notifkit 0.1.7 → 0.1.9

package/drizzle/0005_admin_users.sql

@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS "admin_users" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"email" varchar NOT NULL,
+	"username" varchar,
+	"password_hash" varchar NOT NULL,
+	"role" varchar DEFAULT 'admin' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "admin_users_email_unique" UNIQUE("email"),
+	CONSTRAINT "admin_users_username_unique" UNIQUE("username")
+);

package/drizzle/meta/_journal.json

@@ -36,6 +36,13 @@
       "when": 1788780502388,
       "tag": "0004_pretty_bruce_banner",
       "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1788781000000,
+      "tag": "0005_admin_users",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "notifkit",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Self-hosted notification infrastructure. One call delivers to email, SMS, push, and webhook — routed by preference, quiet hours, and consent.",
   "license": "MIT",
   "author": "devkitshq",
@@ -48,23 +48,28 @@
     "dist",
     "src",
     "drizzle",
+    "dashboard/dist",
     "scripts/create-project.mjs",
+    "scripts/create-admin.mjs",
     "README.md",
     "LICENSE"
   ],
   "bin": {
-    "notifkit-create-project": "./scripts/create-project.mjs"
+    "notifkit-create-project": "./scripts/create-project.mjs",
+    "notifkit-create-admin": "./scripts/create-admin.mjs"
   },
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
     "create-project": "node scripts/create-project.mjs",
+    "create-admin": "node scripts/create-admin.mjs",
+    "build:dashboard": "npm --prefix dashboard run build",
     "test": "vitest run --coverage",
     "test:watch": "vitest",
     "lint": "eslint . --fix",
     "typecheck": "tsc --noEmit",
     "prepare": "husky",
-    "prepublishOnly": "npm run typecheck && npm run build"
+    "prepublishOnly": "npm run typecheck && npm run build && npm run build:dashboard"
   },
   "dependencies": {
     "ai": "^7.0.37",

package/scripts/create-admin.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+/**
+ * Create or update an admin user for the Notifkit Dashboard.
+ *
+ * Usage:
+ *   ADMIN_EMAIL=admin@example.com ADMIN_PASSWORD=secret node scripts/create-admin.mjs
+ *   node scripts/create-admin.mjs admin@example.com secret [username] [role]
+ */
+
+import { config } from "dotenv";
+import { resolve } from "node:path";
+import postgres from "postgres";
+import { scrypt, randomBytes } from "node:crypto";
+import { promisify } from "node:util";
+
+config({ path: resolve(process.cwd(), ".env") });
+
+const scryptAsync = promisify(scrypt);
+
+async function hashPassword(password) {
+  const salt = randomBytes(16).toString("hex");
+  const derivedKey = await scryptAsync(password, salt, 64);
+  return `${salt}:${derivedKey.toString("hex")}`;
+}
+
+const email = process.argv[2] || process.env.ADMIN_EMAIL;
+const password = process.argv[3] || process.env.ADMIN_PASSWORD;
+const username = process.argv[4] || process.env.ADMIN_USERNAME || null;
+const role = process.argv[5] || "admin";
+
+if (!email || !password) {
+  console.error("Usage: node scripts/create-admin.mjs <email> <password> [username] [role]");
+  console.error("Or set ADMIN_EMAIL and ADMIN_PASSWORD in environment.");
+  process.exit(1);
+}
+
+const databaseUrl =
+  process.env.DATABASE_URL || "postgres://platform:platform@localhost:5432/notifkit";
+const sql = postgres(databaseUrl);
+
+try {
+  const passwordHash = await hashPassword(password);
+  const normalizedEmail = email.trim().toLowerCase();
+  const normalizedUsername = username ? username.trim() : null;
+
+  const rows = await sql`
+    INSERT INTO admin_users (email, username, password_hash, role)
+    VALUES (${normalizedEmail}, ${normalizedUsername}, ${passwordHash}, ${role})
+    ON CONFLICT (email) DO UPDATE
+    SET password_hash = EXCLUDED.password_hash,
+        username = COALESCE(EXCLUDED.username, admin_users.username),
+        role = EXCLUDED.role,
+        updated_at = NOW()
+    RETURNING id, email, username, role, created_at, updated_at
+  `;
+
+  console.log("\nAdmin user successfully saved:\n");
+  console.log(`  ID:       ${rows[0].id}`);
+  console.log(`  Email:    ${rows[0].email}`);
+  console.log(`  Username: ${rows[0].username || "(none)"}`);
+  console.log(`  Role:     ${rows[0].role}\n`);
+} catch (err) {
+  console.error(`Failed to create admin: ${err.message}`);
+  process.exit(1);
+} finally {
+  await sql.end();
+}

package/src/config/index.ts

@@ -43,6 +43,9 @@ export const baseConfigSchema = z.object({
   // Windows puts a trailing space in the variable, which otherwise turns every
   // admin request into a 401 that reads like a wrong key.
   ADMIN_API_KEY: z.string().trim().optional(),
+  ADMIN_EMAIL: z.string().trim().email().optional(),
+  ADMIN_PASSWORD: z.string().trim().min(6).optional(),
+  ADMIN_USERNAME: z.string().trim().optional(),
   WORKER_CONCURRENCY: z.coerce.number().int().min(1).default(10),
   QUEUE_MAX_LEN: z.coerce.number().int().min(1).default(10000000),
   DB_MAX_CONNECTIONS: z.coerce.number().int().min(1).default(2),
@@ -62,6 +65,15 @@ export const baseConfigSchema = z.object({
    * instead, which costs far more than the key ever protected.
    */
   UNSUBSCRIBE_SECRET: z.string().min(16).optional(),
+  /**
+   * When true, trusts X-Forwarded-For headers from reverse proxies for client IP resolution.
+   * Defaults to false to prevent client-spoofed headers from bypassing rate limits.
+   */
+  TRUST_PROXY: z.coerce.boolean().default(false),
+  /**
+   * Comma-separated list of allowed origins for CORS on session-authenticated admin routes.
+   */
+  CORS_ORIGIN: z.string().optional(),
 });
 
 export type BaseConfig = z.infer<typeof baseConfigSchema>;

package/src/db/schema.ts

@@ -367,8 +367,21 @@ export const scheduledPayloads = pgTable("scheduled_payloads", {
   createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
 });
 
+export const adminUsers = pgTable("admin_users", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: varchar("email").notNull().unique(),
+  username: varchar("username").unique(),
+  passwordHash: varchar("password_hash").notNull(),
+  role: varchar("role").notNull().default("admin"),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull(),
+});
+
 // ─── Generated Zod Schemas ──────────────────────────────────────────────────
 
+export const insertAdminUserSchema = createInsertSchema(adminUsers);
+export const selectAdminUserSchema = createSelectSchema(adminUsers);
+
 export const insertProjectSchema = createInsertSchema(projects);
 export const selectProjectSchema = createSelectSchema(projects);
 

package/src/repositories/index.ts

@@ -1,4 +1,4 @@
-import { eq, and, sql as drizzleSql, inArray, desc } from "drizzle-orm";
+import { eq, and, or, sql as drizzleSql, inArray, desc } from "drizzle-orm";
 import type { Db } from "@/index.js";
 import type { Preferences, ContactChannel } from "@/contracts/index.js";
 import {
@@ -18,6 +18,7 @@ import {
   projectApiKeys,
   suppressions,
   messageLogs,
+  adminUsers,
 } from "@/db/schema.js";
 
 // ─── Domain types ───────────────────────────────────────────────────────────
@@ -1244,3 +1245,83 @@ export class SegmentRepository {
     return (rows as any[]).map((r) => r.segment);
   }
 }
+
+// ─── AdminUserRepository ───────────────────────────────────────────────────
+
+export interface AdminUserRecord {
+  id: string;
+  email: string;
+  username: string | null;
+  passwordHash: string;
+  role: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export class AdminUserRepository {
+  constructor(private readonly db: Db) {}
+
+  async findByEmailOrUsername(identifier: string): Promise<AdminUserRecord | null> {
+    const normalized = identifier.trim().toLowerCase();
+    const rows = await this.db
+      .select()
+      .from(adminUsers)
+      .where(or(eq(adminUsers.email, normalized), eq(adminUsers.username, identifier.trim())))
+      .limit(1);
+    return (rows[0] as AdminUserRecord) ?? null;
+  }
+
+  async findById(id: string): Promise<AdminUserRecord | null> {
+    const rows = await this.db.select().from(adminUsers).where(eq(adminUsers.id, id)).limit(1);
+    return (rows[0] as AdminUserRecord) ?? null;
+  }
+
+  async create(data: {
+    email: string;
+    username?: string | null;
+    passwordHash: string;
+    role?: string;
+  }): Promise<AdminUserRecord> {
+    const rows = await this.db
+      .insert(adminUsers)
+      .values({
+        email: data.email.trim().toLowerCase(),
+        username: data.username ? data.username.trim() : null,
+        passwordHash: data.passwordHash,
+        role: data.role || "admin",
+      })
+      .returning();
+    return rows[0] as AdminUserRecord;
+  }
+
+  async updatePassword(id: string, passwordHash: string): Promise<boolean> {
+    const rows = await this.db
+      .update(adminUsers)
+      .set({ passwordHash, updatedAt: new Date() })
+      .where(eq(adminUsers.id, id))
+      .returning();
+    return rows.length > 0;
+  }
+
+  async list(): Promise<Omit<AdminUserRecord, "passwordHash">[]> {
+    const rows = await this.db
+      .select({
+        id: adminUsers.id,
+        email: adminUsers.email,
+        username: adminUsers.username,
+        role: adminUsers.role,
+        createdAt: adminUsers.createdAt,
+        updatedAt: adminUsers.updatedAt,
+      })
+      .from(adminUsers)
+      .orderBy(adminUsers.createdAt);
+    return rows as Omit<AdminUserRecord, "passwordHash">[];
+  }
+
+  async count(): Promise<number> {
+    const rows = await this.db
+      .select({ count: drizzleSql<number>`count(*)::int` })
+      .from(adminUsers);
+    return rows[0]?.count ?? 0;
+  }
+}

package/src/services/api/admin-static.ts

@@ -0,0 +1,225 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { resolve, extname, join, relative, isAbsolute } from "node:path";
+import { existsSync, statSync, createReadStream } from "node:fs";
+import { request as httpRequest } from "node:http";
+
+const MIME_TYPES: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".webp": "image/webp",
+  ".txt": "text/plain; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+};
+
+// Possible output directories where built dashboard static files might reside
+const POSSIBLE_DASHBOARD_DIRS = [
+  resolve(process.cwd(), "dashboard", "dist"),
+  resolve(process.cwd(), "dashboard", "out"),
+  resolve(process.cwd(), "dist", "admin"),
+  resolve(process.cwd(), "dist", "dashboard"),
+];
+
+function getDashboardDir(): string | null {
+  for (const dir of POSSIBLE_DASHBOARD_DIRS) {
+    if (existsSync(dir) && existsSync(join(dir, "index.html"))) {
+      return dir;
+    }
+  }
+  return null;
+}
+
+/**
+ * Proxies request to frontend dev server if running.
+ */
+function proxyToDevServer(
+  req: IncomingMessage,
+  res: ServerResponse,
+  targetHost: string,
+  targetPort: number,
+): Promise<boolean> {
+  return new Promise((resolvePromise) => {
+    const proxyReq = httpRequest(
+      {
+        host: targetHost,
+        port: targetPort,
+        path: req.url,
+        method: req.method,
+        headers: req.headers,
+      },
+      (proxyRes) => {
+        res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+        proxyRes.pipe(res);
+        resolvePromise(true);
+      },
+    );
+
+    proxyReq.on("error", () => {
+      resolvePromise(false);
+    });
+
+    if (req.readable) {
+      req.pipe(proxyReq);
+    } else {
+      proxyReq.end();
+    }
+  });
+}
+
+/**
+ * Handles incoming HTTP requests for `/admin` and `/admin/*`.
+ * Serves static exported assets from Vite SPA build with index.html fallback,
+ * or proxies to Vite dev server if running in development mode.
+ */
+export async function handleAdminRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  url: URL,
+): Promise<boolean> {
+  if (url.pathname !== "/admin" && !url.pathname.startsWith("/admin/")) {
+    return false;
+  }
+
+  // Redirect /admin to /admin/
+  if (url.pathname === "/admin") {
+    res.writeHead(301, { Location: "/admin/" + (url.search || "") });
+    res.end();
+    return true;
+  }
+
+  // In development, attempt to proxy to local Vite dev server on port 5173 (or VITE_DEV_URL) if active
+  if (process.env.NODE_ENV !== "production") {
+    const devProxyUrl =
+      process.env.VITE_DEV_URL || process.env.ADMIN_DEV_URL || process.env.NEXT_DEV_URL;
+    const targetPort = devProxyUrl ? parseInt(new URL(devProxyUrl).port, 10) : 5173;
+    const targetHost = devProxyUrl ? new URL(devProxyUrl).hostname : "127.0.0.1";
+
+    const proxied = await proxyToDevServer(req, res, targetHost, targetPort);
+    if (proxied) {
+      return true;
+    }
+  }
+
+  const dashboardDir = getDashboardDir();
+  if (!dashboardDir) {
+    // If dashboard build not found, return friendly message
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(`
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+        <meta charset="utf-8">
+        <title>Notifkit Admin Dashboard</title>
+        <style>
+          body { font-family: system-ui, -apple-system, sans-serif; background: #09090b; color: #f4f4f5; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; }
+          .card { background: #18181b; border: 1px solid #27272a; padding: 2rem; border-radius: 0.75rem; max-width: 500px; text-align: center; }
+          h1 { margin-top: 0; color: #fafafa; }
+          code { background: #27272a; padding: 0.2rem 0.4rem; border-radius: 0.25rem; font-family: monospace; font-size: 0.9em; }
+        </style>
+      </head>
+      <body>
+        <div class="card">
+          <h1>Notifkit Admin Dashboard</h1>
+          <p>The dashboard static bundle has not been built yet.</p>
+          <p>Please build it by running:</p>
+          <p><code>npm run build:dashboard</code></p>
+          <p>or run the dev server with <code>npm --prefix dashboard run dev</code>.</p>
+        </div>
+      </body>
+      </html>
+    `);
+    return true;
+  }
+
+  // Strip /admin prefix to find relative path inside dashboardDir
+  let subPath = url.pathname.slice("/admin".length);
+  if (subPath.startsWith("/")) {
+    subPath = subPath.slice(1);
+  }
+  if (!subPath) {
+    subPath = "index.html";
+  }
+
+  const normalizedSubPath = subPath.replace(/\/$/, "");
+  let filePath = resolve(dashboardDir, subPath);
+
+  // Security check: ensure filePath is inside dashboardDir
+  const rel = relative(dashboardDir, filePath);
+  if (rel.startsWith("..") || isAbsolute(rel)) {
+    res.writeHead(403, { "Content-Type": "text/plain" });
+    res.end("Forbidden");
+    return true;
+  }
+
+  // Check direct file
+  let stat: ReturnType<typeof statSync> | null = null;
+  if (existsSync(filePath)) {
+    stat = statSync(filePath);
+    if (stat.isDirectory()) {
+      filePath = join(filePath, "index.html");
+      stat = existsSync(filePath) ? statSync(filePath) : null;
+    }
+  }
+
+  // Check path.html if direct file not found
+  if (!stat) {
+    const htmlPath = resolve(dashboardDir, `${normalizedSubPath}.html`);
+    if (existsSync(htmlPath)) {
+      filePath = htmlPath;
+      stat = statSync(filePath);
+    }
+  }
+
+  // Check path/index.html
+  if (!stat) {
+    const dirIndexPath = resolve(dashboardDir, normalizedSubPath, "index.html");
+    if (existsSync(dirIndexPath)) {
+      filePath = dirIndexPath;
+      stat = statSync(filePath);
+    }
+  }
+
+  // Fallback to index.html for SPA client-side routing
+  if (!stat) {
+    filePath = resolve(dashboardDir, "index.html");
+    if (existsSync(filePath)) {
+      stat = statSync(filePath);
+    }
+  }
+
+  if (!stat) {
+    res.writeHead(404, { "Content-Type": "text/plain" });
+    res.end("Not Found");
+    return true;
+  }
+
+  const ext = extname(filePath).toLowerCase();
+  const contentType = MIME_TYPES[ext] || "application/octet-stream";
+
+  // Cache static assets (_next/static) aggressively (immutable, 1 year), HTML files no-cache
+  const isImmutable = filePath.includes("_next") || ext === ".js" || ext === ".css";
+  const cacheControl = isImmutable
+    ? "public, max-age=31536000, immutable"
+    : "public, max-age=0, must-revalidate";
+
+  res.writeHead(200, {
+    "Content-Type": contentType,
+    "Content-Length": stat.size,
+    "Cache-Control": cacheControl,
+  });
+
+  const stream = createReadStream(filePath);
+  stream.pipe(res);
+  return true;
+}