spine-framework 0.3.144 → 0.4.0

package/.framework/functions/auth.ts

@@ -1,3 +1,18 @@
+// CIL[BEGIN stable_id="~/.framework/functions/auth.ts:module_header:module_header" type="module_header" identity="module_header" parent="~/.framework/functions/auth.ts"]
+// CIL[DOC-MACRO purpose="Authentication edge functions for user context, health checks, and method dispatch"]
+// CIL[DOC-RESPONSIBILITY responsibility="Provides createHandler-based Netlify functions for /api/auth (context, health, handler)"]
+// CIL[DOC-CONTEXT module="auth" layer="edge" related_files=".framework/functions/_shared/middleware.ts"]
+// CIL[DOC-CONTRACT inputs="HTTP request via createHandler" outputs="JSON context, health, or dispatch response" errors="Error" side_effects="database reads"]
+// CIL[DOC-MICRO logic_summary="Exports context, health, and handler handlers for auth routes" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
+// CIL[DOC-AUDIENCE audience="api consumers, maintainers"]
+
+
+
+
+
+
 
 
 
@@ -11,38 +26,23 @@
 
 
 
-// CIL[BEGIN chunk_id="auth_moduleheader_1783969696" type="module_header" identity="imports" parent="none"]
-// CIL[DOC-MACRO purpose="Import middleware for auth module"]
-// CIL[DOC-RESPONSIBILITY responsibility="Import request handler creation utility"]
-// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\"custom/apps/cortex/pages/operations/OperationsDashboard.tsx\",\".framework/migrations/015_simplify_apps_table.sql\",\".framework/functions/_shared/principal.ts\",\".framework/src/pages/admin/TypeDetailPage.tsx\",\".framework/functions/_shared/schema-utils.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="imported_modules" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Import createHandler for auth function endpoints" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-AUDIENCE audience="developer"]
-// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: custom/apps/cortex/pages/operations/OperationsDashboard.tsx, .framework/migrations/015_simplify_apps_table.sql, .framework/functions/_shared/principal.ts, .framework/src/pages/admin/TypeDetailPage.tsx, .framework/functions/_shared/schema-utils.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
-// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
-// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
 
 import { createHandler } from './_shared/middleware'
-// CIL[END chunk_id="auth_moduleheader_1783969696"]
-// CIL[BEGIN chunk_id="auth_context_1783969696" type="function" identity="context" parent="none"]
-// CIL[DOC-MACRO purpose="Get authenticated user context"]
-// CIL[DOC-RESPONSIBILITY responsibility="Retrieve user profile, account, role, and permissions"]
-// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\".framework/src/pages/admin/RolesPage.tsx\",\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="user_context" errors="auth_errors,not_found" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Fetch user data with account hierarchy and effective permissions" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 6. Direct calls: 0. Related files: .framework/src/pages/admin/RolesPage.tsx, .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 6. Total affected: 21."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Authentication edge functions for user context, health checks, and method dispatch'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/auth.ts:module_header:module_header"]
+// CIL[BEGIN stable_id="~/.framework/functions/auth.ts:context:constant" type="constant" identity="context" parent="~/.framework/functions/auth.ts"]
+// CIL[DOC-MACRO purpose="Fetch authenticated user context with account, role, and permissions"]
+// CIL[DOC-RESPONSIBILITY responsibility="Validate principal, load person/account/role from DB, derive permissions, return normalized context object"]
+// CIL[DOC-CONTEXT module="auth" layer="edge" related_files=".framework/functions/_shared/middleware.ts,.framework/functions/auth.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, _body: unknown" outputs="User context object" errors="Error('Authentication required'), Error('User not found: ...')" side_effects="Supabase DB query for people, accounts, roles; get_account_hierarchy RPC"]
+// CIL[DOC-MICRO logic_summary="Require principal, fetch person with joins, normalize account and role, load account hierarchy, compute permissions based on role, return user context" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const context = createHandler(async (ctx, _body) => {
   
   if (!ctx.principal || ctx.principal.id === 'anonymous') {
@@ -70,7 +70,8 @@ export const context = createHandler(async (ctx, _body) => {
         id,
         slug,
         name,
-        is_system
+        is_system,
+        permissions
       )
     `)
     .eq('id', ctx.principal.id)
@@ -97,25 +98,36 @@ export const context = createHandler(async (ctx, _body) => {
   const role = Array.isArray(personData.role) ? personData.role[0] : personData.role
 
   
-  let accessibleAccounts = []
-  if (personData.account_id) {
+  let accessibleAccounts: any[] = []
+  if (personData.id) {
     try {
-      const { data: childAccounts, error: hierarchyError } = await Promise.race([
-        ctx.db.rpc('get_account_hierarchy', {
-          parent_account_id: personData.account_id
+      // get_accessible_accounts resolves the person's own account plus all
+      // descendants via account_paths (all accounts for system_admin).
+      const { data: accessibleIds, error: hierarchyError } = await Promise.race([
+        ctx.db.rpc('get_accessible_accounts', {
+          actor_id: personData.id
         }),
         new Promise<never>((_resolve, reject) =>
-          setTimeout(() => reject(new Error('get_account_hierarchy timed out')), 5000)
+          setTimeout(() => reject(new Error('get_accessible_accounts timed out')), 5000)
         )
       ])
 
       if (hierarchyError) {
-        console.warn('Backend: get_account_hierarchy error:', hierarchyError)
+        console.warn('Backend: get_accessible_accounts error:', hierarchyError)
       } else {
-        accessibleAccounts = childAccounts || []
+        const accountIds = (accessibleIds || [])
+          .map((r: any) => r.account_id ?? r)
+          .filter(Boolean)
+        if (accountIds.length) {
+          const { data: rows } = await ctx.db
+            .from('accounts')
+            .select('id, slug, display_name, parent_id')
+            .in('id', accountIds)
+          accessibleAccounts = rows || []
+        }
       }
     } catch (e) {
-      console.warn('Backend: get_account_hierarchy failed or timed out:', e)
+      console.warn('Backend: get_accessible_accounts failed or timed out:', e)
     }
 
     console.log('Backend: Found', accessibleAccounts.length, 'accessible accounts')
@@ -153,21 +165,21 @@ export const context = createHandler(async (ctx, _body) => {
     accessible_accounts: accessibleAccounts
   }
 })
-// CIL[END chunk_id="auth_context_1783969696"]
-// CIL[BEGIN chunk_id="auth_health_1783969696" type="function" identity="health" parent="none"]
-// CIL[DOC-MACRO purpose="Health check endpoint"]
-// CIL[DOC-RESPONSIBILITY responsibility="Return service health status"]
-// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\".framework/src/pages/admin/RolesPage.tsx\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="health_status" errors="none" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Return simple health status with timestamp" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 1. Direct calls: 0. Related files: .framework/src/pages/admin/RolesPage.tsx, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 1. Total affected: 1."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Fetch authenticated user context with account, role, and permissions'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/auth.ts:context:constant"]
+// CIL[BEGIN stable_id="~/.framework/functions/auth.ts:health:constant" type="constant" identity="health" parent="~/.framework/functions/auth.ts"]
+// CIL[DOC-MACRO purpose="Health check endpoint for auth service"]
+// CIL[DOC-RESPONSIBILITY responsibility="Return healthy status, timestamp, and service name"]
+// CIL[DOC-CONTEXT module="auth" layer="edge" related_files=".framework/functions/_shared/middleware.ts,.framework/functions/auth.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, _body: unknown" outputs="{ status, timestamp, service }" errors="none" side_effects="none"]
+// CIL[DOC-MICRO logic_summary="Return a static healthy payload with current timestamp" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const health = createHandler(async (ctx, _body) => {
   return {
     status: 'healthy',
@@ -175,21 +187,21 @@ export const health = createHandler(async (ctx, _body) => {
     service: 'auth'
   }
 })
-// CIL[END chunk_id="auth_health_1783969696"]
-// CIL[BEGIN chunk_id="auth_handler_1783969696" type="function" identity="handler" parent="none"]
-// CIL[DOC-MACRO purpose="Route auth HTTP methods"]
-// CIL[DOC-RESPONSIBILITY responsibility="Dispatch requests to auth operations"]
-// CIL[DOC-CONTEXT module="auth" layer="backend_functions" related_files="[\".framework/functions/_shared/principal.ts\",\"\\\"]"]
-// CIL[DOC-CONTRACT inputs="none" outputs="function_responses" errors="method_errors" side_effects="none"]
-// CIL[DOC-MICRO logic_summary="Route GET to context, HEALTH to health endpoint" notable_decisions="[]"]
-// CIL[DOC-CONFIDENCE pass="second" score="0.95" flags="none"]
-// CIL[DOC-STABILITY stability="stable"]
-// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, \."]
-// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
-// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
-// CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
+// CIL[DOC-VECTOR type="context" content="purpose='Health check endpoint for auth service'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/auth.ts:health:constant"]
+// CIL[BEGIN stable_id="~/.framework/functions/auth.ts:handler:constant" type="constant" identity="handler" parent="~/.framework/functions/auth.ts"]
+// CIL[DOC-MACRO purpose="Dispatch incoming auth requests by HTTP method"]
+// CIL[DOC-RESPONSIBILITY responsibility="Route GET to context and HEALTH to health, otherwise throw unsupported method"]
+// CIL[DOC-CONTEXT module="auth" layer="edge" related_files=".framework/functions/_shared/middleware.ts,.framework/functions/auth.ts"]
+// CIL[DOC-CONTRACT inputs="ctx: RequestContext, _body: unknown" outputs="Response from context or health handler" errors="Error('Unsupported method: ...')" side_effects="calls context or health handler"]
+// CIL[DOC-MICRO logic_summary="Read method from ctx.query, dispatch to context or health handler" notable_decisions="[]"]
+// CIL[DOC-CONFIDENCE pass="second" score="0.90" flags="none"]
+// CIL[DOC-STABILITY stability="stable"]
 export const handler = createHandler(async (ctx, _body) => {
   const method = ctx.query?.method || 'GET'
 
@@ -202,4 +214,10 @@ export const handler = createHandler(async (ctx, _body) => {
       throw new Error(`Unsupported method: ${method}`)
   }
 })
-// CIL[END chunk_id="auth_handler_1783969696"]
+// CIL[DOC-VECTOR type="context" content="purpose='Dispatch incoming auth requests by HTTP method'; No verified external callers; imports: .framework/functions/_shared/middleware.ts"]
+// CIL[DOC-VECTOR type="blast_radius" content="No direct caller data from CIL graph; local impact only"]
+// CIL[DOC-VECTOR type="configuration" content="No environment or build configuration dependencies identified"]
+// CIL[DOC-VECTOR type="constraint" content="Standard runtime; no special invariants documented"]
+// CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
+// CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
+// CIL[END stable_id="~/.framework/functions/auth.ts:handler:constant"]