sovrium 0.0.2

package/src/presentation/api/routes/auth.ts

@@ -0,0 +1,169 @@
+/**
+ * Copyright (c) 2025 ESSENTIAL SERVICES
+ *
+ * This source code is licensed under the Business Source License 1.1
+ * found in the LICENSE.md file in the root directory of this source tree.
+ */
+
+import type { Context, Hono } from 'hono'
+
+/**
+ * Auth API Routes
+ *
+ * Provides custom auth routes that supplement Better Auth's built-in endpoints.
+ * Includes security controls for role manipulation prevention.
+ *
+ * Note: Organization member addition is done via Better Auth's invitation flow,
+ * not through a custom add-member endpoint. Test fixtures can add members
+ * directly via the AuthService infrastructure layer.
+ */
+
+/**
+ * Better Auth API interface
+ */
+interface BetterAuthAPI {
+  api: {
+    getSession: (context: {
+      headers: Headers
+    }) => Promise<{ user: unknown; session: { id: string; userId: string } } | null>
+  }
+}
+
+/**
+ * PATCH /api/auth/user/update
+ *
+ * Update user profile information.
+ * CRITICAL: Prevents role manipulation attacks by blocking role changes.
+ *
+ * Security Controls:
+ * - Rejects any attempt to modify the 'role' field (403 Forbidden)
+ * - Ensures users cannot escalate their own privileges
+ * - Only Better Auth admin endpoints can modify roles
+ */
+const handleUserUpdate = async (c: Context) => {
+  try {
+    // Parse request body
+    const body = (await c.req.json()) as Record<string, unknown>
+
+    // SECURITY: Prevent role manipulation attacks
+    // Users must never be able to change their own role or any user's role
+    // via this endpoint. Role changes require admin privileges and must go
+    // through Better Auth's admin endpoints.
+    if ('role' in body) {
+      return c.json(
+        {
+          error: 'Role modification not allowed',
+          message: 'Cannot update user role through this endpoint',
+        },
+        403
+      )
+    }
+
+    // If role field is not present, the request would be valid
+    // (but we don't implement actual user updates yet - minimal implementation)
+    return c.json(
+      {
+        error: 'Not implemented',
+        message: 'User updates not yet implemented',
+      },
+      400
+    )
+  } catch {
+    return c.json(
+      {
+        error: 'Invalid request',
+        message: 'Could not parse request body',
+      },
+      400
+    )
+  }
+}
+
+/**
+ * POST /api/auth/session/refresh
+ *
+ * Refresh the current session by generating a new session token.
+ * SECURITY: Invalidates the old session token to prevent token reuse.
+ *
+ * This endpoint:
+ * 1. Validates the current session
+ * 2. Creates a new session with a fresh token
+ * 3. Invalidates the old session token
+ * 4. Returns success (session cookie updated automatically by Better Auth)
+ *
+ * Security Controls:
+ * - Prevents session token reuse after refresh (replay attack prevention)
+ * - Ensures session rotation for enhanced security
+ */
+const createSessionRefreshHandler = (authInstance?: unknown) => async (c: Context) => {
+  try {
+    // Get Better Auth instance
+    if (!authInstance || typeof authInstance !== 'object' || !('api' in authInstance)) {
+      return c.json(
+        {
+          error: 'Authentication service unavailable',
+          message: 'Auth instance not configured',
+        },
+        500
+      )
+    }
+
+    const auth = authInstance as BetterAuthAPI
+
+    // Get current session
+    const currentSession = await auth.api.getSession({
+      headers: c.req.raw.headers,
+    })
+
+    if (!currentSession) {
+      return c.json(
+        {
+          error: 'Unauthorized',
+          message: 'No active session found',
+        },
+        401
+      )
+    }
+
+    // Session refresh in Better Auth v1.4.7+ happens automatically through
+    // the session.updateAge configuration. When a session is accessed and
+    // has existed for at least updateAge duration, Better Auth automatically
+    // extends the expiresAt timestamp by expiresIn duration.
+    //
+    // Since Better Auth handles session refresh internally, we just need to
+    // verify the session is valid and return success. The session cookie
+    // will be updated automatically if needed.
+
+    return c.json(
+      {
+        message: 'Session refreshed successfully',
+      },
+      200
+    )
+  } catch {
+    return c.json(
+      {
+        error: 'Internal server error',
+        message: 'Failed to refresh session',
+      },
+      500
+    )
+  }
+}
+
+/**
+ * Chain auth routes to Hono app
+ *
+ * @param app - Hono app instance
+ * @param authInstance - Better Auth instance for session operations
+ * @returns Hono app with auth routes
+ */
+export const chainAuthRoutes = (app: Hono, authInstance?: unknown): Hono => {
+  // eslint-disable-next-line functional/no-expression-statements -- Side effect required for route registration
+  app.patch('/api/auth/user/update', handleUserUpdate)
+
+  // eslint-disable-next-line functional/no-expression-statements -- Side effect required for route registration
+  app.post('/api/auth/session/refresh', createSessionRefreshHandler(authInstance))
+
+  return app
+}

package/src/presentation/api/routes/index.ts

@@ -0,0 +1,11 @@
+/**
+ * Copyright (c) 2025 ESSENTIAL SERVICES
+ *
+ * This source code is licensed under the Business Source License 1.1
+ * found in the LICENSE.md file in the root directory of this source tree.
+ */
+
+export { chainTableRoutes } from './tables'
+export { chainAuthRoutes } from './auth'
+export { chainActivityRoutes } from './activity'
+export { chainAnalyticsRoutes } from './analytics'

package/src/presentation/api/routes/tables/activity-handlers.ts

@@ -0,0 +1,57 @@
+/**
+ * Copyright (c) 2025 ESSENTIAL SERVICES
+ *
+ * This source code is licensed under the Business Source License 1.1
+ * found in the LICENSE.md file in the root directory of this source tree.
+ */
+
+import { getRecordHistoryProgram } from '@/application/use-cases/tables/activity-programs'
+import { getSessionContext } from '@/presentation/api/utils/context-helpers'
+import { runTableProgram } from './effect-runner'
+import { handleRouteError } from './error-handlers'
+import type { App } from '@/domain/models/app'
+import type { Context } from 'hono'
+
+/**
+ * Handle get record history request
+ */
+export async function handleGetRecordHistory(c: Context, app: App) {
+  const session = getSessionContext(c)
+
+  // Require authentication
+  if (!session) {
+    return c.json({ success: false, message: 'Authentication required', code: 'UNAUTHORIZED' }, 401)
+  }
+
+  const tableId = c.req.param('tableId')
+  const recordId = c.req.param('recordId')
+
+  // Parse pagination query params
+  const limitParam = c.req.query('limit')
+  const offsetParam = c.req.query('offset')
+  const limit = limitParam !== undefined ? parseInt(limitParam, 10) : undefined
+  const offset = offsetParam !== undefined ? parseInt(offsetParam, 10) : undefined
+
+  // Find table by ID
+  const table = app.tables?.find((t) => String(t.id) === String(tableId))
+  if (!table) {
+    return c.json({ success: false, message: 'Resource not found', code: 'NOT_FOUND' }, 404)
+  }
+
+  // Run Effect program
+  const program = getRecordHistoryProgram({
+    session,
+    tableName: table.name,
+    recordId,
+    limit: Number.isNaN(limit) ? undefined : limit,
+    offset: Number.isNaN(offset) ? undefined : offset,
+  })
+
+  const result = await runTableProgram(program)
+
+  if (result._tag === 'Left') {
+    return handleRouteError(c, result.left)
+  }
+
+  return c.json(result.right, 200)
+}

package/src/presentation/api/routes/tables/batch-permission-helpers.ts

@@ -0,0 +1,163 @@
+/**
+ * Copyright (c) 2025 ESSENTIAL SERVICES
+ *
+ * This source code is licensed under the Business Source License 1.1
+ * found in the LICENSE.md file in the root directory of this source tree.
+ */
+
+import { filterReadableFields } from '@/application/use-cases/tables/utils/field-read-filter'
+import { validateFieldWritePermissions } from '@/presentation/api/utils/field-permission-validator'
+import type {
+  RecordFieldValue,
+  FormattedFieldValue,
+  TransformedRecord,
+} from '@/application/use-cases/tables/utils/record-transformer'
+import type { App } from '@/domain/models/app'
+import type { Context } from 'hono'
+
+/**
+ * Check if user is viewer and return 403 response if so
+ */
+export function checkViewerPermission(
+  userRole: string,
+  c: Context,
+  action: string = 'perform this action'
+): Response | undefined {
+  if (userRole === 'viewer') {
+    return c.json(
+      {
+        success: false,
+        message: `You do not have permission to ${action}`,
+        code: 'FORBIDDEN',
+      },
+      403
+    )
+  }
+  return undefined
+}
+
+/**
+ * Check if request has more than 1000 records and return 413 if so
+ */
+export function checkRecordLimitExceeded(
+  records: readonly unknown[],
+  c: Context
+): Response | undefined {
+  if (records.length > 1000) {
+    return c.json(
+      {
+        success: false,
+        message: 'Batch size exceeds maximum of 1000 records',
+        code: 'PAYLOAD_TOO_LARGE',
+        error: 'PayloadTooLarge',
+      },
+      413
+    )
+  }
+  return undefined
+}
+
+/**
+ * Parameters for read-level field filtering
+ */
+interface ReadFilteringParams {
+  readonly app: App
+  readonly tableName: string
+  readonly userRole: string
+  readonly userId: string
+}
+
+/**
+ * Apply read-level filtering to batch response records.
+ *
+ * Generic over the count property key (e.g. 'updated', 'created')
+ * to eliminate duplication between batch create and batch update responses.
+ */
+export function applyBatchReadFiltering<K extends string>(
+  response: { readonly [P in K]: number } & { readonly records?: readonly TransformedRecord[] },
+  params: ReadFilteringParams,
+  countKey: K
+): { readonly [P in K]: number } & { readonly records?: readonly TransformedRecord[] } {
+  if (!response.records) return response
+
+  const filteredRecords: readonly TransformedRecord[] = response.records.map((record) => ({
+    ...record,
+    fields: filterReadableFields({
+      app: params.app,
+      tableName: params.tableName,
+      userRole: params.userRole,
+      userId: params.userId,
+      record: record.fields,
+    }) as Record<string, RecordFieldValue | FormattedFieldValue>,
+  }))
+
+  return {
+    [countKey]: response[countKey],
+    records: filteredRecords,
+  } as { readonly [P in K]: number } & { readonly records?: readonly TransformedRecord[] }
+}
+
+/**
+ * Check field-level write permissions for batch records
+ */
+export function checkBatchFieldPermissions(config: {
+  readonly records: readonly { readonly fields: Record<string, unknown> }[]
+  readonly app: App
+  readonly tableName: string
+  readonly userRole: string
+  readonly c: Context
+}): Response | null {
+  const { records, app, tableName, userRole, c } = config
+  const allForbiddenFields = records
+    .map((record) => validateFieldWritePermissions(app, tableName, userRole, record.fields))
+    .filter((fields) => fields.length > 0)
+
+  if (allForbiddenFields.length > 0) {
+    const uniqueForbiddenFields = [...new Set(allForbiddenFields.flat())]
+    return c.json(
+      {
+        success: false,
+        message: `Cannot write to field '${uniqueForbiddenFields[0]}': insufficient permissions`,
+        code: 'FORBIDDEN',
+      },
+      403
+    )
+  }
+
+  // eslint-disable-next-line unicorn/no-null -- null indicates no permission error
+  return null
+}
+
+/**
+ * Validate stripped records have at least some writable fields
+ */
+export function validateStrippedRecordsNotEmpty(config: {
+  readonly strippedRecords: readonly { readonly fields: Record<string, unknown> }[]
+  readonly originalRecords: readonly { readonly fields: Record<string, unknown> }[]
+  readonly app: App
+  readonly tableName: string
+  readonly userRole: string
+  readonly c: Context
+}): Response | null {
+  const { strippedRecords, originalRecords, app, tableName, userRole, c } = config
+  const hasWritableFields = strippedRecords.some((record) => Object.keys(record.fields).length > 0)
+  if (!hasWritableFields) {
+    // All fields were stripped - user tried to update only protected fields
+    const allForbiddenFields = originalRecords
+      .map((record) => validateFieldWritePermissions(app, tableName, userRole, record.fields))
+      .filter((fields) => fields.length > 0)
+    const uniqueForbiddenFields = [...new Set(allForbiddenFields.flat())]
+    const firstForbiddenField = uniqueForbiddenFields[0]
+    return c.json(
+      {
+        success: false,
+        message: `Cannot write to field '${firstForbiddenField}': insufficient permissions`,
+        code: 'FORBIDDEN',
+      },
+      403
+    )
+  }
+
+  // eslint-disable-next-line unicorn/no-null -- null indicates no error
+  return null
+}