spine-framework 0.3.124 → 0.3.126

package/.framework/functions/auth.ts

@@ -1,73 +1,55 @@
-/**
- * @module auth
- * @audience core-contributor
- * @layer api-handler
- * @stability stable
- *
- * Authentication context endpoint. Returns the full user session context for
- * the authenticated principal: person record, account, role, permissions, and
- * accessible child accounts (via the `get_account_hierarchy` RPC).
- *
- * **Routed by:** `GET /.netlify/functions/auth`
- *
- * **Actions:**
- * | method | handler  |
- * |--------|----------|
- * | GET    | context  |
- * | HEALTH | health   |
- *
- * **Authorization:** `context` requires a non-anonymous authenticated
- * principal. `health` is unauthenticated.
- *
- * **Returned session shape:**
- * ```ts
- * {
- *   id: string             // person UUID
- *   email: string
- *   full_name: string
- *   account_id: string
- *   account: { id, slug, display_name, parent_id }
- *   roles: string[]        // role slugs (e.g. ['system_admin'])
- *   permissions: string[]  // derived from role.slug or role.permissions
- *   accessible_accounts: AccountHierarchyRow[]
- * }
- * ```
- *
- * INVARIANT: `system_admin` role always receives the full permission set
- *   ['read', 'write', 'admin', 'system'] regardless of `role.permissions`.
- *
- * @seeAlso middleware.ts (createHandler builds ctx.principal from JWT)
- * @seeAlso _shared/db.ts (get_account_hierarchy RPC)
- * @seeAlso roles.ts (role records referenced by FK)
- */
 
-import { createHandler } from './_shared/middleware'
 
-// ─── HANDLERS ─────────────────────────────────────────────────────────────────
-
-/**
- * Returns the full authenticated user context. Fetches person, account,
- * and role in a single query, then calls `get_account_hierarchy` to
- * resolve accessible child accounts.
- *
- * @returns Session object (see module-level shape doc)
- * @throws Error('Authentication required') if principal is anonymous
- * @throws Error('User not found: <id>') if person row is inactive or missing
- * @sideEffects DB read: people table (with account + role joins)
- * @sideEffects DB read: get_account_hierarchy RPC
- * @calledBy handler (GET)
- * @testUnit tests/unit/auth.test.ts — 'context'
- * @testIntegration tests/integration/auth.test.ts — 'returns valid context'
- */
+
+
+
+
+
+
+
+
+
+
+
+// CIL[BEGIN chunk_id="auth_moduleheader_1783969696" type="module_header" identity="imports" parent="none"]
+// CIL[DOC-MACRO purpose="Import middleware for auth module"]
+// CIL[DOC-RESPONSIBILITY responsibility="Import request handler creation utility"]
+// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/schema-utils.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="imported_modules" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Import createHandler for auth function endpoints" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="developer"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/migrations/015_simplify_apps_table.sql, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/schema-utils.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+
+import { createHandler } from './_shared/middleware'
+// CIL[END chunk_id="auth_moduleheader_1783969696"]
+// CIL[BEGIN chunk_id="auth_context_1783969696" type="function" identity="context" parent="none"]
+// CIL[DOC-MACRO purpose="Get authenticated user context"]
+// CIL[DOC-RESPONSIBILITY responsibility="Retrieve user profile, account, role, and permissions"]
+// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\".framework/src/pages/admin/RolesPage.tsx\",\".framework/functions/_shared/principal.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="user_context" errors="auth_errors,not_found" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Fetch user data with account hierarchy and effective permissions" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 6. Direct calls: 0. Related files: .framework/src/pages/admin/RolesPage.tsx, .framework/functions/_shared/principal.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 6. Total affected: 21."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const context = createHandler(async (ctx, _body) => {
-  // Authentication is required
+  
   if (!ctx.principal || ctx.principal.id === 'anonymous') {
     throw new Error('Authentication required')
   }
 
   console.log('Backend: Fetching user context for person:', ctx.principal.id)
-
-  // Single query gets everything - person, account, role using simplified model
   const { data: personData, error: personError } = await ctx.db
     .from('people')
     .select(`
@@ -110,23 +92,36 @@ export const context = createHandler(async (ctx, _body) => {
     role_id: personData.role_id
   })
 
-  // Extract account and role (handle array responses)
+  
   const account = Array.isArray(personData.account) ? personData.account[0] : personData.account
   const role = Array.isArray(personData.role) ? personData.role[0] : personData.role
 
-  // Get child accounts recursively
+  
   let accessibleAccounts = []
   if (personData.account_id) {
-    const { data: childAccounts } = await ctx.db
-      .rpc('get_account_hierarchy', { 
-        parent_account_id: personData.account_id 
-      })
-    
-    accessibleAccounts = childAccounts || []
+    try {
+      const { data: childAccounts, error: hierarchyError } = await Promise.race([
+        ctx.db.rpc('get_account_hierarchy', {
+          parent_account_id: personData.account_id
+        }),
+        new Promise<never>((_resolve, reject) =>
+          setTimeout(() => reject(new Error('get_account_hierarchy timed out')), 5000)
+        )
+      ])
+
+      if (hierarchyError) {
+        console.warn('Backend: get_account_hierarchy error:', hierarchyError)
+      } else {
+        accessibleAccounts = childAccounts || []
+      }
+    } catch (e) {
+      console.warn('Backend: get_account_hierarchy failed or timed out:', e)
+    }
+
     console.log('Backend: Found', accessibleAccounts.length, 'accessible accounts')
   }
 
-  // Determine permissions from role - system_admin role has full permissions
+  
   let effectivePermissions = []
   const roleSlug = role?.slug
   
@@ -144,8 +139,7 @@ export const context = createHandler(async (ctx, _body) => {
     permissionsCount: effectivePermissions.length
   })
 
-  // Return complete user context
-  // Note: system_admin status is determined by 'system_admin' in roles array
+  
   return {
     id: personData.id,
     email: personData.email,
@@ -159,15 +153,21 @@ export const context = createHandler(async (ctx, _body) => {
     accessible_accounts: accessibleAccounts
   }
 })
-
-/**
- * Lightweight health check for the auth function. Returns service name
- * and current timestamp. No authentication required.
- *
- * @returns `{ status: 'healthy', timestamp: string, service: 'auth' }`
- * @calledBy handler (HEALTH method)
- * @calledBy load balancer health probes
- */
+// CIL[END chunk_id="auth_context_1783969696"]
+// CIL[BEGIN chunk_id="auth_health_1783969696" type="function" identity="health" parent="none"]
+// CIL[DOC-MACRO purpose="Health check endpoint"]
+// CIL[DOC-RESPONSIBILITY responsibility="Return service health status"]
+// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="health_status" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Return simple health status with timestamp" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 1. Direct calls: 0. Related files: .framework/src/pages/admin/RolesPage.tsx, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 1. Total affected: 1."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const health = createHandler(async (ctx, _body) => {
   return {
     status: 'healthy',
@@ -175,15 +175,21 @@ export const health = createHandler(async (ctx, _body) => {
     service: 'auth'
   }
 })
-
-// ─── MAIN HANDLER ────────────────────────────────────────────────────────────
-
-/**
- * Netlify function entry point. Routes by HTTP method:
- * GET → context | HEALTH → health
- * @throws Error('Unsupported method: <method>') on unmatched method
- * @calledBy Netlify function routing
- */
+// CIL[END chunk_id="auth_health_1783969696"]
+// CIL[BEGIN chunk_id="auth_handler_1783969696" type="function" identity="handler" parent="none"]
+// CIL[DOC-MACRO purpose="Route auth HTTP methods"]
+// CIL[DOC-RESPONSIBILITY responsibility="Dispatch requests to auth operations"]
+// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\".framework/functions/_shared/principal.ts\",\"\\\"]"]
+// CIL[DOC-CONTRACT inputs="none" outputs="function_responses" errors="method_errors" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Route GET to context, HEALTH to health endpoint" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, \."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 export const handler = createHandler(async (ctx, _body) => {
   const method = ctx.query?.method || 'GET'
 
@@ -196,3 +202,4 @@ export const handler = createHandler(async (ctx, _body) => {
       throw new Error(`Unsupported method: ${method}`)
   }
 })
+// CIL[END chunk_id="auth_handler_1783969696"]