silosdk 0.0.0 → 0.0.1

package/dist/server/index.cjs

@@ -0,0 +1,355 @@
+const require_schema_index = require('../schema/index.cjs');
+const require_do = require('./do.cjs');
+const require_d1 = require('./d1.cjs');
+const require_r2 = require('./r2.cjs');
+const require_auth = require('./auth.cjs');
+const require_protect = require('./protect.cjs');
+
+//#region src/server/index.ts
+async function d1EnsureAuthSchema(db) {
+	await db.batch([db.prepare(`CREATE TABLE IF NOT EXISTS silo_users (
+      id TEXT PRIMARY KEY,
+      email TEXT UNIQUE,
+      role TEXT NOT NULL DEFAULT 'user',
+      createdAt TEXT NOT NULL
+    )`), db.prepare(`CREATE TABLE IF NOT EXISTS silo_otps (
+      email TEXT PRIMARY KEY,
+      code TEXT NOT NULL,
+      expiresAt TEXT NOT NULL
+    )`)]);
+}
+function createServer(config) {
+	const { auth, views, storage } = config;
+	const storageConfig = storage == null ? null : storage === true ? {} : storage || null;
+	const storageMaxSize = storageConfig?.maxSize ?? 50 * 1024 * 1024;
+	const protectedViews = /* @__PURE__ */ new Map();
+	for (const v of views) if ("_rules" in v) protectedViews.set(v.name, v);
+	let schemaReady = false;
+	async function ensureSchema(db) {
+		if (schemaReady) return;
+		await require_d1.d1EnsureSchema(db);
+		if (auth && Array.isArray(auth._providers)) await d1EnsureAuthSchema(db);
+		schemaReady = true;
+	}
+	function checkRolePermission(viewName, operation, role) {
+		if (!auth?._roles) return true;
+		const roleDef = auth._roles[role];
+		if (!roleDef) return false;
+		return (roleDef[viewName] ?? roleDef.default)[operation];
+	}
+	async function resolveUser(request, env) {
+		const url = new URL(request.url);
+		const authHeader = request.headers.get("Authorization");
+		const token = (authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null) ?? url.searchParams.get("token");
+		if (auth) {
+			if (!token) return null;
+			if (!Array.isArray(auth._providers) && auth._providers._type === "custom") {
+				const resolved = await auth._providers.resolve(token);
+				if (!resolved) return null;
+				return {
+					id: resolved.id,
+					email: null,
+					role: resolved.role ?? "user",
+					isAnonymous: false
+				};
+			}
+			const user = await require_auth.resolveSession(env.SILO_SESSIONS, token);
+			if (user && url.pathname === "/sync" && user.isAnonymous) return null;
+			return user;
+		}
+		const devUser = request.headers.get("X-Dev-User");
+		return devUser ? {
+			id: devUser,
+			email: null,
+			role: "user",
+			isAnonymous: false
+		} : {
+			id: "dev",
+			email: null,
+			role: "user",
+			isAnonymous: false
+		};
+	}
+	return {
+		SyncObject: require_do.SyncObject,
+		async fetch(request, env) {
+			await ensureSchema(env.SILO_DB);
+			const url = new URL(request.url);
+			const { pathname } = url;
+			if (pathname === "/health") return json({ ok: true });
+			if (auth && Array.isArray(auth._providers) && pathname.startsWith("/auth/")) return handleAuthRoute(pathname, request, env, auth);
+			if (storageConfig && pathname === "/storage/upload" && request.method === "POST") {
+				const user = await resolveUser(request, env);
+				if (!user || user.isAnonymous) return new Response("Unauthorized", { status: 401 });
+				const scope = request.headers.get("X-Asset-Scope") === "public" ? "public" : "private";
+				const contentLengthHeader = request.headers.get("Content-Length");
+				const declaredSize = contentLengthHeader ? Number(contentLengthHeader) : 0;
+				if (Number.isFinite(declaredSize) && declaredSize > storageMaxSize) return new Response("Payload too large", { status: 413 });
+				if (!request.body) return new Response("Missing request body", { status: 400 });
+				const contentType = request.headers.get("Content-Type") ?? "application/octet-stream";
+				const name = request.headers.get("X-File-Name") ?? void 0;
+				const uploaded = await require_r2.r2Put(env.SILO_STORAGE, {
+					scope,
+					userId: user.id,
+					body: request.body,
+					name,
+					contentType,
+					size: Number.isFinite(declaredSize) && declaredSize > 0 ? declaredSize : void 0
+				});
+				if (storageConfig.onUpload) {
+					if (!await storageConfig.onUpload({
+						user,
+						key: uploaded.key,
+						contentType: uploaded.contentType ?? contentType,
+						size: uploaded.size ?? 0,
+						scope,
+						env
+					})) {
+						await require_r2.r2Delete(env.SILO_STORAGE, uploaded.key);
+						return new Response("Forbidden", { status: 403 });
+					}
+				}
+				return json(uploaded);
+			}
+			const storageMatch = pathname.match(/^\/storage\/(.+)$/);
+			if (storageConfig && storageMatch && request.method === "GET") {
+				const key = decodeURIComponent(storageMatch[1]);
+				const parsed = require_r2.parseAssetKeyScope(key);
+				if (!parsed) return new Response("Not found", { status: 404 });
+				if (parsed.scope === "private") {
+					const user = await resolveUser(request, env);
+					if (!user) return new Response("Unauthorized", { status: 401 });
+					if (!require_r2.isAssetOwner(key, user.id)) return new Response("Forbidden", { status: 403 });
+				} else if (!storageConfig.public) {
+					if (!await resolveUser(request, env)) return new Response("Unauthorized", { status: 401 });
+				}
+				const obj = await require_r2.r2Get(env.SILO_STORAGE, key);
+				if (!obj || !obj.body) return new Response("Not found", { status: 404 });
+				const headers = new Headers();
+				if (obj.httpMetadata?.contentType) headers.set("Content-Type", obj.httpMetadata.contentType);
+				else headers.set("Content-Type", "application/octet-stream");
+				return new Response(obj.body, {
+					status: 200,
+					headers
+				});
+			}
+			if (storageConfig && storageMatch && request.method === "DELETE") {
+				const user = await resolveUser(request, env);
+				if (!user) return new Response("Unauthorized", { status: 401 });
+				const key = decodeURIComponent(storageMatch[1]);
+				if (!require_r2.parseAssetKeyScope(key)) return new Response("Not found", { status: 404 });
+				if (!require_r2.isAssetOwner(key, user.id)) return new Response("Forbidden", { status: 403 });
+				await require_r2.r2Delete(env.SILO_STORAGE, key);
+				return new Response(null, { status: 204 });
+			}
+			const publicMatch = pathname.match(/^\/public\/([^/]+)$/);
+			if (publicMatch) {
+				const viewName = decodeURIComponent(publicMatch[1]);
+				const protected_ = protectedViews.get(viewName);
+				const hasReadRules = protected_?._rules.read != null;
+				const hasWriteRules = protected_?._rules.write != null;
+				if (request.method === "GET") {
+					const whereParam = url.searchParams.get("where");
+					const orderParam = url.searchParams.get("order");
+					let where;
+					let order;
+					if (whereParam) try {
+						const parsed = JSON.parse(whereParam);
+						if (parsed && typeof parsed === "object") where = parsed;
+					} catch {
+						return new Response("Invalid where clause", { status: 400 });
+					}
+					if (orderParam) try {
+						const parsed = JSON.parse(orderParam);
+						if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) order = parsed;
+					} catch {
+						return new Response("Invalid order clause", { status: 400 });
+					}
+					if (!hasReadRules && !checkRolePermission(viewName, "read", "anon")) {
+						const id$1 = url.searchParams.get("id");
+						if (id$1) {
+							const row = await require_d1.d1GetRow(env.SILO_DB, viewName, { id: id$1 });
+							if (!row) return new Response("Not found", { status: 404 });
+							return json(row);
+						} else {
+							const take = url.searchParams.get("take");
+							const options = {};
+							if (take) options.take = Number(take);
+							if (where) options.where = where;
+							if (order) options.order = order;
+							const pv = url.searchParams.get("parentView");
+							const pi = url.searchParams.get("parentId");
+							if (pv && pi) {
+								options.parentView = pv;
+								options.parentId = pi;
+							}
+							const cv = url.searchParams.get("childView");
+							const ci = url.searchParams.get("childId");
+							if (cv && ci) {
+								options.childView = cv;
+								options.childId = ci;
+							}
+							return json(await require_d1.d1GetRows(env.SILO_DB, viewName, options));
+						}
+					}
+					const user = await resolveUser(request, env);
+					if (!user && (hasReadRules || hasWriteRules)) return new Response("Unauthorized", { status: 401 });
+					if (hasReadRules) {
+						const query = where && !Array.isArray(where) ? { ...where } : {};
+						if (!await protected_._rules.read({
+							user,
+							env,
+							query
+						})) return new Response("Forbidden", { status: 403 });
+					} else if (!checkRolePermission(viewName, "read", user?.role ?? "anon")) return new Response("Forbidden", { status: 403 });
+					const id = url.searchParams.get("id");
+					if (id) {
+						const row = await require_d1.d1GetRow(env.SILO_DB, viewName, { id });
+						if (!row) return new Response("Not found", { status: 404 });
+						return json(row);
+					} else {
+						const take = url.searchParams.get("take");
+						const options = {};
+						if (take) options.take = Number(take);
+						if (where) options.where = where;
+						if (order) options.order = order;
+						const pv = url.searchParams.get("parentView");
+						const pi = url.searchParams.get("parentId");
+						if (pv && pi) {
+							options.parentView = pv;
+							options.parentId = pi;
+						}
+						const cv = url.searchParams.get("childView");
+						const ci = url.searchParams.get("childId");
+						if (cv && ci) {
+							options.childView = cv;
+							options.childId = ci;
+						}
+						return json(await require_d1.d1GetRows(env.SILO_DB, viewName, options));
+					}
+				}
+				if (request.method === "POST") {
+					const user = await resolveUser(request, env);
+					if (!user) return new Response("Unauthorized", { status: 401 });
+					let body;
+					try {
+						body = await request.json();
+					} catch {
+						return new Response("Invalid JSON", { status: 400 });
+					}
+					if (!Array.isArray(body?.ops)) return new Response("Expected { ops: [...] }", { status: 400 });
+					if (user.isAnonymous && !protected_?._rules.write) return json({
+						error: "Anonymous users cannot write to public DB",
+						code: "ANON_WRITE_FORBIDDEN"
+					}, 403);
+					if (protected_?._rules.write) {
+						for (const op of body.ops) if (!await protected_._rules.write({
+							user,
+							env,
+							op
+						})) return new Response("Forbidden", { status: 403 });
+					} else if (!checkRolePermission(viewName, "write", user.role)) return new Response("Forbidden", { status: 403 });
+					await require_d1.d1ApplyOps(env.SILO_DB, body.ops);
+					return new Response(null, { status: 204 });
+				}
+				return new Response("Method not allowed", { status: 405 });
+			}
+			if (pathname === "/sync" && request.headers.get("Upgrade") === "websocket") {
+				const user = await resolveUser(request, env);
+				if (!user) return new Response("Unauthorized", { status: 401 });
+				const doId = env.SILO_SYNC.idFromName(user.id);
+				return env.SILO_SYNC.get(doId).fetch(request);
+			}
+			return new Response("Not found", { status: 404 });
+		}
+	};
+	async function handleAuthRoute(pathname, request, env, authInst) {
+		const sessionDuration = authInst._sessionDuration;
+		const otpProv = authInst._providers.find((p) => p._type === "otp");
+		if (pathname === "/auth/anonymous" && request.method === "POST") {
+			const { token, userId } = await require_auth.createAnonymousUser(env.SILO_DB, env.SILO_SESSIONS, sessionDuration, authInst._defaultRole);
+			return json({
+				token,
+				user: {
+					id: userId,
+					email: null,
+					role: authInst._defaultRole,
+					isAnonymous: true
+				}
+			});
+		}
+		if (pathname === "/auth/request" && request.method === "POST") {
+			if (!otpProv) return new Response("OTP auth not enabled", { status: 400 });
+			let body;
+			try {
+				body = await request.json();
+			} catch {
+				return new Response("Invalid JSON", { status: 400 });
+			}
+			if (!body.email) return new Response("Missing email", { status: 400 });
+			const code = await require_auth.createOtp(env.SILO_DB, body.email);
+			await otpProv.config.sendOTP(body.email, code, env);
+			return json({ ok: true });
+		}
+		if (pathname === "/auth/verify" && request.method === "POST") {
+			let body;
+			try {
+				body = await request.json();
+			} catch {
+				return new Response("Invalid JSON", { status: 400 });
+			}
+			if (!body.email || !body.otp) return new Response("Missing email or otp", { status: 400 });
+			const { valid } = await require_auth.verifyOtp(env.SILO_DB, body.email, body.otp);
+			if (!valid) return new Response("Invalid or expired code", { status: 401 });
+			const user = await require_auth.findOrCreateUser(env.SILO_DB, body.email, { role: authInst._defaultRole });
+			return json({
+				token: await require_auth.createSession(env.SILO_SESSIONS, user.id, user.email, user.role, sessionDuration),
+				user: {
+					id: user.id,
+					email: user.email,
+					role: user.role,
+					isAnonymous: false
+				}
+			});
+		}
+		if (pathname === "/auth/signout" && request.method === "POST") {
+			const authHeader = request.headers.get("Authorization");
+			const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+			if (token) await require_auth.deleteSession(env.SILO_SESSIONS, token);
+			return json({ ok: true });
+		}
+		if (pathname === "/auth/me" && request.method === "GET") {
+			const user = await resolveSessionFromRequest(request, env);
+			if (!user) return new Response("Unauthorized", { status: 401 });
+			return json({
+				id: user.id,
+				email: user.email,
+				role: user.role,
+				isAnonymous: user.isAnonymous
+			});
+		}
+		return new Response("Not found", { status: 404 });
+	}
+	async function resolveSessionFromRequest(request, env) {
+		const authHeader = request.headers.get("Authorization");
+		const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+		if (!token) return null;
+		return require_auth.resolveSession(env.SILO_SESSIONS, token);
+	}
+}
+function json(data, status = 200) {
+	return new Response(JSON.stringify(data), {
+		status,
+		headers: { "Content-Type": "application/json" }
+	});
+}
+
+//#endregion
+exports.SyncObject = require_do.SyncObject;
+exports.createAuth = require_auth.createAuth;
+exports.createServer = createServer;
+exports.customProvider = require_auth.customProvider;
+exports.otpProvider = require_auth.otpProvider;
+exports.protect = require_protect.protect;
+exports.resolveSession = require_auth.resolveSession;
+exports.view = require_schema_index.view;

package/dist/server/index.d.cts

@@ -0,0 +1,65 @@
+import { AssetRef, Infer, ProtectedView, View, view } from "../schema/index.cjs";
+import { SyncObject } from "./do.cjs";
+import { AssetScope } from "./r2.cjs";
+import { AuthInstance, RoleDefinition, RolesConfig, ViewPermissions, createAuth, customProvider, otpProvider, resolveSession } from "./auth.cjs";
+import { protect } from "./protect.cjs";
+
+//#region src/server/index.d.ts
+
+interface Env {
+  SILO_SYNC: DurableObjectNamespace;
+  SILO_DB: D1Database;
+  /** Required when using built-in auth (Phase 4). */
+  SILO_SESSIONS: KVNamespace;
+  /** Required when storage is enabled. */
+  SILO_STORAGE: R2Bucket;
+}
+type StorageConfig = {
+  /**
+   * If true, public-scope assets can be read without auth.
+   * Private-scope assets always require owner auth.
+   */
+  public?: boolean;
+  /**
+   * Max upload payload in bytes. Defaults to 50MB.
+   */
+  maxSize?: number;
+  /**
+   * Optional upload gate. Return false to reject.
+   */
+  onUpload?: (ctx: {
+    user: {
+      id: string;
+      email: string | null;
+      role: string;
+      isAnonymous: boolean;
+    };
+    key: string;
+    contentType: string;
+    size: number;
+    scope: AssetScope;
+    env: Env;
+  }) => boolean | Promise<boolean>;
+};
+type ServerConfig = {
+  /**
+   * View definitions to serve. Pass a `ProtectedView` (from `protect()`) to
+   * apply per-view access-control rules.
+   */
+  views: Array<View | ProtectedView>;
+  /**
+   * Auth configuration. Use `createAuth()` to configure built-in passwordless
+   * auth or BYO token validation. Omit for dev/open mode.
+   */
+  auth?: AuthInstance;
+  /**
+   * Object storage configuration (R2). Omit to disable storage routes.
+   */
+  storage?: boolean | StorageConfig;
+};
+declare function createServer(config: ServerConfig): {
+  SyncObject: typeof SyncObject;
+  fetch(request: Request, env: Env): Promise<Response>;
+};
+//#endregion
+export { type AssetRef, type AuthInstance, type Infer, type ProtectedView, type RoleDefinition, type RolesConfig, ServerConfig, StorageConfig, SyncObject, type View, type ViewPermissions, createAuth, createServer, customProvider, otpProvider, protect, resolveSession, view };

package/dist/server/index.d.mts

@@ -0,0 +1,65 @@
+import { AssetRef, Infer, ProtectedView, View, view } from "../schema/index.mjs";
+import { SyncObject } from "./do.mjs";
+import { AssetScope } from "./r2.mjs";
+import { AuthInstance, RoleDefinition, RolesConfig, ViewPermissions, createAuth, customProvider, otpProvider, resolveSession } from "./auth.mjs";
+import { protect } from "./protect.mjs";
+
+//#region src/server/index.d.ts
+
+interface Env {
+  SILO_SYNC: DurableObjectNamespace;
+  SILO_DB: D1Database;
+  /** Required when using built-in auth (Phase 4). */
+  SILO_SESSIONS: KVNamespace;
+  /** Required when storage is enabled. */
+  SILO_STORAGE: R2Bucket;
+}
+type StorageConfig = {
+  /**
+   * If true, public-scope assets can be read without auth.
+   * Private-scope assets always require owner auth.
+   */
+  public?: boolean;
+  /**
+   * Max upload payload in bytes. Defaults to 50MB.
+   */
+  maxSize?: number;
+  /**
+   * Optional upload gate. Return false to reject.
+   */
+  onUpload?: (ctx: {
+    user: {
+      id: string;
+      email: string | null;
+      role: string;
+      isAnonymous: boolean;
+    };
+    key: string;
+    contentType: string;
+    size: number;
+    scope: AssetScope;
+    env: Env;
+  }) => boolean | Promise<boolean>;
+};
+type ServerConfig = {
+  /**
+   * View definitions to serve. Pass a `ProtectedView` (from `protect()`) to
+   * apply per-view access-control rules.
+   */
+  views: Array<View | ProtectedView>;
+  /**
+   * Auth configuration. Use `createAuth()` to configure built-in passwordless
+   * auth or BYO token validation. Omit for dev/open mode.
+   */
+  auth?: AuthInstance;
+  /**
+   * Object storage configuration (R2). Omit to disable storage routes.
+   */
+  storage?: boolean | StorageConfig;
+};
+declare function createServer(config: ServerConfig): {
+  SyncObject: typeof SyncObject;
+  fetch(request: Request, env: Env): Promise<Response>;
+};
+//#endregion
+export { type AssetRef, type AuthInstance, type Infer, type ProtectedView, type RoleDefinition, type RolesConfig, ServerConfig, StorageConfig, SyncObject, type View, type ViewPermissions, createAuth, createServer, customProvider, otpProvider, protect, resolveSession, view };