nuxt-observe 0.0.2

package/dist/runtime/server/api/observe/overview.get.js

@@ -0,0 +1,19 @@
+import { defineEventHandler, getValidatedQuery } from "h3";
+import { overviewQuerySchema } from "../../../shared/schema/overview.js";
+import { periodToRange } from "../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../utils/authz.js";
+import { resolveEffectiveScope } from "../../utils/scope.js";
+import { getOverview, emptyOverview } from "../../utils/overview.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "stats.read");
+  const { period, service, group } = await getValidatedQuery(event, overviewQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, { service, group });
+  const { from, to, label } = periodToRange(period);
+  const scope = {
+    serviceIds: effective === "*" ? [] : effective,
+    isAll: effective === "*"
+  };
+  const data = effective !== "*" && effective.length === 0 ? emptyOverview() : await getOverview(effective, from, to);
+  return { period: { from, to, label }, scope, ...data };
+});

package/dist/runtime/server/api/observe/rollout/compare.get.d.ts

@@ -0,0 +1,3 @@
+import { type VersionCompare } from '../../../../shared/schema/rollout.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<VersionCompare>>;
+export default _default;

package/dist/runtime/server/api/observe/rollout/compare.get.js

@@ -0,0 +1,24 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import { rolloutQuerySchema } from "../../../../shared/schema/rollout.js";
+import { periodToRange } from "../../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../../utils/authz.js";
+import { resolveEffectiveScope } from "../../../utils/scope.js";
+import { getVersionSeries } from "../../../utils/rollout.js";
+import { DEFAULT_BUCKET_MS, MAX_BUCKETS } from "../../../utils/stats-query.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "stats.read");
+  const { period, service, group, env, bucketMs } = await getValidatedQuery(event, rolloutQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, { service, group });
+  const { from, to } = periodToRange(period);
+  const bucket = bucketMs ?? DEFAULT_BUCKET_MS[period];
+  if ((to - from) / bucket > MAX_BUCKETS) {
+    throw createError({ statusCode: 400, statusMessage: "bucketMs too small for window" });
+  }
+  try {
+    return await getVersionSeries(effective, from, to, bucket, { env });
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Rollout query failed" });
+  }
+});

package/dist/runtime/server/api/observe/rollout/regressions.get.d.ts

@@ -0,0 +1,3 @@
+import { type RegressionResponse } from '../../../../shared/schema/rollout.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<RegressionResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/rollout/regressions.get.js

@@ -0,0 +1,31 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { rolloutQuerySchema, detectRegressions } from "../../../../shared/schema/rollout.js";
+import { periodToRange } from "../../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../../utils/authz.js";
+import { resolveEffectiveScope } from "../../../utils/scope.js";
+import { getServiceBySlug } from "../../../utils/services.js";
+import { getVersionSummary } from "../../../utils/rollout.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "stats.read");
+  const { period, service, env } = await getValidatedQuery(event, rolloutQuerySchema.parse);
+  if (!service) {
+    throw createError({ statusCode: 400, statusMessage: "rollout/regressions requires a ?service" });
+  }
+  const allowed = await getAllowedServiceIds(event, principal);
+  await resolveEffectiveScope(event, principal, allowed, { service });
+  const svc = await getServiceBySlug(service);
+  if (!svc || svc.version_tracking === 0) {
+    return { trackingEnabled: false, findings: [] };
+  }
+  const { from, to } = periodToRange(period);
+  try {
+    const stats = await getVersionSummary([svc.id], from, to, { env });
+    const config = useRuntimeConfig(event).observe.rollout.regression;
+    const findings = detectRegressions(stats, config, Date.now());
+    return { trackingEnabled: true, findings };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Rollout query failed" });
+  }
+});

package/dist/runtime/server/api/observe/rollout/versions.get.d.ts

@@ -0,0 +1,3 @@
+import { type VersionStat } from '../../../../shared/schema/rollout.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<VersionStat[]>>;
+export default _default;

package/dist/runtime/server/api/observe/rollout/versions.get.js

@@ -0,0 +1,20 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import { rolloutQuerySchema } from "../../../../shared/schema/rollout.js";
+import { periodToRange } from "../../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../../utils/authz.js";
+import { resolveEffectiveScope } from "../../../utils/scope.js";
+import { getVersionSummary } from "../../../utils/rollout.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "stats.read");
+  const { period, service, group, env } = await getValidatedQuery(event, rolloutQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, { service, group });
+  const { from, to } = periodToRange(period);
+  try {
+    if (effective !== "*" && effective.length === 0) return [];
+    return await getVersionSummary(effective, from, to, { env });
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Rollout query failed" });
+  }
+});

package/dist/runtime/server/api/observe/services/[id]/assignments.put.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Phase 1: assignments are declared in `observe.auth.users` (config), and the config
+ * auth provider never reads user_service_roles, so a runtime write here would silently
+ * no-op until CP16 ships the DB provider. We refuse rather than mislead (CP11 §11 R1).
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<never>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id]/assignments.put.js

@@ -0,0 +1,12 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { serviceIdParams } from "../../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../../utils/authz.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  await getValidatedRouterParams(event, serviceIdParams.parse);
+  throw createError({
+    statusCode: 501,
+    statusMessage: "Not Implemented",
+    data: { error: "ASSIGNMENTS_MANAGED_IN_CONFIG", hint: "Edit observe.auth.users; runtime assignment lands in CP16." }
+  });
+});

package/dist/runtime/server/api/observe/services/[id]/keys/[keyId]/rotate.post.d.ts

@@ -0,0 +1,4 @@
+import type { MintedKey } from '../../../../../../../shared/schema/provisioning.js';
+/** Atomic revoke-old + mint-new. The new raw key is returned exactly once. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<MintedKey>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id]/keys/[keyId]/rotate.post.js

@@ -0,0 +1,14 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody, createError } from "h3";
+import { keyIdParams, keyCreateSchema } from "../../../../../../../shared/schema/provisioning.js";
+import { requireCapability, assertServiceInScope } from "../../../../../../utils/authz.js";
+import { keyBelongsToService, rotateKey } from "../../../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.manage");
+  const { id, keyId } = await getValidatedRouterParams(event, keyIdParams.parse);
+  await assertServiceInScope(event, principal, id);
+  if (!await keyBelongsToService(keyId, id)) {
+    throw createError({ statusCode: 404, statusMessage: "Key not found" });
+  }
+  const { label } = await readValidatedBody(event, keyCreateSchema.parse);
+  return await rotateKey(event, id, keyId, label);
+});

package/dist/runtime/server/api/observe/services/[id]/keys/[keyId].delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+}>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id]/keys/[keyId].delete.js

@@ -0,0 +1,14 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { keyIdParams } from "../../../../../../shared/schema/provisioning.js";
+import { requireCapability, assertServiceInScope } from "../../../../../utils/authz.js";
+import { keyBelongsToService, revokeKey } from "../../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.manage");
+  const { id, keyId } = await getValidatedRouterParams(event, keyIdParams.parse);
+  await assertServiceInScope(event, principal, id);
+  if (!await keyBelongsToService(keyId, id)) {
+    throw createError({ statusCode: 404, statusMessage: "Key not found" });
+  }
+  await revokeKey(keyId);
+  return { ok: true };
+});

package/dist/runtime/server/api/observe/services/[id]/keys/index.get.d.ts

@@ -0,0 +1,3 @@
+import type { KeyMeta } from '../../../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<KeyMeta[]>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id]/keys/index.get.js

@@ -0,0 +1,10 @@
+import { defineEventHandler, getValidatedRouterParams } from "h3";
+import { serviceIdParams } from "../../../../../../shared/schema/provisioning.js";
+import { requireCapability, assertServiceInScope } from "../../../../../utils/authz.js";
+import { listKeyMeta } from "../../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.manage");
+  const { id } = await getValidatedRouterParams(event, serviceIdParams.parse);
+  await assertServiceInScope(event, principal, id);
+  return await listKeyMeta(id);
+});

package/dist/runtime/server/api/observe/services/[id]/keys/index.post.d.ts

@@ -0,0 +1,3 @@
+import type { MintedKey } from '../../../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<MintedKey>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id]/keys/index.post.js

@@ -0,0 +1,11 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody } from "h3";
+import { serviceIdParams, keyCreateSchema } from "../../../../../../shared/schema/provisioning.js";
+import { requireCapability, assertServiceInScope } from "../../../../../utils/authz.js";
+import { mintKey } from "../../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.manage");
+  const { id } = await getValidatedRouterParams(event, serviceIdParams.parse);
+  await assertServiceInScope(event, principal, id);
+  const { label } = await readValidatedBody(event, keyCreateSchema.parse);
+  return await mintKey(event, id, label);
+});

package/dist/runtime/server/api/observe/services/[id]/restore.post.d.ts

@@ -0,0 +1,4 @@
+import type { ServiceDetail } from '../../../../../shared/schema/provisioning.js';
+/** Undo a soft-delete before the retention window elapses. Admin-only (services.create). */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ServiceDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id]/restore.post.js

@@ -0,0 +1,11 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { serviceIdParams } from "../../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../../utils/authz.js";
+import { restoreServiceById } from "../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "services.create");
+  const { id } = await getValidatedRouterParams(event, serviceIdParams.parse);
+  const restored = await restoreServiceById(id);
+  if (!restored) throw createError({ statusCode: 404, statusMessage: "Service not found" });
+  return restored;
+});

package/dist/runtime/server/api/observe/services/[id].delete.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Soft-delete: the service leaves the active list immediately but is recoverable via
+ * the restore route until the retention window elapses (see SERVICE_DELETE_RETENTION_MS).
+ * Admin-only (services.create) since there is no separate services.delete capability.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+    deletedAt: number;
+    purgeAt: number;
+}>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id].delete.js

@@ -0,0 +1,11 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { serviceIdParams } from "../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { softDeleteServiceById } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "services.create");
+  const { id } = await getValidatedRouterParams(event, serviceIdParams.parse);
+  const result = await softDeleteServiceById(id);
+  if (!result) throw createError({ statusCode: 404, statusMessage: "Service not found" });
+  return { ok: true, deletedAt: result.deletedAt, purgeAt: result.purgeAt };
+});

package/dist/runtime/server/api/observe/services/[id].get.d.ts

@@ -0,0 +1,3 @@
+import type { ServiceDetail } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ServiceDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id].get.js

@@ -0,0 +1,12 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { serviceIdParams } from "../../../../shared/schema/provisioning.js";
+import { requireCapability, assertServiceInScope } from "../../../utils/authz.js";
+import { getServiceDetail } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.read");
+  const { id } = await getValidatedRouterParams(event, serviceIdParams.parse);
+  await assertServiceInScope(event, principal, id);
+  const detail = await getServiceDetail(id);
+  if (!detail) throw createError({ statusCode: 404, statusMessage: "Service not found" });
+  return detail;
+});

package/dist/runtime/server/api/observe/services/[id].patch.d.ts

@@ -0,0 +1,3 @@
+import type { ServiceDetail } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ServiceDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/services/[id].patch.js

@@ -0,0 +1,13 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody, createError } from "h3";
+import { serviceIdParams, serviceUpdateSchema } from "../../../../shared/schema/provisioning.js";
+import { requireCapability, assertServiceInScope } from "../../../utils/authz.js";
+import { updateServiceFromInput } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.manage");
+  const { id } = await getValidatedRouterParams(event, serviceIdParams.parse);
+  await assertServiceInScope(event, principal, id);
+  const patch = await readValidatedBody(event, serviceUpdateSchema.parse);
+  const updated = await updateServiceFromInput(id, patch);
+  if (!updated) throw createError({ statusCode: 404, statusMessage: "Service not found" });
+  return updated;
+});

package/dist/runtime/server/api/observe/services/index.get.d.ts

@@ -0,0 +1,3 @@
+import type { ServiceListItem } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ServiceListItem[]>>;
+export default _default;

package/dist/runtime/server/api/observe/services/index.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { requireCapability } from "../../../utils/authz.js";
+import { listServicesForPrincipal } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.read");
+  return await listServicesForPrincipal(event, principal);
+});

package/dist/runtime/server/api/observe/services/index.post.d.ts

@@ -0,0 +1,3 @@
+import type { ServiceDetail } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ServiceDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/services/index.post.js

@@ -0,0 +1,16 @@
+import { defineEventHandler, readValidatedBody, createError } from "h3";
+import { serviceCreateSchema } from "../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { createServiceFromInput } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.create");
+  const input = await readValidatedBody(event, serviceCreateSchema.parse);
+  try {
+    return await createServiceFromInput(input, principal);
+  } catch (e) {
+    if (e instanceof Error && /UNIQUE/i.test(e.message)) {
+      throw createError({ statusCode: 409, statusMessage: "Service slug already exists" });
+    }
+    throw e;
+  }
+});

package/dist/runtime/server/api/observe/stats.get.d.ts

@@ -0,0 +1,3 @@
+import { type StatsResponse } from '../../../shared/schema/stats.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<StatsResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/stats.get.js

@@ -0,0 +1,28 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import { statsQuerySchema } from "../../../shared/schema/stats.js";
+import { periodToRange } from "../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../utils/authz.js";
+import { resolveEffectiveScope } from "../../utils/scope.js";
+import { getStats, emptyStats, DEFAULT_BUCKET_MS, MAX_BUCKETS } from "../../utils/stats-query.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "stats.read");
+  const { period, service, group, version, level, bucketMs } = await getValidatedQuery(event, statsQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, { service, group });
+  const { from, to, label } = periodToRange(period);
+  const bucket = bucketMs ?? DEFAULT_BUCKET_MS[period];
+  if ((to - from) / bucket > MAX_BUCKETS) {
+    throw createError({ statusCode: 400, statusMessage: "bucketMs too small for window" });
+  }
+  const scope = {
+    serviceIds: effective === "*" ? [] : effective,
+    isAll: effective === "*"
+  };
+  try {
+    const data = effective !== "*" && effective.length === 0 ? emptyStats(from, to, bucket) : await getStats(effective, from, to, bucket, { version, level });
+    return { period: { from, to, label }, scope, bucketMs: bucket, ...data };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Stats query failed" });
+  }
+});

package/dist/runtime/server/api/observe/users/[id]/assignments.put.d.ts

@@ -0,0 +1,3 @@
+import type { UserDetail } from '../../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/users/[id]/assignments.put.js

@@ -0,0 +1,14 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody, createError } from "h3";
+import { userIdParams, userAssignmentsSchema } from "../../../../../shared/auth/schema.js";
+import { requireCapability } from "../../../../utils/authz.js";
+import { getUserById, setUserAssignments } from "../../../../utils/db/users.js";
+import { getUserDetail } from "../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  const { id } = await getValidatedRouterParams(event, userIdParams.parse);
+  const input = await readValidatedBody(event, userAssignmentsSchema.parse);
+  const target = await getUserById(id);
+  if (!target) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  await setUserAssignments(id, input);
+  return await getUserDetail(id);
+});

package/dist/runtime/server/api/observe/users/[id].delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+}>>;
+export default _default;

package/dist/runtime/server/api/observe/users/[id].delete.js

@@ -0,0 +1,15 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { userIdParams } from "../../../../shared/auth/schema.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { getUserById, deleteUser, countAdmins } from "../../../utils/db/users.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  const { id } = await getValidatedRouterParams(event, userIdParams.parse);
+  const target = await getUserById(id);
+  if (!target) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  if (target.role === "admin" && !target.disabled && await countAdmins() <= 1) {
+    throw createError({ statusCode: 409, statusMessage: "Cannot delete the last admin", data: { error: "LAST_ADMIN" } });
+  }
+  await deleteUser(id);
+  return { ok: true };
+});

package/dist/runtime/server/api/observe/users/[id].get.d.ts

@@ -0,0 +1,3 @@
+import type { UserDetail } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/users/[id].get.js

@@ -0,0 +1,11 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { userIdParams } from "../../../../shared/auth/schema.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { getUserDetail } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  const { id } = await getValidatedRouterParams(event, userIdParams.parse);
+  const detail = await getUserDetail(id);
+  if (!detail) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  return detail;
+});

package/dist/runtime/server/api/observe/users/[id].patch.d.ts

@@ -0,0 +1,3 @@
+import type { UserDetail } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/users/[id].patch.js

@@ -0,0 +1,25 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody, createError } from "h3";
+import { hashPassword } from "#imports";
+import { userIdParams, patchUserSchema } from "../../../../shared/auth/schema.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { getUserById, updateUser, countAdmins } from "../../../utils/db/users.js";
+import { getUserDetail } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  const { id } = await getValidatedRouterParams(event, userIdParams.parse);
+  const patch = await readValidatedBody(event, patchUserSchema.parse);
+  const target = await getUserById(id);
+  if (!target) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  const isEnabledAdmin = target.role === "admin" && !target.disabled;
+  const willLoseAdmin = patch.role !== void 0 && patch.role !== "admin" || patch.disabled === true;
+  if (isEnabledAdmin && willLoseAdmin && await countAdmins() <= 1) {
+    throw createError({ statusCode: 409, statusMessage: "Cannot remove the last admin", data: { error: "LAST_ADMIN" } });
+  }
+  await updateUser(id, {
+    ...patch.displayName !== void 0 ? { displayName: patch.displayName } : {},
+    ...patch.role !== void 0 ? { role: patch.role } : {},
+    ...patch.disabled !== void 0 ? { disabled: patch.disabled } : {},
+    ...patch.password !== void 0 ? { passwordHash: await hashPassword(patch.password) } : {}
+  });
+  return await getUserDetail(id);
+});

package/dist/runtime/server/api/observe/users/index.get.d.ts

@@ -0,0 +1,8 @@
+import type { UserPick } from '../../../../shared/schema/provisioning.js';
+/**
+ * Admin-only user list. Data source follows the active provider: DB rows when the db provider
+ * is active, config-seeded users (observe.auth.users) otherwise. Same UserPick wire shape
+ * either way, so the CP11 composable + UI are reused rather than forked.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserPick[]>>;
+export default _default;

package/dist/runtime/server/api/observe/users/index.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { requireCapability } from "../../../utils/authz.js";
+import { listUsers, listDbUsers, isDbProviderActive } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  return isDbProviderActive() ? await listDbUsers() : listUsers();
+});

package/dist/runtime/server/api/observe/users/index.post.d.ts

@@ -0,0 +1,3 @@
+import type { UserDetail } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<UserDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/users/index.post.js

@@ -0,0 +1,29 @@
+import { defineEventHandler, readValidatedBody, createError } from "h3";
+import { hashPassword } from "#imports";
+import { createUserSchema } from "../../../../shared/auth/schema.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { getUserByUsername, createUser } from "../../../utils/db/users.js";
+import { getUserDetail } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "users.manage");
+  const input = await readValidatedBody(event, createUserSchema.parse);
+  if (await getUserByUsername(input.username)) {
+    throw createError({ statusCode: 409, statusMessage: "Username already exists", data: { error: "DUPLICATE_USERNAME" } });
+  }
+  const passwordHash = input.password ? await hashPassword(input.password) : null;
+  try {
+    const row = await createUser({
+      username: input.username,
+      displayName: input.displayName ?? null,
+      role: input.role,
+      passwordHash,
+      createdBy: principal.sub
+    });
+    return await getUserDetail(row.id);
+  } catch (e) {
+    if (e instanceof Error && /UNIQUE/i.test(e.message)) {
+      throw createError({ statusCode: 409, statusMessage: "Username already exists", data: { error: "DUPLICATE_USERNAME" } });
+    }
+    throw e;
+  }
+});

package/dist/runtime/server/auth/authorization.d.ts

@@ -0,0 +1,7 @@
+import type { AuthorizationStore } from '../../shared/auth/types.js';
+/**
+ * Identity store: the principal already carries its assignment (built by the provider),
+ * so CP5 returns it verbatim. CP16's db store will look this up by principal.sub; CP6
+ * adds capability checks (the roles.ts matrix) here / in require-observe-session.
+ */
+export declare const ConfigAuthorizationStore: AuthorizationStore;

package/dist/runtime/server/auth/authorization.js

@@ -0,0 +1,5 @@
+export const ConfigAuthorizationStore = {
+  async getAssignment(principal) {
+    return principal.assignment;
+  }
+};

package/dist/runtime/server/auth/provider.d.ts

@@ -0,0 +1,17 @@
+import type { AuthProvider } from '../../shared/auth/types.js';
+/**
+ * Resolves the configured PRIMARY provider once per process. runtimeConfig.observe.auth.provider
+ * selects it. This file is Nitro-only (never node-unit-imported), so importing the ambient
+ * hashPassword/verifyPassword from '#imports' is safe here; they are then INJECTED into the
+ * factories, which themselves stay '#imports'-free for node tests (CP5-HANDOFF §3.4).
+ */
+export declare function getAuthProvider(): AuthProvider;
+/**
+ * The JWT provider consulted by the Bearer fallback (require-observe-session.ts) REGARDLESS
+ * of which primary provider is selected, whenever `observe.auth.jwt.enabled`. Memoised
+ * separately from the primary so a `provider:'db'` install can still accept Bearer tokens.
+ * Returns null when JWT is not enabled.
+ */
+export declare function getJwtAuthProvider(): AuthProvider | null;
+/** Test-only: drop the memoized singletons between fixtures. */
+export declare function __resetAuthProviderForTests(): void;

package/dist/runtime/server/auth/provider.js

@@ -0,0 +1,44 @@
+import { useRuntimeConfig } from "nitropack/runtime";
+import { hashPassword, verifyPassword } from "#imports";
+import { createConfigAuthProvider } from "./providers/config-provider.js";
+import { createDbAuthProvider } from "./providers/db-provider.js";
+import { createJwtAuthProvider } from "./providers/jwt-provider.js";
+let _provider;
+let _jwtProvider;
+function authRuntime() {
+  return useRuntimeConfig().observe.auth ?? {};
+}
+export function getAuthProvider() {
+  if (_provider) return _provider;
+  const auth = authRuntime();
+  switch (auth.provider ?? "config") {
+    case "db":
+      _provider = createDbAuthProvider({
+        hashPassword,
+        verifyPassword,
+        // The config user seed becomes the gated bootstrap-admin fallback (roles.ts lifecycle).
+        configFallback: createConfigAuthProvider({ users: auth.users ?? [], hashPassword, verifyPassword })
+      });
+      break;
+    case "jwt":
+      _provider = createJwtAuthProvider(auth.jwt ?? {});
+      break;
+    default:
+      _provider = createConfigAuthProvider({
+        users: auth.users ?? [],
+        hashPassword,
+        verifyPassword
+      });
+  }
+  return _provider;
+}
+export function getJwtAuthProvider() {
+  if (_jwtProvider !== void 0) return _jwtProvider;
+  const jwt = authRuntime().jwt;
+  _jwtProvider = jwt?.enabled ? createJwtAuthProvider(jwt) : null;
+  return _jwtProvider;
+}
+export function __resetAuthProviderForTests() {
+  _provider = void 0;
+  _jwtProvider = void 0;
+}