webspresso 0.0.90 → 0.0.91

package/src/services/builtins/auth.js

@@ -0,0 +1,273 @@
+/**
+ * Built-in Auth Services
+ * @module src/services/builtins/auth
+ */
+
+const { z } = require('zod');
+const { hash, verify } = require('../../../core/auth/hash');
+const {
+  TOKEN_TYPES,
+  createKnexAuthTokensAdapter,
+  createAuthToken,
+  verifyAuthToken,
+  consumeAuthToken,
+} = require('../../../core/auth/tokens');
+const {
+  ValidationError,
+  UnauthorizedError,
+  NotFoundError,
+} = require('../../../core/errors');
+
+/**
+ * Create built-in auth services map
+ * @param {Object} [options]
+ * @param {string} [options.userModel='User'] - Name of user model
+ * @param {Object} [options.fields] - Field name mappings
+ * @returns {Record<string, Object>}
+ */
+function createAuthServices(options = {}) {
+  const userModel = options.userModel || 'User';
+  const fields = {
+    email: 'email',
+    password: 'password',
+    name: 'name',
+    role: 'role',
+    active: 'active',
+    emailVerifiedAt: 'email_verified_at',
+    ...(options.fields || {}),
+  };
+
+  return {
+    'auth.login': {
+      schema: z.object({
+        email: z.string().email(),
+        password: z.string().min(1),
+        remember: z.boolean().optional(),
+      }),
+      async handler(input, ctx) {
+        const { email, password, remember } = input;
+        const db = ctx.db;
+        if (!db) {
+          throw new Error('Database instance is required in context for auth.login');
+        }
+
+        const repo = db.getRepository(userModel);
+        const user = await repo.findOne({ [fields.email]: email });
+
+        if (!user) {
+          throw new UnauthorizedError('Invalid email or password');
+        }
+
+        if (user[fields.active] === false || user[fields.active] === 0) {
+          throw new UnauthorizedError('Account is deactivated');
+        }
+
+        const isValid = await verify(password, user[fields.password]);
+        if (!isValid) {
+          throw new UnauthorizedError('Invalid email or password');
+        }
+
+        // Exclude password from returned user object
+        const { [fields.password]: _, ...safeUser } = user;
+
+        // Attach to session if running inside HTTP request context
+        if (ctx.req && ctx.req.session) {
+          ctx.req.session.user = safeUser;
+          if (remember && ctx.req.session.cookie) {
+            // Extend session maxAge if remember is checked (30 days)
+            ctx.req.session.cookie.maxAge = 30 * 24 * 60 * 60 * 1000;
+          }
+        }
+
+        return { user: safeUser };
+      },
+    },
+
+    'auth.register': {
+      schema: z.object({
+        email: z.string().email(),
+        password: z.string().min(8, 'Password must be at least 8 characters long'),
+        name: z.string().optional(),
+        role: z.string().optional(),
+      }),
+      transaction: true,
+      async handler(input, ctx) {
+        const { email, password, name, role } = input;
+        const db = ctx.db;
+        const trx = ctx.trx;
+        if (!db) {
+          throw new Error('Database instance is required in context for auth.register');
+        }
+
+        const repo = db.getRepository(userModel);
+        const existing = await repo.findOne({ [fields.email]: email }, { trx });
+        if (existing) {
+          throw new ValidationError('Email is already registered', [
+            { field: 'email', message: 'Email is already registered' },
+          ]);
+        }
+
+        const hashedPassword = await hash(password);
+        const userData = {
+          [fields.email]: email,
+          [fields.password]: hashedPassword,
+        };
+
+        if (name !== undefined) userData[fields.name] = name;
+        if (role !== undefined) userData[fields.role] = role;
+
+        const user = await repo.create(userData, { trx });
+        const { [fields.password]: _, ...safeUser } = user;
+
+        return { user: safeUser };
+      },
+    },
+
+    'auth.request-password-reset': {
+      schema: z.object({
+        email: z.string().email(),
+        ttlMs: z.number().positive().default(60 * 60 * 1000), // Default 1 hour
+      }),
+      async handler(input, ctx) {
+        const { email, ttlMs } = input;
+        const db = ctx.db;
+        if (!db) {
+          throw new Error('Database instance is required in context for auth.request-password-reset');
+        }
+
+        const repo = db.getRepository(userModel);
+        const user = await repo.findOne({ [fields.email]: email });
+
+        // Safe timing-attack resistant behavior: do not leak if account exists
+        if (!user) {
+          return { sent: true, userId: null, rawToken: null };
+        }
+
+        const adapter = createKnexAuthTokensAdapter(db.knex || db);
+        const { rawToken, expiresAt } = await createAuthToken(
+          adapter,
+          TOKEN_TYPES.PASSWORD_RESET,
+          user.id,
+          ttlMs
+        );
+
+        return {
+          sent: true,
+          userId: user.id,
+          rawToken,
+          expiresAt,
+        };
+      },
+    },
+
+    'auth.reset-password': {
+      schema: z.object({
+        token: z.string().min(1, 'Reset token is required'),
+        password: z.string().min(8, 'Password must be at least 8 characters long'),
+      }),
+      transaction: true,
+      async handler(input, ctx) {
+        const { token, password } = input;
+        const db = ctx.db;
+        const trx = ctx.trx;
+        if (!db) {
+          throw new Error('Database instance is required in context for auth.reset-password');
+        }
+
+        const adapter = createKnexAuthTokensAdapter(trx || db.knex || db);
+        const verified = await verifyAuthToken(adapter, TOKEN_TYPES.PASSWORD_RESET, token);
+
+        if (!verified) {
+          throw new ValidationError('Invalid or expired password reset token', [
+            { field: 'token', message: 'Token is invalid or has expired' },
+          ]);
+        }
+
+        const hashedPassword = await hash(password);
+        const repo = db.getRepository(userModel);
+        await repo.update(verified.userId, { [fields.password]: hashedPassword }, { trx });
+
+        await consumeAuthToken(adapter, verified.tokenHash);
+
+        return { success: true, userId: verified.userId };
+      },
+    },
+
+    'auth.change-password': {
+      schema: z.object({
+        currentPassword: z.string().min(1, 'Current password is required'),
+        newPassword: z.string().min(8, 'New password must be at least 8 characters long'),
+      }),
+      auth: true, // Requires user in context
+      transaction: true,
+      async handler(input, ctx) {
+        const { currentPassword, newPassword } = input;
+        const db = ctx.db;
+        const trx = ctx.trx;
+        const currentUser = ctx.user || (ctx.auth && ctx.auth.user) || (ctx.req && ctx.req.session && ctx.req.session.user);
+
+        if (!currentUser || !currentUser.id) {
+          throw new UnauthorizedError('User authentication required');
+        }
+
+        const repo = db.getRepository(userModel);
+        const user = await repo.findById(currentUser.id, { trx });
+
+        if (!user) {
+          throw new NotFoundError('User not found');
+        }
+
+        const isCurrentValid = await verify(currentPassword, user[fields.password]);
+        if (!isCurrentValid) {
+          throw new ValidationError('Current password does not match', [
+            { field: 'currentPassword', message: 'Current password does not match' },
+          ]);
+        }
+
+        const hashedNewPassword = await hash(newPassword);
+        await repo.update(currentUser.id, { [fields.password]: hashedNewPassword }, { trx });
+
+        return { success: true };
+      },
+    },
+
+    'auth.verify-email': {
+      schema: z.object({
+        token: z.string().min(1, 'Verification token is required'),
+      }),
+      transaction: true,
+      async handler(input, ctx) {
+        const { token } = input;
+        const db = ctx.db;
+        const trx = ctx.trx;
+        if (!db) {
+          throw new Error('Database instance is required in context for auth.verify-email');
+        }
+
+        const adapter = createKnexAuthTokensAdapter(trx || db.knex || db);
+        const verified = await verifyAuthToken(adapter, TOKEN_TYPES.EMAIL_VERIFY, token);
+
+        if (!verified) {
+          throw new ValidationError('Invalid or expired verification token', [
+            { field: 'token', message: 'Verification token is invalid or has expired' },
+          ]);
+        }
+
+        const repo = db.getRepository(userModel);
+        await repo.update(
+          verified.userId,
+          { [fields.emailVerifiedAt]: new Date() },
+          { trx }
+        );
+
+        await consumeAuthToken(adapter, verified.tokenHash);
+
+        return { success: true, userId: verified.userId };
+      },
+    },
+  };
+}
+
+module.exports = {
+  createAuthServices,
+};

package/src/services/builtins/exchange.js

@@ -0,0 +1,229 @@
+/**
+ * Built-in Data Exchange & Spreadsheet Services
+ * @module src/services/builtins/exchange
+ */
+
+const { z } = require('zod');
+const { ValidationError, NotFoundError } = require('../../../core/errors');
+const { getModel } = require('../../../core/orm/model');
+const { buildXlsxBuffer } = require('../../../plugins/data-exchange/export-xlsx');
+const {
+  parseCsvToRows,
+  parseXlsxToRows,
+  buildPayloadForRow,
+  allowedImportColumns,
+} = require('../../../plugins/data-exchange/import');
+const { buildHeaderMapping, dataRowsToObjects } = require('../../../plugins/data-exchange/parse-table');
+
+/**
+ * Convert base64 data to Buffer
+ * @param {string} base64Str
+ * @returns {Buffer}
+ */
+function parseBase64Buffer(base64Str) {
+  const match = base64Str.match(/^data:([^;]+);base64,(.+)$/);
+  if (match) {
+    return Buffer.from(match[2], 'base64');
+  }
+  return Buffer.from(base64Str, 'base64');
+}
+
+/**
+ * Create built-in exchange services map
+ * @param {Object} [options]
+ * @param {Object} [options.db]
+ * @returns {Record<string, Object>}
+ */
+function createExchangeServices(options = {}) {
+  const db = options.db || null;
+
+  return {
+    'exchange.export': {
+      schema: z.object({
+        model: z.string().min(1, 'Model name is required'),
+        ids: z.array(z.union([z.string(), z.number()])).optional(),
+        where: z.record(z.any()).optional(),
+        limit: z.number().int().positive().default(10000),
+      }),
+      auth: 'admin',
+      async handler(input, ctx) {
+        const { model: modelName, ids, where, limit } = input;
+        const activeDb = ctx.db || db;
+        if (!activeDb) {
+          throw new Error('Database instance is required in context for exchange.export');
+        }
+
+        const model = activeDb.getModel ? activeDb.getModel(modelName) : getModel(modelName);
+        if (!model) {
+          throw new NotFoundError(`Model "${modelName}" not found`);
+        }
+
+        const repo = activeDb.getRepository(modelName);
+        let records = [];
+
+        if (ids && ids.length > 0) {
+          records = await repo.query().whereIn(model.primaryKey, ids).limit(limit).list();
+        } else if (where && Object.keys(where).length > 0) {
+          records = await repo.findAll(where, { limit });
+        } else {
+          records = await repo.query().limit(limit).list();
+        }
+
+        const buffer = await buildXlsxBuffer(model, records);
+        const safeName = String(model.name).replace(/[^\w.-]+/g, '_');
+
+        return {
+          buffer,
+          filename: `${safeName}_export.xlsx`,
+          rowCount: records.length,
+          model: modelName,
+        };
+      },
+    },
+
+    'exchange.import': {
+      schema: z.object({
+        model: z.string().min(1, 'Model name is required'),
+        buffer: z.any().optional(),
+        base64: z.string().optional(),
+        csvText: z.string().optional(),
+        mode: z.enum(['insert', 'upsert']).default('insert'),
+        upsertKey: z.string().optional(),
+      }),
+      auth: 'admin',
+      transaction: true,
+      async handler(input, ctx) {
+        const { model: modelName, buffer: rawBuffer, base64, csvText, mode, upsertKey: userUpsertKey } = input;
+        const activeDb = ctx.db || db;
+        const trx = ctx.trx;
+        if (!activeDb) {
+          throw new Error('Database instance is required in context for exchange.import');
+        }
+
+        const model = activeDb.getModel ? activeDb.getModel(modelName) : getModel(modelName);
+        if (!model) {
+          throw new NotFoundError(`Model "${modelName}" not found`);
+        }
+
+        let buffer;
+        let isCsv = false;
+
+        if (csvText) {
+          buffer = Buffer.from(csvText, 'utf8');
+          isCsv = true;
+        } else if (rawBuffer) {
+          buffer = Buffer.isBuffer(rawBuffer) ? rawBuffer : Buffer.from(rawBuffer);
+        } else if (base64) {
+          buffer = parseBase64Buffer(base64);
+        }
+
+        if (!buffer || buffer.length === 0) {
+          throw new ValidationError('Missing spreadsheet file content (buffer, base64, or csvText)', [
+            { field: 'buffer', message: 'Spreadsheet content is required' },
+          ]);
+        }
+
+        let rows = [];
+        if (isCsv) {
+          rows = parseCsvToRows(buffer);
+        } else {
+          try {
+            rows = await parseXlsxToRows(buffer);
+          } catch (err) {
+            // Fallback to CSV parsing
+            try {
+              rows = parseCsvToRows(buffer);
+            } catch (csvErr) {
+              throw new ValidationError(`Invalid spreadsheet format: ${err.message}`, [
+                { field: 'buffer', message: 'Could not parse Excel or CSV file' },
+              ]);
+            }
+          }
+        }
+
+        if (rows.length < 2) {
+          throw new ValidationError('File must include a header row and at least one data row', [
+            { field: 'buffer', message: 'File is empty or missing data rows' },
+          ]);
+        }
+
+        const isColumnAllowed = (col) => {
+          if (model.columns && typeof model.columns.has === 'function' && model.columns.has(col)) return true;
+          if (model.schema && model.schema.shape && col in model.schema.shape) return true;
+          return false;
+        };
+
+        let upsertKey = String(userUpsertKey || model.primaryKey);
+        if (!isColumnAllowed(upsertKey)) {
+          throw new ValidationError(`upsertKey "${upsertKey}" is not a column on model ${modelName}`);
+        }
+
+        const allowedKeys = model.columns && model.columns.size
+          ? allowedImportColumns(model)
+          : Object.keys(model.schema?.shape || {}).filter(c => !model.hidden?.includes(c));
+        const headerMapping = buildHeaderMapping(rows[0], allowedKeys);
+        const objects = dataRowsToObjects(rows, headerMapping);
+
+        const repo = activeDb.getRepository(modelName);
+        const summary = {
+          success: true,
+          created: 0,
+          updated: 0,
+          failed: 0,
+          totalRows: objects.length,
+          errors: [],
+        };
+
+        for (const item of objects) {
+          const { rowNumber, data } = item;
+          let payload;
+          try {
+            payload = buildPayloadForRow(model, data, mode);
+          } catch (e) {
+            summary.failed++;
+            summary.errors.push({ row: rowNumber, message: e.message || String(e) });
+            continue;
+          }
+
+          try {
+            if (mode === 'insert') {
+              await repo.create(payload, { trx });
+              summary.created++;
+              continue;
+            }
+
+            // Upsert mode
+            const keyVal = payload[upsertKey];
+            if (keyVal === undefined || keyVal === null || keyVal === '') {
+              const insertPayload = { ...payload };
+              delete insertPayload[upsertKey];
+              await repo.create(insertPayload, { trx });
+              summary.created++;
+              continue;
+            }
+
+            const existing = await repo.findOne({ [upsertKey]: keyVal }, { trx });
+            if (existing) {
+              const id = existing[model.primaryKey];
+              await repo.update(id, payload, { trx });
+              summary.updated++;
+            } else {
+              await repo.create({ ...payload, [upsertKey]: keyVal }, { trx });
+              summary.created++;
+            }
+          } catch (e) {
+            summary.failed++;
+            summary.errors.push({ row: rowNumber, message: e.message || String(e) });
+          }
+        }
+
+        summary.success = summary.failed === 0;
+        return summary;
+      },
+    },
+  };
+}
+
+module.exports = {
+  createExchangeServices,
+};

package/src/services/builtins/mail.js

@@ -0,0 +1,134 @@
+/**
+ * Built-in Mail & Notification Services
+ * @module src/services/builtins/mail
+ */
+
+const { z } = require('zod');
+const { ValidationError, NotFoundError } = require('../../../core/errors');
+
+/**
+ * Create built-in mail services map
+ * @param {Object} options
+ * @param {Object} options.emailService - Instance created by createEmailService
+ * @param {Object} [options.registry] - TemplateRegistry instance
+ * @param {Object} [options.db] - Database or knex instance
+ * @param {string} [options.tableName='email_logs']
+ * @returns {Record<string, Object>}
+ */
+function createMailServices(options = {}) {
+  const { emailService, registry, db, tableName = 'email_logs' } = options;
+
+  if (!emailService) {
+    throw new Error('emailService instance is required for createMailServices');
+  }
+
+  const emailSchema = z.string().email();
+  const recipientSchema = z.union([emailSchema, z.array(emailSchema)]);
+
+  return {
+    'mail.send': {
+      schema: z.object({
+        to: recipientSchema,
+        subject: z.string().min(1, 'Subject is required'),
+        from: z.string().optional(),
+        replyTo: z.string().optional(),
+        cc: z.union([z.string(), z.array(z.string())]).optional(),
+        bcc: z.union([z.string(), z.array(z.string())]).optional(),
+        template: z.string().optional(),
+        mjml: z.string().optional(),
+        html: z.string().optional(),
+        text: z.string().optional(),
+        data: z.record(z.any()).optional().default({}),
+        attachments: z.array(z.any()).optional(),
+      }),
+      async handler(input, ctx) {
+        try {
+          const result = await emailService.send(input);
+          return {
+            success: true,
+            messageId: result.messageId,
+            to: input.to,
+            subject: input.subject,
+          };
+        } catch (err) {
+          throw new Error(`Failed to send email: ${err.message}`);
+        }
+      },
+    },
+
+    'mail.send-templated': {
+      schema: z.object({
+        template: z.string().min(1, 'Template ID is required'),
+        to: recipientSchema,
+        subject: z.string().min(1, 'Subject is required'),
+        data: z.record(z.any()).optional().default({}),
+        from: z.string().optional(),
+        replyTo: z.string().optional(),
+        attachments: z.array(z.any()).optional(),
+      }),
+      async handler(input, ctx) {
+        const { template, ...rest } = input;
+        try {
+          const result = await emailService.send({
+            template,
+            ...rest,
+          });
+          return {
+            success: true,
+            messageId: result.messageId,
+            template,
+            to: input.to,
+          };
+        } catch (err) {
+          throw new Error(`Failed to send templated email: ${err.message}`);
+        }
+      },
+    },
+
+    'mail.preview': {
+      schema: z.object({
+        template: z.string().optional(),
+        mjml: z.string().optional(),
+        data: z.record(z.any()).optional().default({}),
+      }),
+      async handler(input, ctx) {
+        const { template, mjml, data } = input;
+        if (!template && !mjml) {
+          throw new ValidationError('Either template or mjml must be provided for preview', [
+            { field: 'template', message: 'Either template or mjml must be provided' },
+          ]);
+        }
+
+        const previewOpts = template ? template : { mjml };
+        const rendered = await emailService.preview(previewOpts, data);
+        return {
+          html: rendered.html,
+          text: rendered.text,
+          errors: rendered.errors || [],
+        };
+      },
+    },
+
+    'mail.query-logs': {
+      schema: z.object({
+        limit: z.number().int().positive().default(50),
+        offset: z.number().int().nonnegative().default(0),
+        status: z.enum(['sent', 'error']).optional(),
+        to: z.string().optional(),
+        template: z.string().optional(),
+      }),
+      auth: 'admin',
+      async handler(input, ctx) {
+        if (!emailService.queryLogs) {
+          return { logs: [], total: 0 };
+        }
+        const logs = await emailService.queryLogs(input);
+        return { logs, total: logs.length };
+      },
+    },
+  };
+}
+
+module.exports = {
+  createMailServices,
+};