spine-framework 0.3.56 → 0.3.57

package/.framework/functions/_shared/index.ts

@@ -76,7 +76,7 @@ export type { RequestContext, HandlerFunction, HandlerResult } from './middlewar
  * createHandler — wraps a handler function with auth, principal resolution, and audit.
  * Use this when writing Netlify function handlers.
  */
-export { createHandler, requireUserContext, requireSystemContextWithAudit, json, error as errorResponse, cors } from './middleware'
+export { createHandler, createPublicHandler, requireUserContext, requireSystemContextWithAudit, json, error as errorResponse, cors } from './middleware'
 
 // ============================================
 // Identity — Principal model

package/.framework/functions/_shared/middleware.ts

@@ -274,6 +274,96 @@ export function createHandler(handler: HandlerFunction) {
   }
 }
 
+// ─── PUBLIC HANDLER FACTORY ────────────────────────────────────────────────────
+
+/**
+ * Wraps a handler function without requiring authentication.
+ * Used for public endpoints like check-first-user, check-domain, validate-token.
+ * 
+ * Similar to createHandler but allows anonymous principals.
+ */
+export function createPublicHandler(handler: HandlerFunction) {
+  return async (event: any, context: any) => {
+    // Detect nested call: if event is already a RequestContext with a principal,
+    // skip event parsing and call the raw handler directly
+    if (event && event.requestId && event.principal) {
+      return handler(event, context)
+    }
+
+    const requestId = crypto.randomUUID()
+    const startTime = Date.now()
+    
+    try {
+      // Parse headers
+      const appId = event.headers?.['x-app-id'] || event.headers?.['X-App-Id']
+      
+      // Parse query string parameters
+      const queryParams: Record<string, string> = {}
+      if (event.queryStringParameters) {
+        Object.assign(queryParams, event.queryStringParameters)
+      }
+      if (!queryParams.method && event.httpMethod) {
+        queryParams.method = event.httpMethod
+      }
+
+      // Resolve principal - may be anonymous for public endpoints
+      const principal = await resolvePrincipal(event)
+      
+      // Get RLS-scoped database client based on principal type
+      // For anonymous users, this returns adminDb (service role)
+      const ctxDb = getPrincipalDb(principal)
+      
+      // Build request context
+      const ctx: RequestContext = {
+        requestId,
+        principal,
+        db: ctxDb,
+        accountId: principal?.accountId || null,
+        appId: appId || null,
+        query: queryParams,
+        requestPath: event.path || '/',
+      }
+      
+      // Parse body
+      let body = null
+      if (event.body) {
+        try {
+          body = JSON.parse(event.body)
+        } catch (e) {
+          return error('Invalid JSON in request body', 400)
+        }
+      }
+      if (ctx.query.id) {
+        if (!body || typeof body !== 'object' || Array.isArray(body)) {
+          body = {}
+        }
+        if (!('id' in body)) {
+          body.id = ctx.query.id
+        }
+      }
+      
+      // Execute handler
+      const result = await handler(ctx, body)
+      const durationMs = Date.now() - startTime
+      
+      // Return success response
+      return json({
+        data: result,
+        error: null,
+        meta: {
+          requestId,
+          duration: durationMs
+        }
+      })
+      
+    } catch (err: any) {
+      console.error(`[${requestId}] Public handler error:`, err)
+      const status = typeof err.statusCode === 'number' ? err.statusCode : 500
+      return error(err.message || 'Internal server error', status)
+    }
+  }
+}
+
 // ─── RESPONSE HELPERS ────────────────────────────────────────────────────────
 
 /**

package/.framework/functions/invites.ts

@@ -52,7 +52,7 @@
  * @seeAlso src/components/shared/InviteManager.tsx  (UI)
  */
 
-import { createHandler } from './_shared/middleware'
+import { createHandler, createPublicHandler } from './_shared/middleware'
 import { adminDb } from './_shared/db'
 import { emitLog } from './_shared/audit'
 
@@ -239,13 +239,14 @@ export const completeRegistration = createHandler(async (ctx, body) => {
       .single()
 
     // Resolve member_admin role (fall back to member if not seeded yet)
-    const { data: role } = await adminDb
+    const { data: roles } = await adminDb
       .from('roles')
       .select('id')
       .in('slug', ['member_admin', 'member'])
       .order('slug')   // member_admin sorts before member
       .limit(1)
-      .single()
+
+    const role = roles?.[0]
 
     // Create account
     const slug = generateAccountSlug(account_name)
@@ -285,11 +286,13 @@ export const completeRegistration = createHandler(async (ctx, body) => {
     if (!target_account_id) throw new Error('target_account_id is required for join_request')
 
     // Resolve member role
-    const { data: role } = await adminDb
+    const { data: roles } = await adminDb
       .from('roles')
       .select('id')
       .eq('slug', 'member')
-      .single()
+      .limit(1)
+
+    const role = roles?.[0]
 
     // Resolve type_id
     const { data: personType } = await adminDb
@@ -633,16 +636,16 @@ export const deny = createHandler(async (ctx, body) => {
 
 // ─── MAIN HANDLER ────────────────────────────────────────────────────────────
 
-export const handler = createHandler(async (ctx, body) => {
+export const handler = createPublicHandler(async (ctx, body) => {
   const action = ctx.query?.action
 
   switch (action) {
-    // Public
+    // Public endpoints (no auth required)
     case 'check-first-user':    return await checkFirstUser(ctx, body)
     case 'check-domain':        return await checkDomain(ctx, body)
     case 'validate-token':      return await validateToken(ctx, body)
     case 'complete-registration': return await completeRegistration(ctx, body)
-    // Protected
+    // Protected endpoints (require auth)
     case 'create-invite':       return await createInvite(ctx, body)
     case 'list-invites':        return await listInvites(ctx, body)
     case 'revoke-invite':       return await revokeInvite(ctx, body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.56",
+  "version": "0.3.57",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {