thatcher 1.0.4

package/src/lib/crud-factory.js

@@ -0,0 +1,83 @@
+/**
+ * CRUD Factory - Creates per-entity CRUD handler objects
+ * Adapted from moonlanding/src/lib/crud-factory.js
+ */
+
+import { createCrudHandlers as buildHandlers } from './crud-handlers.js';
+import { getConfigEngineSync } from './config-generator-engine.js';
+
+/**
+ * Create CRUD handlers for an entity
+ * @param {string} entityName
+ * @returns {object} Handler functions (GET, POST, PUT, PATCH, DELETE)
+ */
+export function createCrudHandlers(entityName) {
+  const configEngine = getConfigEngineSync();
+  const spec = configEngine.generateEntitySpec(entityName);
+
+  return {
+    GET: async (request, context) => {
+      // Handle list or single get based on presence of id
+      const { params } = context;
+      const id = params?.id;
+
+      if (id) {
+        return buildHandlers(spec).get(id, request, context);
+      } else {
+        return buildHandlers(spec).list(request, context);
+      }
+    },
+
+    POST: async (request, context) => {
+      return buildHandlers(spec).create(request, context);
+    },
+
+    PUT: async (request, context) => {
+      const { params } = context;
+      const id = params?.id;
+      if (!id) throw new Error('ID required for PUT');
+      return buildHandlers(spec).update(id, request, context);
+    },
+
+    PATCH: async (request, context) => {
+      const { params } = context;
+      const id = params?.id;
+      if (!id) throw new Error('ID required for PATCH');
+      return buildHandlers(spec).update(id, request, context);
+    },
+
+    DELETE: async (request, context) => {
+      const { params } = context;
+      const id = params?.id;
+      if (!id) throw new Error('ID required for DELETE');
+      return buildHandlers(spec).remove(id, request, context);
+    },
+  };
+}
+
+/**
+ * Create generic controller for an entity
+ * @param {string} entityName
+ * @returns {object}
+ */
+export function createEntityController(entityName) {
+  const configEngine = getConfigEngineSync();
+  const spec = configEngine.generateEntitySpec(entityName);
+  const handlers = buildHandlers(entityName, spec);
+
+  return {
+    list: handlers.list,
+    get: handlers.get,
+    create: handlers.create,
+    update: handlers.update,
+    delete: handlers.remove,
+
+    // Custom actions from config
+    async customAction(action, request, context) {
+      const { params } = context;
+      const id = params?.id;
+      const body = await request.json();
+      return handlers.customAction(action, id, body, context);
+    },
+  };
+}

package/src/lib/crud-handlers.js

@@ -0,0 +1,244 @@
+/**
+ * CRUD Handlers - HTTP handler implementations for entity operations
+ * This is where request/response handling, validation, auth, and business logic meet
+ */
+
+import { list, get, listWithPagination, searchWithPagination } from './query-engine.js';
+import { create, update, remove } from './query-engine-write.js';
+import { validateEntity, validateUpdate, sanitizeData } from './validate.js';
+import { requirePermission, getSessionToken } from './auth-middleware.js';
+import { executeHook } from './hook-engine.js';
+import { AppError, NotFoundError, ValidationError } from './error-handler.js';
+import { ok, created, paginated, noContent, error } from './response-formatter.js';
+import { HTTP } from '../config/constants.js';
+import { permissionService } from '../services/permission.service.js';
+import { parse as parseQuery } from './query-string-adapter.js';
+import { now } from './database-core.js';
+import { getConfigEngineSync } from './config-generator-engine.js';
+
+/**
+ * Build a complete set of CRUD handlers for an entity
+ * @param {object} spec - Entity specification
+ * @returns {object}
+ */
+export function createCrudHandlers(entityName, spec) {
+  if (!spec) {
+    spec = getConfigEngineSync().generateEntitySpec(entityName);
+  }
+
+  return {
+    /**
+     * List entities (GET /api/:entity)
+     */
+    list: async (req, context) => {
+      const { user } = context;
+      await requirePermission(user, spec, 'list');
+
+      const { q, page, pageSize, filters } = await parseQuery(req);
+      const config = getConfigEngineSync().getConfig();
+      const paginationCfg = config.system?.pagination || { default_page_size: 50, max_page_size: 500 };
+
+      const finalPage = page || 1;
+      if (!Number.isInteger(finalPage) || finalPage < 1) {
+        throw new AppError('page must be >= 1', 'BAD_REQUEST', HTTP.BAD_REQUEST);
+      }
+
+      const requestedPageSize = pageSize || paginationCfg.default_page_size;
+      if (!Number.isInteger(requestedPageSize) || requestedPageSize < 1) {
+        throw new AppError('pageSize must be >= 1', 'BAD_REQUEST', HTTP.BAD_REQUEST);
+      }
+
+      const finalPageSize = Math.min(requestedPageSize, paginationCfg.max_page_size || 500);
+
+      let items, pagination;
+
+      if (q) {
+        const result = await searchWithPagination(entityName, q, {}, finalPage, finalPageSize);
+        items = result.items;
+        pagination = result.pagination;
+      } else {
+        const coercedFilters = {};
+        if (filters) {
+          for (const [key, value] of Object.entries(filters)) {
+            const fd = spec.fields?.[key];
+            coercedFilters[key] = fd ? coerceFieldValue(value, fd.type) : value;
+          }
+        }
+        const result = await listWithPagination(entityName, coercedFilters, finalPage, finalPageSize);
+        items = result.items;
+        pagination = result.pagination;
+      }
+
+      const filtered = permissionService.filterRecords(user, spec, items);
+      const filteredItems = filtered.map(i => permissionService.filterFields(user, spec, i));
+
+      return paginated(filteredItems, pagination);
+    },
+
+    /**
+     * Get single entity (GET /api/:entity/:id)
+     */
+    get: async (id, req, context) => {
+      const { user } = context;
+      await requirePermission(user, spec, 'view');
+
+      if (!id) throw new AppError('ID required', 'BAD_REQUEST', HTTP.BAD_REQUEST);
+
+      const item = get(entityName, id);
+      if (!item) throw NotFoundError(entityName, id);
+
+      if (!permissionService.checkRowAccess(user, spec, item)) {
+        throw new AppError('Access denied', 'FORBIDDEN', HTTP.FORBIDDEN);
+      }
+
+      return ok(permissionService.filterFields(user, spec, item));
+    },
+
+    /**
+     * Create entity (POST /api/:entity)
+     */
+    create: async (req, context) => {
+      const { user } = context;
+      await requirePermission(user, spec, 'create');
+
+      const rawData = await req.json();
+      permissionService.enforceEditPermissions(user, spec, rawData);
+
+      const errors = await validateEntity(entityName, rawData);
+      if (Object.keys(errors).length > 0) {
+        throw new ValidationError('Validation failed', errors);
+      }
+
+      const sanitized = sanitizeData(entityName, rawData, spec);
+      const record = create(entityName, sanitized, user);
+
+      // Execute hooks
+      executeHook(`create:${entityName}:after`, {
+        entity: entityName,
+        id: record.id,
+        data: record,
+        user,
+      }).catch(console.error);
+
+      return created(permissionService.filterFields(user, spec, record));
+    },
+
+    /**
+     * Update entity (PUT/PATCH /api/:entity/:id)
+     */
+    update: async (id, req, context) => {
+      const { user } = context;
+      await requirePermission(user, spec, 'edit');
+
+      if (!id) throw new AppError('ID required', 'BAD_REQUEST', HTTP.BAD_REQUEST);
+
+      const existing = get(entityName, id);
+      if (!existing) throw NotFoundError(entityName, id);
+
+      if (!permissionService.checkRowAccess(user, spec, existing)) {
+        throw new AppError('Access denied', 'FORBIDDEN', HTTP.FORBIDDEN);
+      }
+
+      const rawData = await req.json();
+      permissionService.enforceEditPermissions(user, spec, rawData);
+
+      const errors = await validateUpdate(entityName, rawData, existing);
+      if (Object.keys(errors).length > 0) {
+        throw new ValidationError('Validation failed', errors);
+      }
+
+      const sanitized = sanitizeData(entityName, rawData, spec, existing);
+      const record = update(entityName, id, sanitized, user);
+
+      executeHook(`update:${entityName}:after`, {
+        entity: entityName,
+        id,
+        data: record,
+        before: existing,
+        after: record,
+        user,
+      }).catch(console.error);
+
+      return ok(permissionService.filterFields(user, spec, record));
+    },
+
+    /**
+     * Delete entity (DELETE /api/:entity/:id)
+     */
+    remove: async (id, req, context) => {
+      const { user } = context;
+      await requirePermission(user, spec, 'delete');
+
+      if (!id) throw new AppError('ID required', 'BAD_REQUEST', HTTP.BAD_REQUEST);
+
+      const existing = get(entityName, id);
+      if (!existing) throw NotFoundError(entityName, id);
+
+      if (!permissionService.checkRowAccess(user, spec, existing)) {
+        throw new AppError('Access denied', 'FORBIDDEN', HTTP.FORBIDDEN);
+      }
+
+      const result = remove(entityName, id);
+
+      executeHook(`delete:${entityName}:after`, {
+        entity: entityName,
+        id,
+        data: result,
+        user,
+      }).catch(console.error);
+
+      return noContent();
+    },
+
+    /**
+     * Custom action handler
+     */
+    customAction: async (action, id, data, context) => {
+      const { user } = context;
+      await requirePermission(user, spec, 'edit'); // Simplified permission check
+
+      const record = get(entityName, id);
+      if (!record) throw NotFoundError(entityName, id);
+
+      // Custom action logic (upload, manage_flags, etc.)
+      if (action === 'upload_files') {
+        const files = Array.isArray(data.files) ? data.files : [data.files];
+        executeHook(`upload_files:${entityName}:after`, {
+          entity: entityName,
+          id,
+          data: { id, uploaded_files: files },
+          user,
+        });
+        return ok({ id, uploaded_files: files });
+      }
+
+      // More actions can be added here
+      throw new AppError(`Unknown action: ${action}`, 'BAD_REQUEST', HTTP.BAD_REQUEST);
+    },
+  };
+}
+
+/**
+ * Coerce field value to correct type
+ * @param {any} value
+ * @param {string} type
+ * @returns {any}
+ */
+function coerceFieldValue(value, type) {
+  if (value === null || value === undefined) return value;
+
+  switch (type) {
+    case 'int':
+    case 'decimal':
+      return Number(value);
+    case 'bool':
+      return Boolean(value);
+    case 'json':
+      return typeof value === 'string' ? JSON.parse(value) : value;
+    case 'date':
+    case 'timestamp':
+      return Number(value);
+    default:
+      return String(value);
+  }
+}

package/src/lib/csrf-protection.js

@@ -0,0 +1,63 @@
+import crypto from 'crypto';
+import { HTTP } from '@/config/constants';
+
+const tokens = new Map();
+const TOKEN_TTL = 3600000;
+
+function cleanExpiredTokens() {
+  const now = Date.now();
+  for (const [token, data] of tokens.entries()) {
+    if (now - data.createdAt > TOKEN_TTL) {
+      tokens.delete(token);
+    }
+  }
+}
+
+export function generateToken() {
+  const token = crypto.randomBytes(32).toString('hex');
+  tokens.set(token, { createdAt: Date.now() });
+  if (tokens.size > 10000) cleanExpiredTokens();
+  return token;
+}
+
+export function validateToken(token) {
+  if (!token || typeof token !== 'string') return false;
+  const data = tokens.get(token);
+  if (!data) return false;
+  if (Date.now() - data.createdAt > TOKEN_TTL) {
+    tokens.delete(token);
+    return false;
+  }
+  tokens.delete(token);
+  return true;
+}
+
+export async function withCsrfValidation(handler) {
+  return async (request, context) => {
+    const method = request.method?.toUpperCase();
+    if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+      return handler(request, context);
+    }
+
+    try {
+      const contentType = request.headers.get('content-type') || '';
+      const token = request.headers.get('x-csrf-token');
+
+      if (!token || !validateToken(token)) {
+        console.warn(`[CSRF] Invalid token for ${method}`);
+        return new Response(JSON.stringify({ error: 'Invalid CSRF token' }), {
+          status: HTTP.FORBIDDEN,
+          headers: { 'Content-Type': 'application/json' },
+        });
+      }
+    } catch (e) {
+      console.error('[CSRF] Validation error:', e.message);
+      return new Response(JSON.stringify({ error: 'CSRF validation failed' }), {
+        status: HTTP.BAD_REQUEST,
+        headers: { 'Content-Type': 'application/json' },
+      });
+    }
+
+    return handler(request, context);
+  };
+}

package/src/lib/database-core.js

@@ -0,0 +1,258 @@
+/**
+ * Database Core - SQLite initialization and schema management
+ * Adapted from moonlanding/src/lib/database-core.js
+ */
+
+import Database from 'better-sqlite3';
+import fs from 'fs';
+import path from 'path';
+
+const SQL_TYPES = {
+  id: 'TEXT PRIMARY KEY',
+  text: 'TEXT',
+  textarea: 'TEXT',
+  email: 'TEXT',
+  int: 'INTEGER',
+  decimal: 'REAL',
+  bool: 'INTEGER',
+  date: 'INTEGER',
+  timestamp: 'INTEGER',
+  json: 'TEXT',
+  image: 'TEXT',
+  ref: 'TEXT',
+  enum: 'TEXT',
+};
+
+let db = null;
+let migrationComplete = false;
+const moduleCache = new Map();
+
+/**
+ * Get or create database instance
+ * @param {string} dbPath - Path to SQLite database file
+ * @returns {Database} better-sqlite3 database instance
+ */
+export function getDatabase(dbPath = null) {
+  if (db && !dbPath) return db;
+
+  const DB_PATH = dbPath || path.resolve(process.cwd(), 'data', 'app.db');
+  const dataDir = path.dirname(DB_PATH);
+
+  if (!fs.existsSync(dataDir)) {
+    fs.mkdirSync(dataDir, { recursive: true });
+  }
+
+  db = new Database(DB_PATH);
+  db.pragma('journal_mode = WAL');
+  const BUSY_TIMEOUT_MS = process.env.DATABASE_BUSY_TIMEOUT_MS || '5000';
+  db.pragma(`busy_timeout = ${BUSY_TIMEOUT_MS}`);
+  db.pragma('synchronous = NORMAL');
+  db.pragma('foreign_keys = ON');
+  db.pragma('auto_vacuum = INCREMENTAL');
+
+  return db;
+}
+
+/**
+ * Generate unique ID using nanoid-like algorithm
+ * @returns {string}
+ */
+export function genId() {
+  // Simple but effective ID generation
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+
+/**
+ * Get current Unix timestamp (seconds)
+ * @returns {number}
+ */
+export function now() {
+  return Math.floor(Date.now() / 1000);
+}
+
+/**
+ * Build column definition from field spec
+ * @param {string} key - Field name
+ * @param {object} field - Field definition
+ * @returns {string} SQL column definition
+ */
+function buildColumnDef(key, field) {
+  let col = `"${key}" ${SQL_TYPES[field.type] || 'TEXT'}`;
+
+  if (field.required && field.type !== 'id') {
+    col += ' NOT NULL';
+  }
+
+  if (field.unique) {
+    col += ' UNIQUE';
+  }
+
+  if (field.default !== undefined) {
+    if (typeof field.default === 'string' || typeof field.default === 'number' || typeof field.default === 'boolean') {
+      const defaultVal = typeof field.default === 'string'
+        ? `'${field.default.replace(/'/g, "''")}'`
+        : field.default;
+      col += ` DEFAULT ${defaultVal}`;
+    }
+  }
+
+  return col;
+}
+
+/**
+ * Run migrations to create/update tables from entity specs
+ * @param {object} configEngine - Config engine with entity specs
+ */
+export function migrate(configEngine) {
+  if (migrationComplete) return;
+
+  const dbInstance = getDatabase();
+  let specsToUse = {};
+
+  try {
+    const allEntities = configEngine.getAllEntities();
+    for (const entityName of allEntities) {
+      specsToUse[entityName] = configEngine.generateEntitySpec(entityName);
+    }
+  } catch (e) {
+    console.error('[Database] Failed to get specs from ConfigEngine during migration:', e.message);
+    return;
+  }
+
+  // Create tables
+  for (const spec of Object.values(specsToUse)) {
+    if (!spec) continue;
+
+    const tableName = spec.name === 'user' ? 'users' : spec.name;
+    const columns = [];
+    const foreignKeys = [];
+
+    // Build columns from fields
+    for (const [key, field] of Object.entries(spec.fields || {})) {
+      columns.push(buildColumnDef(key, field));
+
+      if (field.type === 'ref' && field.ref) {
+        const refTable = field.ref === 'user' ? 'users' : field.ref;
+        foreignKeys.push(`FOREIGN KEY ("${key}") REFERENCES "${refTable}"(id)`);
+      }
+    }
+
+    const fkPart = foreignKeys.length ? (',\n' + foreignKeys.join(',\n')) : '';
+    const sql = `CREATE TABLE IF NOT EXISTS "${tableName}" (${columns.join(',\n')}${fkPart})`;
+
+    try {
+      dbInstance.exec(sql);
+    } catch (e) {
+      console.error(`[Database] Table creation failed for ${tableName}:`, e.message, '\nSQL:', sql);
+      throw e;
+    }
+
+    // Add new columns (ALTER TABLE for schema evolution)
+    try {
+      const existingCols = new Set(
+        dbInstance.prepare(`PRAGMA table_info("${tableName}")`).all().map(c => c.name)
+      );
+
+      for (const [key, field] of Object.entries(spec.fields || {})) {
+        if (!existingCols.has(key)) {
+          let colType = SQL_TYPES[field.type] || 'TEXT';
+          let alterSql = `ALTER TABLE "${tableName}" ADD COLUMN "${key}" ${colType}`;
+
+          if (field.default !== undefined && (typeof field.default === 'string' || typeof field.default === 'number' || typeof field.default === 'boolean')) {
+            const defaultVal = typeof field.default === 'string'
+              ? `'${field.default.replace(/'/g, "''")}'`
+              : field.default;
+            alterSql += ` DEFAULT ${defaultVal}`;
+          }
+
+          dbInstance.exec(alterSql);
+        }
+      }
+    } catch (e) {
+      console.error(`[Database] Column migration failed for ${tableName}:`, e.message);
+    }
+  }
+
+  // Create indexes
+  for (const spec of Object.values(specsToUse)) {
+    if (!spec) continue;
+
+    const tableName = spec.name === 'user' ? 'users' : spec.name;
+    const searchFields = [];
+
+    for (const [key, field] of Object.entries(spec.fields || {})) {
+      if (field.type === 'ref' || field.sortable || field.search) {
+        try {
+          dbInstance.exec(`CREATE INDEX IF NOT EXISTS idx_${tableName}_${key} ON "${tableName}"("${key}")`);
+        } catch (e) {
+          console.error(`[Database] Index creation failed for ${tableName}.${key}:`, e.message);
+        }
+      }
+
+      if (field.search || key === 'name' || key === 'description') {
+        searchFields.push(`"${key}"`);
+      }
+    }
+
+    // Create FTS virtual table for search
+    if (searchFields.length > 0) {
+      try {
+        dbInstance.exec(`CREATE VIRTUAL TABLE IF NOT EXISTS ${tableName}_fts USING fts5(${searchFields.join(', ')}, content="${tableName}", content_rowid=id)`);
+      } catch (e) {
+        console.error(`[Database] FTS table creation failed for ${tableName}:`, e.message);
+      }
+    }
+  }
+
+  // Run additional migrations
+  runCustomMigrations(dbInstance, specsToUse);
+
+  migrationComplete = true;
+}
+
+/**
+ * Run custom migration logic (triggers, data migrations, etc.)
+ * @param {Database} dbInstance
+ * @param {object} specs
+ */
+function runCustomMigrations(dbInstance, specs) {
+  // Placeholder for custom migration logic
+  // Can be extended via plugins
+  try {
+    // Create triggers for updated_at timestamps
+    for (const entityName of Object.keys(specs)) {
+      const tableName = entityName === 'user' ? 'users' : entityName;
+      // Add timestamp triggers if needed
+    }
+  } catch (e) {
+    console.error('[Database] Custom migrations failed:', e.message);
+  }
+}
+
+/**
+ * Ensure database is initialized (lazy migration)
+ */
+export function ensureInitialized(configEngine) {
+  if (!migrationComplete) {
+    migrate(configEngine);
+  }
+}
+
+/**
+ * Reset database (for testing)
+ */
+export function resetDatabase() {
+  const DB_PATH = path.resolve(process.cwd(), 'data', 'app.db');
+  try {
+    if (db) db.close();
+    if (fs.existsSync(DB_PATH)) fs.unlinkSync(DB_PATH);
+    if (fs.existsSync(DB_PATH + '-wal')) fs.unlinkSync(DB_PATH + '-wal');
+    if (fs.existsSync(DB_PATH + '-shm')) fs.unlinkSync(DB_PATH + '-shm');
+    db = null;
+    migrationComplete = false;
+  } catch (e) {
+    console.error('[Database] Reset failed:', e.message);
+  }
+}
+
+export { SQL_TYPES };