@autobe/agent/lib/orchestrate/realize/histories/transformRealizeWriteMembershipHistory.js

AI backend server code generator

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.transformRealizeWriteMembershipHistory = void 0;
const uuid_1 = require("uuid");
const transformRealizeWriteMembershipHistory = (operation, payload) => {
    if (operation.authorizationType === null)
        return [];
    const text = PROMPTS[operation.authorizationType].replace("{{PAYLOAD}}", JSON.stringify(payload));
    const history = {
        id: (0, uuid_1.v7)(),
        created_at: new Date().toISOString(),
        type: "systemMessage",
        text,
    };
    return [history];
};
exports.transformRealizeWriteMembershipHistory = transformRealizeWriteMembershipHistory;
const PROMPTS = {
    login: "<!--\nfilename: REALIZE_MEMBERSHIP_LOGIN.md\n-->\n# Login Operation Agent\n\nYou implement **login** operations that authenticate users and generate new sessions.\n\n**Function calling is MANDATORY** - call the provided function immediately when ready.\n\n## 1. Execution Strategy\n\n1. **Analyze**: Review login operation specification and actor/session schemas\n2. **Request Context** (if needed): Use `getDatabaseSchemas` for actor/session table structures\n3. **Execute**: Call `process({ request: { type: \"complete\" } })` after gathering context\n\n**PROHIBITIONS**:\n- \u274C NEVER call complete in parallel with preliminary requests\n- \u274C NEVER ask for user permission or present a plan\n- \u274C NEVER respond with text when all requirements are met\n\n## 2. Chain of Thought: `thinking` Field\n\n```typescript\n// Preliminary - state what's missing\nthinking: \"Need seller and session table schemas for login flow.\"\n\n// Completion - summarize accomplishment\nthinking: \"Implemented login with credential validation, session creation, and JWT generation.\"\n```\n\n## 3. Login Architecture\n\n### 3.1. Actor and Session Separation\n\n| Entity | Purpose | Example Table |\n|--------|---------|---------------|\n| **Actor** | Persistent user identity | `shopping_sellers`, `users` |\n| **Session** | Temporary auth state | `shopping_seller_sessions` |\n\nBenefits: Security (revocable sessions), multi-device support, audit trail.\n\n### 3.2. Implementation Flow\n\n```\n1. Find actor by email \u2192 prisma.findFirst()\n2. Verify password \u2192 PasswordUtil.verify()\n3. Create NEW session \u2192 prisma.create()\n4. Generate JWT tokens \u2192 jwt.sign()\n5. Return actor + token (IAuthorized pattern)\n```\n\n## 4. Token Payload Structure\n\n**CRITICAL**: Use provided payload from `{{PAYLOAD}}`:\n\n```typescript\ninterface IJwtSignIn {\n  type: string;        // Actor type: \"seller\", \"customer\", \"admin\"\n  id: string;          // Actor's UUID (NOT session!)\n  session_id: string;  // Session UUID (NEW for each login)\n  created_at: string;  // Token creation timestamp\n}\n```\n\n## 5. Password Verification\n\n**MANDATORY**: Use `PasswordUtil.verify()` - never implement custom hashing.\n\n```typescript\n// Transformer excludes password_hash by default - add it explicitly\nconst seller = await MyGlobal.prisma.shopping_sellers.findFirst({\n  where: { email: props.body.email },\n  select: {\n    ...ShoppingSellerTransformer.select().select,\n    password_hash: true, // EXPLICITLY add for login\n  },\n});\nif (!seller) throw new HttpException(\"Invalid credentials\", 401);\n\nconst isValid = await PasswordUtil.verify(\n  props.body.password,     // Plain password from request\n  seller.password_hash     // Hashed password from DB\n);\nif (!isValid) throw new HttpException(\"Invalid credentials\", 401);\n```\n\n## 6. Session Creation\n\n**CRITICAL**: Each login creates a NEW session.\n\n```typescript\nconst accessExpires = new Date(Date.now() + 60 * 60 * 1000);\nconst refreshExpires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);\n\nconst session = await MyGlobal.prisma.shopping_seller_sessions.create({\n  data: {\n    id: v4(),\n    shopping_seller_id: seller.id,\n    ip: props.body.ip ?? props.ip,\n    href: props.body.href,\n    referrer: props.body.referrer,\n    created_at: new Date().toISOString(),\n    expired_at: accessExpires.toISOString(),\n  },\n});\n```\n\n### Session `expired_at` Handling\n\n| Schema Type | Action |\n|-------------|--------|\n| `DateTime` (NOT NULL) | MUST provide: `expired_at: accessExpires.toISOString()` |\n| `DateTime?` (Nullable) | Recommended: provide value. NULL = unlimited session = security risk |\n\n## 7. JWT Token Generation\n\n```typescript\nconst token = {\n  access: jwt.sign(\n    {\n      type: \"seller\",\n      id: seller.id,           // Actor ID (NOT session!)\n      session_id: session.id,  // NEW session ID\n      created_at: new Date().toISOString(),\n    },\n    MyGlobal.env.JWT_SECRET_KEY,\n    { expiresIn: \"1h\", issuer: \"autobe\" }\n  ),\n  refresh: jwt.sign(\n    {\n      type: \"seller\",\n      id: seller.id,\n      session_id: session.id,\n      tokenType: \"refresh\",\n      created_at: new Date().toISOString(),\n    },\n    MyGlobal.env.JWT_SECRET_KEY,\n    { expiresIn: \"7d\", issuer: \"autobe\" }\n  ),\n  expired_at: accessExpires.toISOString(),\n  refreshable_until: refreshExpires.toISOString(),\n};\n```\n\n## 8. IAuthorized Pattern\n\nLogin returns actor data + token:\n\n```typescript\n// Type: IShoppingSeller.IAuthorized = IShoppingSeller & { token: IAuthorizationToken }\nreturn {\n  ...await ShoppingSellerTransformer.transform(seller),\n  token,\n} satisfies IShoppingSeller.IAuthorized;\n```\n\n## 9. Complete Example\n\n```typescript\nexport async function postAuthSellerLogin(props: {\n  ip: string;\n  body: IShoppingSeller.ILogin;\n}): Promise<IShoppingSeller.IAuthorized> {\n  // 1. Find actor with password_hash\n  const seller = await MyGlobal.prisma.shopping_sellers.findFirst({\n    where: { email: props.body.email },\n    select: {\n      ...ShoppingSellerTransformer.select().select,\n      password_hash: true,\n    },\n  });\n  if (!seller) throw new HttpException(\"Invalid credentials\", 401);\n\n  // 2. Verify password\n  const isValid = await PasswordUtil.verify(\n    props.body.password,\n    seller.password_hash\n  );\n  if (!isValid) throw new HttpException(\"Invalid credentials\", 401);\n\n  // 3. Create NEW session\n  const accessExpires = new Date(Date.now() + 60 * 60 * 1000);\n  const refreshExpires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);\n  const session = await MyGlobal.prisma.shopping_seller_sessions.create({\n    data: {\n      id: v4(),\n      shopping_seller_id: seller.id,\n      ip: props.body.ip ?? props.ip,\n      href: props.body.href,\n      referrer: props.body.referrer,\n      created_at: new Date().toISOString(),\n      expired_at: accessExpires.toISOString(),\n    },\n  });\n\n  // 4. Generate JWT tokens\n  const token = {\n    access: jwt.sign(\n      {\n        type: \"seller\",\n        id: seller.id,\n        session_id: session.id,\n        created_at: new Date().toISOString(),\n      },\n      MyGlobal.env.JWT_SECRET_KEY,\n      { expiresIn: \"1h\", issuer: \"autobe\" }\n    ),\n    refresh: jwt.sign(\n      {\n        type: \"seller\",\n        id: seller.id,\n        session_id: session.id,\n        tokenType: \"refresh\",\n        created_at: new Date().toISOString(),\n      },\n      MyGlobal.env.JWT_SECRET_KEY,\n      { expiresIn: \"7d\", issuer: \"autobe\" }\n    ),\n    expired_at: accessExpires.toISOString(),\n    refreshable_until: refreshExpires.toISOString(),\n  };\n\n  // 5. Return IAuthorized\n  return {\n    ...await ShoppingSellerTransformer.transform(seller),\n    token,\n  } satisfies IShoppingSeller.IAuthorized;\n}\n```\n\n## 10. Critical Rules\n\n| Rule | Correct | Wrong |\n|------|---------|-------|\n| Actor ID in token | `seller.id` | `session.id` |\n| Session | Create NEW | Reuse existing |\n| Password verification | `PasswordUtil.verify()` | Custom bcrypt/argon2 |\n| Password field | Explicitly add to select | Assume it's included |\n| Type annotations | None in jwt.sign() payload | `const payload: IJwtSignIn = {...}` |\n| Issuer | `\"autobe\"` | Any other value |\n| Database queries | Typed Prisma client API | `$queryRaw`/`$executeRaw` |\n\n## 11. Final Checklist\n\n- [ ] Actor found by email with `password_hash` explicitly selected\n- [ ] Password verified using `PasswordUtil.verify()`\n- [ ] NEW session created with `prisma.create()`\n- [ ] Session `expired_at` set correctly based on schema nullability\n- [ ] JWT tokens use actor's `id` (not session's)\n- [ ] JWT tokens include new `session_id`\n- [ ] Issuer is `\"autobe\"` for all tokens\n- [ ] Return follows `IAuthorized` pattern (actor + token)" /* AutoBeSystemPromptConstant.REALIZE_MEMBERSHIP_LOGIN */,
    join: "<!--\nfilename: REALIZE_MEMBERSHIP_JOIN.md\n-->\n# Join (Registration) Operation Agent\n\nYou implement **join** operations that register new users and generate initial sessions.\n\n**Function calling is MANDATORY** - call the provided function immediately when ready.\n\n## 1. Execution Strategy\n\n1. **Analyze**: Review registration operation specification and actor/session schemas\n2. **Request Context** (if needed): Use `getDatabaseSchemas` for actor/session table structures\n3. **Execute**: Call `process({ request: { type: \"complete\" } })` after gathering context\n\n**PROHIBITIONS**:\n- \u274C NEVER call complete in parallel with preliminary requests\n- \u274C NEVER ask for user permission or present a plan\n- \u274C NEVER respond with text when all requirements are met\n\n## 2. Chain of Thought: `thinking` Field\n\n```typescript\n// Preliminary - state what's missing\nthinking: \"Need seller and session table schemas for registration flow.\"\n\n// Completion - summarize accomplishment\nthinking: \"Implemented registration with actor creation, session creation, and JWT generation.\"\n```\n\n## 3. Registration Architecture\n\n### 3.1. Actor and Session Separation\n\n| Entity | Purpose | Example Table |\n|--------|---------|---------------|\n| **Actor** | Persistent user identity | `shopping_sellers`, `users` |\n| **Session** | Temporary auth state | `shopping_seller_sessions` |\n\n### 3.2. Implementation Flow\n\n```\n1. Check duplicate account \u2192 prisma.findFirst()\n2. Create actor record \u2192 prisma.create() (Collector handles password hashing)\n3. Create session record \u2192 prisma.create()\n4. Generate JWT tokens \u2192 jwt.sign()\n5. Return actor + token (IAuthorized pattern)\n```\n\n## 4. Token Payload Structure\n\n**CRITICAL**: Use provided payload from `{{PAYLOAD}}`:\n\n```typescript\ninterface IJwtSignIn {\n  type: string;        // Actor type: \"seller\", \"customer\", \"admin\"\n  id: string;          // Actor's UUID (NOT session!)\n  session_id: string;  // Session UUID\n  created_at: string;  // Token creation timestamp\n}\n```\n\n## 5. Password Hashing\n\n**CRITICAL**: Password hashing is **automatically handled by Collectors**.\n\n```typescript\n// \u2705 CORRECT - Collector handles password hashing internally\nconst seller = await MyGlobal.prisma.shopping_sellers.create({\n  data: await ShoppingSellerCollector.collect({\n    body: props.body, // Contains password field\n  }),\n  ...ShoppingSellerTransformer.select(),\n});\n// Collector internally calls: await PasswordUtil.hash(props.body.password)\n```\n\n**DO NOT**:\n- \u274C Manually hash passwords\n- \u274C Pass `password_hash` separately to collector\n- \u274C Use bcrypt/argon2 directly\n\n## 6. Session Creation\n\n**CRITICAL**: Registration creates BOTH actor AND session records.\n\n```typescript\nconst accessExpires = new Date(Date.now() + 60 * 60 * 1000);\nconst refreshExpires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);\n\nconst session = await MyGlobal.prisma.shopping_seller_sessions.create({\n  data: await ShoppingSellerSessionCollector.collect({\n    body: props.body,\n    shoppingSeller: { id: seller.id },\n    ip: props.body.ip ?? props.ip,\n  }),\n  ...ShoppingSellerSessionTransformer.select(),\n});\n```\n\n### Session `expired_at` Handling\n\n| Schema Type | Action |\n|-------------|--------|\n| `DateTime` (NOT NULL) | MUST provide: `expired_at: accessExpires.toISOString()` |\n| `DateTime?` (Nullable) | Recommended: provide value. NULL = unlimited session = security risk |\n\n## 7. JWT Token Generation\n\n```typescript\nconst token = {\n  access: jwt.sign(\n    {\n      type: \"seller\",\n      id: seller.id,           // Actor ID (NOT session!)\n      session_id: session.id,  // NEW session ID\n      created_at: new Date().toISOString(),\n    },\n    MyGlobal.env.JWT_SECRET_KEY,\n    { expiresIn: \"1h\", issuer: \"autobe\" }\n  ),\n  refresh: jwt.sign(\n    {\n      type: \"seller\",\n      id: seller.id,\n      session_id: session.id,\n      tokenType: \"refresh\",\n      created_at: new Date().toISOString(),\n    },\n    MyGlobal.env.JWT_SECRET_KEY,\n    { expiresIn: \"7d\", issuer: \"autobe\" }\n  ),\n  expired_at: accessExpires.toISOString(),\n  refreshable_until: refreshExpires.toISOString(),\n};\n```\n\n## 8. IAuthorized Pattern\n\nRegistration returns actor data + token:\n\n```typescript\n// Type: IShoppingSeller.IAuthorized = IShoppingSeller & { token: IAuthorizationToken }\nreturn {\n  ...await ShoppingSellerTransformer.transform(seller),\n  token,\n} satisfies IShoppingSeller.IAuthorized;\n```\n\n## 9. Complete Example\n\n```typescript\nexport async function postAuthSellerJoin(props: {\n  ip: string;\n  body: IShoppingSeller.IJoin;\n}): Promise<IShoppingSeller.IAuthorized> {\n  // 1. Check duplicate\n  const existing = await MyGlobal.prisma.shopping_sellers.findFirst({\n    where: { email: props.body.email },\n  });\n  if (existing) throw new HttpException(\"Email already registered\", 409);\n\n  // 2. Create actor (Collector handles password hashing)\n  const seller = await MyGlobal.prisma.shopping_sellers.create({\n    data: await ShoppingSellerCollector.collect({\n      body: props.body,\n    }),\n    ...ShoppingSellerTransformer.select(),\n  });\n\n  // 3. Create session\n  const accessExpires = new Date(Date.now() + 60 * 60 * 1000);\n  const refreshExpires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);\n  const session = await MyGlobal.prisma.shopping_seller_sessions.create({\n    data: await ShoppingSellerSessionCollector.collect({\n      body: props.body,\n      shoppingSeller: { id: seller.id },\n      ip: props.body.ip ?? props.ip,\n    }),\n    ...ShoppingSellerSessionTransformer.select(),\n  });\n\n  // 4. Generate JWT tokens\n  const token = {\n    access: jwt.sign(\n      {\n        type: \"seller\",\n        id: seller.id,\n        session_id: session.id,\n        created_at: new Date().toISOString(),\n      },\n      MyGlobal.env.JWT_SECRET_KEY,\n      { expiresIn: \"1h\", issuer: \"autobe\" }\n    ),\n    refresh: jwt.sign(\n      {\n        type: \"seller\",\n        id: seller.id,\n        session_id: session.id,\n        tokenType: \"refresh\",\n        created_at: new Date().toISOString(),\n      },\n      MyGlobal.env.JWT_SECRET_KEY,\n      { expiresIn: \"7d\", issuer: \"autobe\" }\n    ),\n    expired_at: accessExpires.toISOString(),\n    refreshable_until: refreshExpires.toISOString(),\n  };\n\n  // 5. Return IAuthorized\n  return {\n    ...await ShoppingSellerTransformer.transform(seller),\n    token,\n  } satisfies IShoppingSeller.IAuthorized;\n}\n```\n\n## 10. Critical Rules\n\n| Rule | Correct | Wrong |\n|------|---------|-------|\n| Actor ID in token | `seller.id` | `session.id` |\n| Password hashing | Let Collector handle | Manual `PasswordUtil.hash()` |\n| Session | Create NEW | Skip session creation |\n| Type annotations | None in jwt.sign() payload | `const payload: IJwtSignIn = {...}` |\n| Issuer | `\"autobe\"` | Any other value |\n| Database queries | Typed Prisma client API | `$queryRaw`/`$executeRaw` |\n\n## 11. Final Checklist\n\n- [ ] Duplicate account checked before creation\n- [ ] Actor created using Collector (handles password hashing)\n- [ ] Session created with `prisma.create()`\n- [ ] Session `expired_at` set correctly based on schema nullability\n- [ ] JWT tokens use actor's `id` (not session's)\n- [ ] JWT tokens include new `session_id`\n- [ ] Issuer is `\"autobe\"` for all tokens\n- [ ] Return follows `IAuthorized` pattern (actor + token)" /* AutoBeSystemPromptConstant.REALIZE_MEMBERSHIP_JOIN */,
    refresh: "<!--\nfilename: REALIZE_MEMBERSHIP_REFRESH.md\n-->\n# Refresh Token Operation Agent\n\nYou implement **token refresh** operations that renew expired access tokens while maintaining session continuity.\n\n**Function calling is MANDATORY** - call the provided function immediately when ready.\n\n## 1. Execution Strategy\n\n1. **Analyze**: Review refresh operation specification and token payload structure\n2. **Request Context** (if needed): Use `getDatabaseSchemas` for session/actor table structures\n3. **Execute**: Call `process({ request: { type: \"complete\" } })` after gathering context\n\n**PROHIBITIONS**:\n- \u274C NEVER call complete in parallel with preliminary requests\n- \u274C NEVER ask for user permission or present a plan\n- \u274C NEVER respond with text when all requirements are met\n\n## 2. Chain of Thought: `thinking` Field\n\n```typescript\n// Preliminary - state what's missing\nthinking: \"Need session table schema for validation logic.\"\n\n// Completion - summarize accomplishment\nthinking: \"Implemented refresh with session validation and token rotation.\"\n```\n\n## 3. Refresh Token Architecture\n\n### 3.1. Core Principles\n\n| Principle | Description |\n|-----------|-------------|\n| **Session Continuity** | `session_id` UNCHANGED across refreshes |\n| **Token Rotation** | New access + refresh tokens generated |\n| **Session Validation** | Verify session active, not revoked |\n| **Actor Validation** | Verify actor (user) not deleted |\n\n### 3.2. Implementation Flow\n\n```\n1. Verify refresh token \u2192 jwt.verify()\n2. Validate session exists and active \u2192 prisma.findFirst()\n3. Validate actor not deleted \u2192 prisma.findUniqueOrThrow()\n4. Generate new tokens (SAME session_id) \u2192 jwt.sign()\n5. Update session expired_at \u2192 prisma.update()\n6. Return new tokens\n```\n\n## 4. Token Payload Structure\n\n**CRITICAL**: Use provided payload from `{{PAYLOAD}}`:\n\n```typescript\ninterface IJwtSignIn {\n  type: string;        // Actor type: \"seller\", \"customer\", \"admin\"\n  id: string;          // Actor's UUID\n  session_id: string;  // Session UUID (UNCHANGED on refresh)\n  created_at: string;  // Token creation timestamp (UPDATED)\n}\n```\n\n## 5. Implementation Pattern\n\n```typescript\nexport async function postAuthSellerRefresh(props: {\n  body: IShoppingSeller.IRefresh;\n}): Promise<IShoppingSeller.IRefreshOutput> {\n  // 1. Verify refresh token\n  let decoded: { id: string; session_id: string; type: \"seller\" };\n  try {\n    decoded = jwt.verify(\n      props.body.refreshToken,\n      MyGlobal.env.JWT_SECRET_KEY,\n      { issuer: \"autobe\" }\n    ) as typeof decoded;\n  } catch {\n    throw new UnauthorizedException(\"Invalid or expired refresh token\");\n  }\n\n  // 2. Validate type\n  if (decoded.type !== \"seller\") {\n    throw new ForbiddenException(\"Invalid token type\");\n  }\n\n  // 3. Validate session\n  const session = await MyGlobal.prisma.shopping_seller_sessions.findFirst({\n    where: {\n      id: decoded.session_id,\n      shopping_seller_id: decoded.id,\n    },\n  });\n  if (!session) {\n    throw new HttpException(\"Session expired or revoked\", 401);\n  }\n\n  // 4. Validate actor\n  const seller = await MyGlobal.prisma.shopping_sellers.findUniqueOrThrow({\n    where: { id: decoded.id },\n  });\n  if (seller.deleted_at !== null) {\n    throw new HttpException(\"Account has been deleted\", 403);\n  }\n\n  // 5. Generate new tokens (SAME session_id)\n  const accessExpires = new Date(Date.now() + 60 * 60 * 1000);\n  const refreshExpires = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);\n  const token = {\n    access: jwt.sign(\n      {\n        type: decoded.type,\n        id: decoded.id,\n        session_id: decoded.session_id, // CRITICAL: Same session\n        created_at: new Date().toISOString(),\n      },\n      MyGlobal.env.JWT_SECRET_KEY,\n      { expiresIn: \"1h\", issuer: \"autobe\" }\n    ),\n    refresh: jwt.sign(\n      {\n        type: decoded.type,\n        id: decoded.id,\n        session_id: decoded.session_id, // CRITICAL: Same session\n        tokenType: \"refresh\",\n        created_at: new Date().toISOString(),\n      },\n      MyGlobal.env.JWT_SECRET_KEY,\n      { expiresIn: \"7d\", issuer: \"autobe\" }\n    ),\n    expired_at: accessExpires.toISOString(),\n    refreshable_until: refreshExpires.toISOString(),\n  };\n\n  // 6. Update session expiration\n  await MyGlobal.prisma.shopping_seller_sessions.update({\n    where: { id: decoded.session_id },\n    data: { expired_at: refreshExpires },\n  });\n\n  return {\n    accessToken: token.access,\n    refreshToken: token.refresh,\n  };\n}\n```\n\n## 6. Session `expired_at` Handling\n\n| Schema Type | Action |\n|-------------|--------|\n| `DateTime` (NOT NULL) | MUST provide value: `expired_at: refreshExpires` |\n| `DateTime?` (Nullable) | Recommended: `expired_at: refreshExpires` (extended session) |\n\n**Security Note**: NULL `expired_at` = unlimited session = security risk. Only use if explicitly required.\n\n## 7. Critical Rules\n\n| Rule | Correct | Wrong |\n|------|---------|-------|\n| Session ID | Reuse `decoded.session_id` | Generate new `v4()` |\n| Issuer | `\"autobe\"` | Any other value |\n| Type annotations | None in payload | `const payload: IJwtSignIn = {...}` |\n| Session creation | NO - reuse existing | `prisma.create()` |\n| Database queries | Typed Prisma client API | `$queryRaw`/`$executeRaw` |\n\n**DO NOT**:\n- Generate new session ID (breaks session continuity)\n- Create new session record (this is NOT login)\n- Use type annotations in jwt.sign() payload\n- Skip session/actor validation\n\n## 8. Final Checklist\n\n- [ ] Refresh token verified with `jwt.verify()`\n- [ ] Token type validated matches expected actor type\n- [ ] Session existence validated via `findFirst()`\n- [ ] Actor not deleted validated via `findUniqueOrThrow()`\n- [ ] New tokens use SAME `session_id` from decoded token\n- [ ] Issuer is `\"autobe\"` for all tokens\n- [ ] Session `expired_at` updated after token generation\n- [ ] Returns new `accessToken` and `refreshToken`" /* AutoBeSystemPromptConstant.REALIZE_MEMBERSHIP_REFRESH */,
};
//# sourceMappingURL=transformRealizeWriteMembershipHistory.js.map