index.js

/**
 * Simplex CRM Core Engine
 * 
 * Multi-tenant SaaS platform framework. Owns the application lifecycle
 * and provides the structural backbone — database, auth, permissions,
 * encryption, sessions, and communication. You plug in your domain
 * logic; the engine handles the infrastructure.
 * 
 * Quick start:
 *   import { bootstrap } from '@simplex/crm-core';
 * 
 *   const core = await bootstrap({
 *     database: { connectionString: process.env.DATABASE_URL },
 *     masterKey: process.env.MASTER_KEY,
 *     permissions: { nodes: { ... }, defaultRoles: { ... } },
 *     email: { host: '...', port: 587, user: '...', pass: '...', from: '...' },
 *   });
 * 
 * Or import modules individually:
 *   import { initDatabase, run, get, withTransaction } from '@simplex/crm-core/core/db';
 *   import { encrypt, decrypt } from '@simplex/crm-core/core/crypto';
 */

// Core
export { initDatabase, getPool, getCachePool, getAdmissionController, closeDatabase, testDbConnection } from './core/db.js';
export {
  run, get, all, exec, withTransaction,
  lockRow, lockRowNowait,
  acquireAdvisoryLock, tryAcquireAdvisoryLock, releaseAdvisoryLock,
  acquireTransactionLock, tryAcquireTransactionLock,
  withAdvisoryLock, withLockedTransaction,
  isResourceLocked, getHeldLocks, getLockResources,
  getOrgSchemaName, ensureOrgSchema,
  runWithSchema, getWithSchema, allWithSchema, withSchemaTransaction
} from './core/db.js';

export { encrypt, decrypt, getMasterKeyBuffer, validateMasterKey, setMasterKey } from './core/crypto.js';

export { runWithContext, getRequestContext, getCurrentTenantId } from './core/requestContext.js';

export {
  configure as configurePermissions,
  P, getPermissionNodes, getDefaultRoles,
  clearPermissionCache, getUserPermissions,
  hasPermission, hasAnyPermission, hasAllPermissions,
  isSuperAdmin, isSupportStaff, isOrgAdmin,
  requirePermission, requireAnyPermission, requireAllPermissions,
  requireSuperadmin, requireOrgAdmin
} from './core/permissions.js';

export {
  configureAuth, setAuthCache,
  createUser, verifyUser, changePassword,
  getUserByToken, invalidateTokenCache,
  resetPasswordToDefault,
  validatePassword, normalizeEmail
} from './core/userAuth.js';

export {
  initRoleManager, getOrgRoles, getOrgRole,
  getSystemRoles, createOrgRole, updateOrgRole, deleteOrgRole,
  roleHasPermission, invalidateOrgCache, shutdownRoleManager,
  doesRoleRequireMfa
} from './core/roleManager.js';

export {
  generateOrgKeyBase64, createOrganizationKey,
  getOrganizationKey, getOrganizationKeyVersion,
  rotateOrganizationKey, clearOrgKeyCache,
  encryptWithOrgKey, decryptWithOrgKey,
  encryptBinaryWithOrgKey, decryptBinaryWithOrgKey,
  encryptField, decryptField, encryptFields, decryptFields,
  checkKeyHealth, getKeyRotationHistory
} from './core/orgEncryption.js';

// Communication
export { initEmailService, sendEmail, registerTemplates, setOrgTransporterFactory } from './core/emailSender.js';
export { initSMSService, sendSMS, registerSmsTemplates } from './core/sms.js';
export { registerNotifier, registerNotifiers, notify, getRegisteredEvents } from './core/notifications.js';

// Middleware
export { requireAuth, requireRole } from './middleware/auth.js';
export {
  configureSessionMiddleware, sessionMiddleware,
  requireSession, enforceOrganization, requireOrganization,
  getOrganizationId, validateResourceOrg, getRLSContext
} from './middleware/session.js';
export {
  configureSensitiveDataMiddleware,
  requireEncryption, requireValidEncryption, auditSensitiveAccess,
  warnKeyRotation, blockPlaintextSensitive, stripSensitiveResponse,
  withEncryption, rateLimitSensitive
} from './middleware/sensitiveData.js';
export { configureQuotaMiddleware, checkStorageQuota, checkSeatQuota, addQuotaHeaders, enforceStorageLimit } from './middleware/quota.js';

// Services
export {
  get as cacheGet, set as cacheSet, del as cacheDel, delPattern as cacheDelPattern,
  getJSON, setJSON, getOrSet, userCache, orgCache, rolesCache, queryCache,
  rateLimit, cleanupExpired as cleanupCache, clearMemoryCache, initCache
} from './services/cache.js';

export {
  SESSION_POLICY, generateSessionId, generateSessionKey,
  hashValue, generateDeviceFingerprint,
  createSession, validateSession, revokeSession, revokeAllUserSessions,
  getUserSessions, cleanupExpiredSessions, extendSession,
  getOrganizationSessionPolicy, checkExistingSessions
} from './services/sessions.js';

export {
  createAdmissionController, FairAdmissionController, AdmissionTimeoutError
} from './services/admissionController.js';

// Utils
export { getClientIp } from './utils/ip.js';
export { getVersionInfo, setPackageDir } from './utils/version.js';

// Migration runner
export { runMigrations } from './migrate.js';

// ============================================================
// BOOTSTRAP — Convenience function to wire everything up
// ============================================================

import { initDatabase } from './core/db.js';
import { setMasterKey } from './core/crypto.js';
import { configure as configurePermissions } from './core/permissions.js';
import { configureAuth, setAuthCache } from './core/userAuth.js';
import { initRoleManager, doesRoleRequireMfa } from './core/roleManager.js';
import { initEmailService } from './core/emailSender.js';
import { initSMSService } from './core/sms.js';
import { initCache, getOrSet, del } from './services/cache.js';
import { configureSessionMiddleware } from './middleware/session.js';
import * as sessionsService from './services/sessions.js';
import { runMigrations } from './migrate.js';
import { fileURLToPath } from 'url';
import { dirname, join } from 'path';

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);

/**
 * Bootstrap the entire CRM Core stack with a single config object.
 * 
 * @param {Object} config
 * @param {Object} config.database - { connectionString, ssl?, caCert?, maxConnections?, cachePoolMax?, lockResources?, schemaPrefix?, admission? }
 * @param {string} config.masterKey - MASTER_KEY for encryption
 * @param {Object} [config.permissions] - { nodes, defaultRoles, basePermissions }
 * @param {Object} [config.auth] - userAuth configuration (passwordMinLength, passwordExpiryDays, defaultPassword, isMfaExempt, ...)
 * @param {Object} [config.roleStore] - Adapter for roleManager
 * @param {Object} [config.email] - SMTP config for emailSender
 * @param {Object} [config.sms] - SMS provider config
 * @param {Object} [config.auditService] - { logCrossOrgAccess, logSuperadminAction }
 * @param {Function} [config.subscriptionCheck] - async (req) => { allowed, reason?, pastDue? }
 * @param {boolean} [config.runMigrations=false] - Auto-run core migrations on startup
 * @param {string[]} [config.migrationPaths] - Additional migration directories
 * @returns {Promise<Object>} Initialized modules
 */
export async function bootstrap(config) {
  // 1. Database
  const pool = initDatabase(config.database || {});

  // 2. Master key
  if (config.masterKey) setMasterKey(config.masterKey);

  // 3. Migrations
  if (config.runMigrations) {
    const coreMigrationsDir = join(__dirname, 'migrations');
    const paths = [coreMigrationsDir, ...(config.migrationPaths || [])];
    await runMigrations(paths, {
      onApplied: (f) => console.log(`✓ Migration: ${f}`),
      onSkipped: (f) => console.log(`⊘ Skipped: ${f} (already applied)`)
    });
  }

  // 4. Cache
  await initCache();

  // 5. Permissions
  if (config.permissions) configurePermissions(config.permissions);

  // 6. Auth
  const authConfig = { ...(config.auth || {}), doesRoleRequireMfa };
  configureAuth(authConfig);
  setAuthCache({ getOrSet, del });

  // 7. Role manager
  if (config.roleStore) {
    await initRoleManager({ roleStore: config.roleStore });
  }

  // 8. Session middleware
  configureSessionMiddleware({
    sessionService: sessionsService,
    auditService: config.auditService,
    subscriptionCheck: config.subscriptionCheck,
  });

  // 9. Email
  if (config.email) await initEmailService(config.email);

  // 10. SMS
  if (config.sms) await initSMSService(config.sms);

  return { pool };
}