"
+		}).returning())[0];
+	}
+	async updatePassword(id, passwordHash) {
+		return (await this.db.update(adminUsers).set({
+			passwordHash,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(adminUsers.id, id)).returning()).length > 0;
+	}
+	async list() {
+		return await this.db.select({
+			id: adminUsers.id,
+			email: adminUsers.email,
+			username: adminUsers.username,
+			role: adminUsers.role,
+			createdAt: adminUsers.createdAt,
+			updatedAt: adminUsers.updatedAt
+		}).from(adminUsers).orderBy(adminUsers.createdAt);
+	}
+	async count() {
+		return (await this.db.select({ count: sql`count(*)::int` }).from(adminUsers))[0]?.count ?? 0;
+	}
+};
 //#endregion
 //#region src/templates/render.ts
 function escapeHtml(unsafe) {
@@ -3402,35 +3468,35 @@ var NotifkitServer = class extends EventEmitter {
 		}
 		const startupPromises = [];
 		if (services.includes("api")) {
-			const { startApiServer } = await import("./main-CFSukWm8.mjs");
+			const { startApiServer } = await import("./main-JdOvJ70b.mjs");
 			startupPromises.push(startApiServer());
 		}
 		if (services.includes("delivery")) {
-			const { startDeliveryWorker } = await import("./main-pFAfCkVX.mjs");
+			const { startDeliveryWorker } = await import("./main-CyeQ_yDt.mjs");
 			startupPromises.push(startDeliveryWorker());
 		}
 		if (services.includes("engine")) {
-			const { startEngineWorker } = await import("./main-Yorxzw0Z.mjs");
+			const { startEngineWorker } = await import("./main-BPbPnBIG.mjs");
 			startupPromises.push(startEngineWorker());
 		}
 		if (services.includes("enricher")) {
-			const { startEnricherWorker } = await import("./main-Bgi2wWck.mjs");
+			const { startEnricherWorker } = await import("./main-AO0JaY5z.mjs");
 			startupPromises.push(startEnricherWorker());
 		}
 		if (services.includes("scheduler")) {
-			const { startSchedulerWorker } = await import("./main-DFMHcN_d.mjs");
+			const { startSchedulerWorker } = await import("./main-BMYSYcv2.mjs");
 			startupPromises.push(startSchedulerWorker());
 		}
 		if (services.includes("ai")) {
-			const { startAiWorker } = await import("./main-D6SG3Isk.mjs");
+			const { startAiWorker } = await import("./main-DSmh1e-V.mjs");
 			startupPromises.push(startAiWorker());
 		}
 		if (services.includes("workflow")) {
-			const { startWorkflowWorker } = await import("./main-CjbVdUqa.mjs");
+			const { startWorkflowWorker } = await import("./main-D19Wxs0x.mjs");
 			startupPromises.push(startWorkflowWorker());
 		}
 		if (services.includes("events")) {
-			const { startEventWorker } = await import("./main-CRPxM-O3.mjs");
+			const { startEventWorker } = await import("./main-4Wyge9ms.mjs");
 			startupPromises.push(startEventWorker());
 		}
 		const handleSignal = async (signal) => {
@@ -3470,35 +3536,35 @@ var NotifkitServer = class extends EventEmitter {
 			"events"
 		] : this.options.services;
 		if (services.includes("api")) {
-			const { stopApiServer } = await import("./main-CFSukWm8.mjs");
+			const { stopApiServer } = await import("./main-JdOvJ70b.mjs");
 			await stopApiServer();
 		}
 		if (services.includes("delivery")) {
-			const { stopDeliveryWorker } = await import("./main-pFAfCkVX.mjs");
+			const { stopDeliveryWorker } = await import("./main-CyeQ_yDt.mjs");
 			await stopDeliveryWorker();
 		}
 		if (services.includes("engine")) {
-			const { stopEngineWorker } = await import("./main-Yorxzw0Z.mjs");
+			const { stopEngineWorker } = await import("./main-BPbPnBIG.mjs");
 			await stopEngineWorker();
 		}
 		if (services.includes("enricher")) {
-			const { stopEnricherWorker } = await import("./main-Bgi2wWck.mjs");
+			const { stopEnricherWorker } = await import("./main-AO0JaY5z.mjs");
 			await stopEnricherWorker();
 		}
 		if (services.includes("scheduler")) {
-			const { stopSchedulerWorker } = await import("./main-DFMHcN_d.mjs");
+			const { stopSchedulerWorker } = await import("./main-BMYSYcv2.mjs");
 			await stopSchedulerWorker();
 		}
 		if (services.includes("ai")) {
-			const { stopAiWorker } = await import("./main-D6SG3Isk.mjs");
+			const { stopAiWorker } = await import("./main-DSmh1e-V.mjs");
 			await stopAiWorker();
 		}
 		if (services.includes("workflow")) {
-			const { stopWorkflowWorker } = await import("./main-CjbVdUqa.mjs");
+			const { stopWorkflowWorker } = await import("./main-D19Wxs0x.mjs");
 			await stopWorkflowWorker();
 		}
 		if (services.includes("events")) {
-			const { stopEventWorker } = await import("./main-CRPxM-O3.mjs");
+			const { stopEventWorker } = await import("./main-4Wyge9ms.mjs");
 			await stopEventWorker();
 		}
 		if (this.pgContainer) {
@@ -3512,6 +3578,6 @@ var NotifkitServer = class extends EventEmitter {
 	}
 };
 //#endregion
-export { childLogger as $, INBOUND_STREAMS as $t, ProjectSettingsCache as A, NotificationRequestedPayloadSchema as At, LUA_RELEASE_LOCK as B, PreferencesSchema as Bt, ProjectRepository as C, DeliveryOptionsSchema as Ct, WorkflowRepository as D, NotificationEnrichedPayloadSchema as Dt, UserRepository as E, NotificationScheduledPayloadSchema as Et, sleep as F, ContactChannelSchema as Ft, normaliseTarget as G, UpdateProjectSchema as Gt, LUA_SCHEDULER_CLAIM as H, SyncTemplatesSchema as Ht, DataLoader as I, CreateWorkflowSchema as It, PendingMessageScanner as J, WorkflowNotifyPayloadSchema as Jt, LRUCache as K, UpdateUserSchema as Kt, CircuitBreaker as L, IngestEventSchema as Lt, AppError as M, AddContactSchema as Mt, ValidationError as N, AddUserSchema as Nt, Redis as O, RecipientProfileSchema as Ot, generateId as P, BatchAddContactsSchema as Pt, metrics as Q, ENRICHED_STREAMS as Qt, BatchProcessor as R, InlineUserSchema as Rt, PreferenceRepository as S, NotificationDeliveredPayloadSchema as St, TemplateRepository as T, RenderedContentSchema as Tt, LUA_SCHEDULER_POLL as U, TemplateSchema as Ut, LUA_RENEW_LOCK as V, QuietHoursSchema as Vt, getPriorityBucket as W, TriggerWorkflowSchema as Wt, StreamProducer as X, buildStreamEvent as Xt, StreamConsumer as Y, WorkflowStepSchema as Yt, getMetricsRegistry as Z, CONSUMER_GROUPS as Zt, escapeHeader as _, readBaseConfig as _n, workflowWaiters as _t, SuspendExecutionError as a, StreamEventSchema as an, runMigrations as at, renderWithTemplate as b, NotificationSkippedPayloadSchema as bt, BaseWorker as c, EventMetadataSchema as cn, projectApiKeys as ct, buildUnsubscribeHeaders as d, NotificationStatusSchema as dn, suppressions as dt, OUTBOUND_STREAMS as en, createLogger as et, signUnsubscribeToken as f, AI_DEFAULTS as fn, userTopicPreferences as ft, TemplateCache as g, parseConfig as gn, workflowSteps as gt, templateRegistry as h, loadEnv as hn, workflowInstances as ht, workflowRegistry as i, StreamEventMetadataSchema as in, createDatabase as it, UserThrottle as j, NotificationTargetSchema as jt, RedisClient as k, NotificationCreatedPayloadSchema as kt, NonRetryableError as l, NotificationChannelSchema as ln, projects as lt, renderTemplate as m, getAiConfig as mn, workflowDefinitions as mt, NotifkitClient as n, STREAMS as nn, withRequestId as nt, buildStepNotifyPayload as o, EventRegistry as on, deliveryOutbox as ot, verifyUnsubscribeToken as p, baseConfigSchema as pn, users as pt, globalEmitter as q, UserContactInputSchema as qt, workflow as r, EventEnvelopeSchema as rn, IdempotencyGuard as rt, resolveStepTarget as s, registry as sn, messageLogs as st, NotifkitServer as t, PUBSUB_CHANNELS as tn, withContext as tt, startHealthReporter as u, NotificationPrioritySchema as un, scheduledPayloads as ut, escapeHtml as v, setAiConfig as vn, NotificationAiPendingPayloadSchema as vt, SegmentRepository as w, NotificationDispatchedPayloadSchema as wt, ContactRepository as x, NotificationFailedPayloadSchema as xt, interpolate as y, setGlobalConfig as yn, NotificationCanceledPayloadSchema as yt, AsyncSemaphore as z, NotifyRequestSchema as zt };
+export { metrics as $, ENRICHED_STREAMS as $t, RedisClient as A, NotificationCreatedPayloadSchema as At, AsyncSemaphore as B, NotifyRequestSchema as Bt, PreferenceRepository as C, NotificationDeliveredPayloadSchema as Ct, UserRepository as D, NotificationScheduledPayloadSchema as Dt, TemplateRepository as E, RenderedContentSchema as Et, generateId as F, BatchAddContactsSchema as Ft, getPriorityBucket as G, TriggerWorkflowSchema as Gt, LUA_RENEW_LOCK as H, QuietHoursSchema as Ht, sleep as I, ContactChannelSchema as It, globalEmitter as J, UserContactInputSchema as Jt, normaliseTarget as K, UpdateProjectSchema as Kt, DataLoader as L, CreateWorkflowSchema as Lt, UserThrottle as M, NotificationTargetSchema as Mt, AppError as N, AddContactSchema as Nt, WorkflowRepository as O, NotificationEnrichedPayloadSchema as Ot, ValidationError as P, AddUserSchema as Pt, getMetricsRegistry as Q, CONSUMER_GROUPS as Qt, CircuitBreaker as R, IngestEventSchema as Rt, ContactRepository as S, NotificationFailedPayloadSchema as St, SegmentRepository as T, NotificationDispatchedPayloadSchema as Tt, LUA_SCHEDULER_CLAIM as U, SyncTemplatesSchema as Ut, LUA_RELEASE_LOCK as V, PreferencesSchema as Vt, LUA_SCHEDULER_POLL as W, TemplateSchema as Wt, StreamConsumer as X, WorkflowStepSchema as Xt, PendingMessageScanner as Y, WorkflowNotifyPayloadSchema as Yt, StreamProducer as Z, buildStreamEvent as Zt, escapeHeader as _, parseConfig as _n, workflowSteps as _t, SuspendExecutionError as a, StreamEventMetadataSchema as an, createDatabase as at, renderWithTemplate as b, setGlobalConfig as bn, NotificationCanceledPayloadSchema as bt, BaseWorker as c, registry as cn, messageLogs as ct, buildUnsubscribeHeaders as d, NotificationPrioritySchema as dn, scheduledPayloads as dt, INBOUND_STREAMS as en, childLogger as et, signUnsubscribeToken as f, NotificationStatusSchema as fn, suppressions as ft, TemplateCache as g, loadEnv as gn, workflowInstances as gt, templateRegistry as h, getAiConfig as hn, workflowDefinitions as ht, workflowRegistry as i, EventEnvelopeSchema as in, IdempotencyGuard as it, ProjectSettingsCache as j, NotificationRequestedPayloadSchema as jt, Redis as k, RecipientProfileSchema as kt, NonRetryableError as l, EventMetadataSchema as ln, projectApiKeys as lt, renderTemplate as m, baseConfigSchema as mn, users as mt, NotifkitClient as n, PUBSUB_CHANNELS as nn, withContext as nt, buildStepNotifyPayload as o, StreamEventSchema as on, runMigrations as ot, verifyUnsubscribeToken as p, AI_DEFAULTS as pn, userTopicPreferences as pt, LRUCache as q, UpdateUserSchema as qt, workflow as r, STREAMS as rn, withRequestId as rt, resolveStepTarget as s, EventRegistry as sn, deliveryOutbox as st, NotifkitServer as t, OUTBOUND_STREAMS as tn, createLogger as tt, startHealthReporter as u, NotificationChannelSchema as un, projects as ut, escapeHtml as v, readBaseConfig as vn, workflowWaiters as vt, ProjectRepository as w, DeliveryOptionsSchema as wt, AdminUserRepository as x, NotificationSkippedPayloadSchema as xt, interpolate as y, setAiConfig as yn, NotificationAiPendingPayloadSchema as yt, BatchProcessor as z, InlineUserSchema as zt };
 
-//# sourceMappingURL=src-CPMwsUCJ.mjs.map
+//# sourceMappingURL=src-CGmXRfsM.mjs.map