@abeltib/lookup-core

Prisma schema/client, Better Auth config, RBAC/ABAC helpers, and the wallet credit ledger for the IMEI Lookup Platform.

Internal-only. Only lookup-web and lookup-api should ever depend on this package — both run fully server-side and are trusted with direct database access. A bot, mobile app, or third-party consumer should go through @abeltib/lookup-sdk instead, which never touches this package.

What lives here

• prisma/schema.prisma — the canonical schema. Auth tables (User, Session, Account, Verification) follow Better Auth's required shape exactly — do not rename fields. RBAC is a many-to-many UserRole join, not a single role column, so a user can hold multiple roles without a migration.
• src/db.ts — the shared PrismaClient, built on @prisma/adapter-neon (not Prisma's default engine binary) because lookup-api runs on Cloudflare Workers, which can't execute native binaries.
• src/auth.ts — Better Auth config: email+password, Google OAuth, one-time-code email verification (emailOTP plugin, sent automatically on sign-up), link-based forgot-password, per-route rate limiting, admin plugin. Only imported by lookup-web.
• src/email.ts — sends transactional email via Resend. Falls back to printing the email to the console if RESEND_API_KEY isn't set, so the OTP/reset flow is testable before you have a Resend account.
• src/jwt.ts — sign/verify for the short-lived internal JWT lookup-web uses to call lookup-api server-to-server (product doc §3.2).
• src/rbac.ts — resolves a user's roles/permissions from the DB, plus the pure hasPermission/requirePermission checks used against an already-resolved permission list (e.g. from the internal JWT, to avoid a DB round-trip per request in lookup-api).
• src/abac.ts — ownership policy functions (canViewLookupRequest, canViewWallet, ...) — §3.6.
• src/credits.ts — the only code allowed to mutate a wallet balance. Every debit/credit runs in a serializable transaction with a SELECT ... FOR UPDATE row lock (NFR-1, NFR-2).
• src/logger.ts — logEvent() (and category-specific logAuthEvent/logWalletEvent/logAdminEvent/etc. wrappers), the one function every mutating action in the system calls. Writes structured JSON to stdout always, and best-effort NDJSON files under logs/<category>/<YYYY-MM>/<YYYY-MM-DD>.log (append-only) wherever the filesystem is writable — see the doc comment at the top of the file for why there are two sinks.
• prisma/seed.ts — seeds the permission catalog, default role→permission mapping (both imported from @abeltib/lookup-shared, so they can't drift), and sample lookup service types.

Local setup

cp .env.example .env   # fill in a real Neon DATABASE_URL and secrets
npm install
npm run db:migrate:dev # creates the initial migration against your DB
npm run db:seed

Database migrations in CI

db:migrate:deploy runs against the real database and is wired to a manual (workflow_dispatch) GitHub Action, not an automatic one on merge — a schema migration is a production action and shouldn't fire silently off a push.

Versioning

Published to npm as @abeltib/lookup-core via Changesets — same flow as lookup-shared (see its README). While lookup-shared hasn't been published yet either, this package depends on it via a local file: reference; switch both to real npm semver ranges once you publish for the first time.