thatcher 1.0.4

package/src/config/env.js

@@ -0,0 +1,164 @@
+/**
+ * Environment configuration
+ * Provides typed access to environment variables with defaults
+ */
+
+/**
+ * Get environment variable with optional default
+ */
+function getEnv(key, defaultValue = null) {
+  const val = process.env[key];
+  if (val === undefined || val === null) return defaultValue;
+  return val;
+}
+
+/**
+ * Get boolean from env
+ */
+function getEnvBool(key, defaultValue = false) {
+  const val = getEnv(key);
+  if (val === null) return defaultValue;
+  return val === 'true' || val === '1';
+}
+
+/**
+ * Get number from env
+ */
+function getEnvInt(key, defaultValue = 0) {
+  const val = getEnv(key);
+  if (val === null) return defaultValue;
+  const num = parseInt(val, 10);
+  return isNaN(num) ? defaultValue : num;
+}
+
+/**
+ * Configuration object builder
+ */
+export function buildConfig(overrides = {}) {
+  const config = {
+    db: {
+      path: overrides.databasePath || getEnv('DATABASE_PATH', './data/app.db'),
+      ...overrides.db,
+    },
+
+    auth: {
+      google: {
+        clientId: getEnv('GOOGLE_CLIENT_ID'),
+        clientSecret: getEnv('GOOGLE_CLIENT_SECRET'),
+        redirectUri: getEnv('GOOGLE_REDIRECT_URI') || 'http://localhost:3000/api/auth/google/callback',
+        serviceAccountPath: getEnv('GOOGLE_SERVICE_ACCOUNT_PATH', './config/service-account.json'),
+        ...overrides.auth?.google,
+      },
+      session: {
+        secure: getEnv('NODE_ENV') === 'production',
+        expires: false,
+        cookieName: getEnv('SESSION_COOKIE_NAME', 'thatcher_session'),
+        maxAge: getEnvInt('SESSION_MAX_AGE', 60 * 60 * 24 * 30), // 30 days
+        ...overrides.auth?.session,
+      },
+      ...overrides.auth,
+    },
+
+    drive: {
+      serviceAccountPath: getEnv('GOOGLE_SERVICE_ACCOUNT_PATH', './config/service-account.json'),
+      rootFolderId: getEnv('GOOGLE_DRIVE_FOLDER_ID'),
+      cache: {
+        enabled: true,
+        ttl: 3600,
+        bucket: getEnv('CACHE_BUCKET', 'thatcher_cache'),
+        ...overrides.drive?.cache,
+      },
+      ...overrides.drive,
+    },
+
+    email: {
+      provider: getEnv('EMAIL_PROVIDER', 'nodemailer'),
+      from: getEnv('EMAIL_FROM', 'noreply@example.com'),
+      smtp: {
+        host: getEnv('EMAIL_HOST', 'smtp.gmail.com'),
+        port: getEnvInt('EMAIL_PORT', 587),
+        user: getEnv('EMAIL_USER'),
+        password: getEnv('EMAIL_PASSWORD'),
+        ...overrides.email?.smtp,
+      },
+      limits: {
+        daily: getEnvInt('EMAIL_DAILY_LIMIT', 500),
+        ratePerMinute: getEnvInt('EMAIL_RATE_PER_MINUTE', 10),
+        ...overrides.email?.limits,
+      },
+      ...overrides.email,
+    },
+
+    app: {
+      url: getEnv('APP_URL', 'http://localhost:3000'),
+      env: getEnv('NODE_ENV', 'development'),
+      debug: getEnvBool('DEBUG', false),
+      name: getEnv('APP_NAME', 'Thatcher App'),
+      ...overrides.app,
+    },
+
+    server: {
+      port: getEnvInt('PORT', 3000),
+      host: getEnv('HOST', '0.0.0.0'),
+      ...overrides.server,
+    },
+  };
+
+  return config;
+}
+
+/**
+ * Check if Google OAuth is configured
+ */
+export function hasGoogleAuth(config) {
+  const cfg = config?.auth?.google || buildConfig().auth.google;
+  return !!(cfg.clientId && cfg.clientSecret);
+}
+
+/**
+ * Check if Drive integration is configured
+ */
+export function hasDriveConfig(config) {
+  const cfg = config?.drive || buildConfig().drive;
+  return !!cfg.rootFolderId;
+}
+
+/**
+ * Check if email sending is configured
+ */
+export function hasEmailConfig(config) {
+  const cfg = config?.email || buildConfig().email;
+  return !!(cfg.smtp.user && cfg.smtp.password);
+}
+
+/**
+ * Validate environment configuration
+ * Returns array of warnings (non-fatal)
+ */
+export function validateEnv(config = buildConfig()) {
+  const warnings = [];
+
+  if (!getEnv('DATABASE_PATH')) {
+    warnings.push('DATABASE_PATH not set, using default ./data/app.db');
+  }
+
+  if (config.app.env === 'production') {
+    if (!config.email.smtp.user) warnings.push('EMAIL_USER not set - email sending disabled');
+    if (!config.email.smtp.password) warnings.push('EMAIL_PASSWORD not set - email sending disabled');
+    if (!config.app.url) warnings.push('APP_URL not set - links in emails will use localhost');
+  }
+
+  if (!hasGoogleAuth(config)) {
+    warnings.push('Google OAuth not configured - auth will be email/password only');
+  }
+
+  return warnings;
+}
+
+export default {
+  buildConfig,
+  hasGoogleAuth,
+  hasDriveConfig,
+  hasEmailConfig,
+  validateEnv,
+};

package/src/config/spec-helpers.js

@@ -0,0 +1,232 @@
+/**
+ * Spec Helpers - Utility functions for entity specifications
+ * Provides easy access to entity specs, navigation, and derived properties
+ */
+
+/**
+ * Get entity spec by name
+ * @param {string} name - Entity name
+ * @param {object} configEngine - Config engine instance
+ * @returns {object|null} Entity specification or null if not found
+ */
+export function getSpec(name, configEngine) {
+  try {
+    return configEngine.generateEntitySpec(name);
+  } catch (error) {
+    if (error.message.includes('not found') || error.message.includes('Unknown entity')) {
+      return null;
+    }
+    throw error;
+  }
+}
+
+/**
+ * Get all navigable entities (top-level, non-embedded)
+ * @param {object} configEngine
+ * @returns {Array} Sorted array of entity specs
+ */
+export function getNavItems(configEngine) {
+  try {
+    const allEntities = configEngine.getAllEntities();
+    return allEntities
+      .map(e => configEngine.generateEntitySpec(e))
+      .filter(s => !s.embedded && !s.parent && !s.system_entity)
+      .sort((a, b) => (a.order || 999) - (b.order || 999))
+      .map(s => ({
+        name: s.name,
+        label: s.labelPlural || s.label,
+        icon: s.icon,
+        href: `/${s.name}`,
+      }));
+  } catch (error) {
+    console.error('[spec-helpers] getNavItems error:', error.message);
+    return [];
+  }
+}
+
+/**
+ * Get child entity definitions for a parent spec
+ * @param {object} spec - Parent entity spec
+ * @returns {Array} Child entity configs
+ */
+export function getChildEntities(spec) {
+  if (!spec.children) return [];
+  return Object.entries(spec.children).map(([key, child]) => ({
+    key,
+    entity: child.entity,
+    label: child.label,
+    fk: child.fk,
+    filter: child.filter,
+    component: child.component,
+  }));
+}
+
+/**
+ * Get parent entity name
+ * @param {object} spec
+ * @returns {string|null}
+ */
+export function getParentEntity(spec) {
+  return spec.parent || null;
+}
+
+/**
+ * Get default sort configuration
+ * @param {object} spec
+ * @returns {{field: string, dir: string}}
+ */
+export function getDefaultSort(spec) {
+  return spec.list?.defaultSort || { field: 'created_at', dir: 'desc' };
+}
+
+/**
+ * Get available filters for entity
+ * @param {object} spec
+ * @returns {Array}
+ */
+export function getAvailableFilters(spec) {
+  return spec.list?.filters || [];
+}
+
+/**
+ * Get page size for entity
+ * @param {object} spec
+ * @returns {number}
+ */
+export function getPageSize(spec, systemPagination = { default_page_size: 20 }) {
+  return spec.list?.pageSize || systemPagination.default_page_size;
+}
+
+/**
+ * Get entity label (singular or plural)
+ * @param {object} spec
+ * @param {boolean} plural
+ * @returns {string}
+ */
+export function getEntityLabel(spec, plural = false) {
+  return plural ? (spec.labelPlural || spec.label) : spec.label;
+}
+
+/**
+ * Get default initial state for entity (empty record with defaults)
+ * @param {object} spec
+ * @returns {object}
+ */
+export function getInitialState(spec) {
+  const state = {};
+  for (const [key, field] of Object.entries(spec.fields)) {
+    if (field.type === 'id') continue;
+    if (field.default !== undefined) {
+      state[key] = field.default;
+    } else if (field.type === 'bool') {
+      state[key] = false;
+    } else if (field.type === 'int' || field.type === 'decimal') {
+      state[key] = 0;
+    } else if (field.type === 'json') {
+      state[key] = [];
+    } else if (field.type === 'date' || field.type === 'timestamp') {
+      state[key] = null;
+    } else {
+      state[key] = '';
+    }
+  }
+  return state;
+}
+
+/**
+ * Check if entity is embedded (used in parent contexts)
+ * @param {object} spec
+ * @returns {boolean}
+ */
+export function isEmbeddedEntity(spec) {
+  return spec.embedded === true;
+}
+
+/**
+ * Check if entity is a top-level parent
+ * @param {object} spec
+ * @returns {boolean}
+ */
+export function isParentEntity(spec) {
+  return !spec.embedded && !spec.parent;
+}
+
+/**
+ * Check if entity has child relationships
+ * @param {object} spec
+ * @returns {boolean}
+ */
+export function hasChildRelationships(spec) {
+  return !!spec.children && Object.keys(spec.children).length > 0;
+}
+
+/**
+ * Get entity options (enums, picklists)
+ * @param {object} spec
+ * @param {string} optionKey
+ * @returns {Array}
+ */
+export function getOptions(spec, optionKey) {
+  return spec.options?.[optionKey] || [];
+}
+
+/**
+ * Get display label for an option value
+ * @param {object} spec
+ * @param {string} optionKey
+ * @param {string} value
+ * @returns {string}
+ */
+export function getOptionLabel(spec, optionKey, value) {
+  const option = getOptions(spec, optionKey).find(o => o.value === value);
+  return option?.label || String(value);
+}
+
+/**
+ * Get color for an option value (for UI badges)
+ * @param {object} spec
+ * @param {string} optionKey
+ * @param {string} value
+ * @returns {string}
+ */
+export function getOptionColor(spec, optionKey, value) {
+  const option = getOptions(spec, optionKey).find(o => o.value === value);
+  return option?.color || 'gray';
+}
+
+/**
+ * Build navigation structure for menus
+ * @param {object} configEngine
+ * @param {object} user - Optional user for permission filtering
+ * @returns {Array} Navigation items
+ */
+export function buildNavigation(configEngine, user = null) {
+  try {
+    const allEntities = configEngine.getAllEntities();
+    const items = allEntities
+      .map(e => configEngine.generateEntitySpec(e))
+      .filter(s => !s.embedded && !s.parent && !s.system_entity)
+      .sort((a, b) => (a.order || 999) - (b.order || 999))
+      .map(s => ({
+        name: s.name,
+        label: s.labelPlural || s.label,
+        icon: s.icon,
+        href: `/${s.name}`,
+        badge: s.badge,
+      }));
+
+    // Filter by user permissions if provided
+    if (user && configEngine.getRolePermissions) {
+      return items.filter(item => {
+        const spec = configEngine.generateEntitySpec(item.name);
+        const perms = configEngine.getRolePermissions(user.role, item.name);
+        return perms.includes('list') || perms.includes('view') || perms.includes('all');
+      });
+    }
+
+    return items;
+  } catch (error) {
+    console.error('[spec-helpers] buildNavigation error:', error.message);
+    return [];
+  }
+}

package/src/engine.server.js

@@ -0,0 +1,212 @@
+/**
+ * Auth Engine - Lucia session management and Google OAuth
+ * Simplified extraction from moonlanding/src/engine.server.js
+ */
+
+import { Lucia } from 'lucia';
+import { BetterSqlite3Adapter } from '@lucia-auth/adapter-sqlite';
+import { Google } from 'arctic';
+import bcrypt from 'bcrypt';
+import { getDatabase } from './database-core.js';
+import { buildConfig, hasGoogleAuth } from '../config/env.js';
+
+let _lucia = null;
+let _google = null;
+let _adapter = null;
+
+/**
+ * Initialize auth engine with database and config
+ * @param {object} [config] - Optional config override
+ */
+export function initAuth(config = null) {
+  const cfg = config || buildConfig();
+  const db = getDatabase(cfg.db.path);
+
+  _adapter = new BetterSqlite3Adapter(db, { user: 'users', session: 'sessions' });
+
+  _lucia = new Lucia(_adapter, {
+    sessionCookie: {
+      expires: cfg.auth.session.expires,
+      attributes: {
+        secure: cfg.auth.session.secure,
+        httpOnly: true,
+        sameSite: 'lax',
+      },
+    },
+    getUserAttributes: (row) => ({
+      id: row.id,
+      email: row.email,
+      name: row.name,
+      avatar: row.avatar,
+      type: row.type,
+      role: row.role,
+    }),
+  });
+
+  if (hasGoogleAuth(cfg)) {
+    _google = new Google(
+      cfg.auth.google.clientId,
+      cfg.auth.google.clientSecret,
+      cfg.auth.google.redirectUri
+    );
+  }
+
+  return { lucia: _lucia, google: _google };
+}
+
+/**
+ * Get Lucia instance
+ * @returns {Lucia}
+ */
+export function getLucia() {
+  if (!_lucia) initAuth();
+  return _lucia;
+}
+
+/**
+ * Get Google OAuth client
+ * @returns {Google|null}
+ */
+export function getGoogle() {
+  if (!_google) initAuth();
+  return _google;
+}
+
+/**
+ * Parse cookies from header
+ * @param {string} cookieHeader
+ * @returns {object}
+ */
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  cookieHeader.split(';').forEach(cookie => {
+    const [name, value] = cookie.trim().split('=');
+    if (name && value) cookies[name] = decodeURIComponent(value);
+  });
+  return cookies;
+}
+
+let _currentRequest = null;
+
+/**
+ * Set current request context (for auth)
+ * @param {object} req
+ */
+export function setCurrentRequest(req) {
+  _currentRequest = req;
+}
+
+/**
+ * Get current user from session
+ * @returns {object|null}
+ */
+export async function getUser() {
+  try {
+    const request = _currentRequest;
+    if (!request) return null;
+
+    const lucia = getLucia();
+    const cookies = parseCookies(request.headers?.cookie || '');
+    const sessionId = cookies[lucia.sessionCookieName];
+    if (!sessionId) return null;
+
+    const { user, session } = await lucia.validateSession(sessionId);
+    if (!user || !session) return null;
+
+    return user;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Require user (throw if not authenticated)
+ * @returns {Promise<object>}
+ */
+export async function requireUser() {
+  const user = await getUser();
+  if (!user) throw new Error('Unauthorized');
+  return user;
+}
+
+/**
+ * Create a new session
+ * @param {string} userId
+ * @returns {{session: object, sessionCookie: object}}
+ */
+export async function createSession(userId) {
+  const lucia = getLucia();
+  // Note: cookies() requires Next.js polyfill in moonlanding; for SDK we return session data
+  const session = await lucia.createSession(userId, {});
+  const sessionCookie = lucia.createSessionCookie(session.id);
+  return { session, sessionCookie };
+}
+
+/**
+ * Invalidate current session
+ */
+export async function invalidateSession() {
+  const lucia = getLucia();
+  // Simplified - caller handles cookie clearing
+  // In full app this uses @lucia-auth/adapter-sqlite's cookie management
+}
+
+/**
+ * Hash password with bcrypt
+ * @param {string} password
+ * @returns {Promise<string>}
+ */
+export async function hashPassword(password) {
+  return bcrypt.hash(password, 12);
+}
+
+/**
+ * Verify password
+ * @param {string} password
+ * @param {string} hash
+ * @returns {Promise<boolean>}
+ */
+export async function verifyPassword(password, hash) {
+  return bcrypt.compare(password, hash);
+}
+
+/**
+ * Get user by email
+ * @param {string} email
+ * @returns {object|null}
+ */
+export function getUserByEmail(email) {
+  const db = getDatabase();
+  return db.prepare('SELECT * FROM users WHERE email = ?').get(email);
+}
+
+/**
+ * Create a new user
+ * @param {object} userData
+ * @returns {object}
+ */
+export async function createUser(userData) {
+  const hashedPassword = await hashPassword(userData.password);
+  const { create } = await import('./query-engine-write.js');
+  return create('user', {
+    ...userData,
+    password: hashedPassword,
+  }, { id: 'system' });
+}
+
+/**
+ * Authenticate user with credentials
+ * @param {string} email
+ * @param {string} password
+ * @returns {object|null} User if valid, null otherwise
+ */
+export async function authenticate(email, password) {
+  const user = getUserByEmail(email);
+  if (!user) return null;
+
+  const valid = await verifyPassword(password, user.password);
+  if (!valid) return null;
+
+  return user;
+}