1tube 0.1.0

package/eslint-plugin.js

@@ -0,0 +1,91 @@
+/**
+ * ESLint plugin for projects consuming 1tube.
+ *
+ * Prevents accidentally building edge-function URLs from SUPABASE_URL
+ * (which bypasses the 1tube gateway) and from using EDGE_URL directly
+ * (which skips the named constant pattern in api.ts).
+ *
+ * Usage in eslint.config.js (flat config):
+ *
+ *   import oneTube from "1tube/eslint-plugin";
+ *
+ *   export default defineConfig({
+ *     plugins: { "1tube": oneTube },
+ *     rules: {
+ *       "1tube/no-supabase-function-urls": "error",
+ *       "1tube/no-direct-edge-url": "error",
+ *     },
+ *   });
+ */
+
+const plugin = {
+  rules: {
+    "no-supabase-function-urls": {
+      meta: {
+        type: "problem",
+        docs: {
+          description:
+            "Disallow building edge-function URLs from API_CONFIG.SUPABASE_URL",
+        },
+        messages: {
+          useFnConstant:
+            "Don't build function URLs from API_CONFIG.SUPABASE_URL — use the named API_CONFIG.*_URL constants (routed via EDGE_URL / 1tube). Add a new constant in api.ts if one is missing.",
+        },
+        schema: [],
+      },
+      create(context) {
+        return {
+          TemplateLiteral(node) {
+            const exprs = node.expressions;
+            const quasis = node.quasis;
+            for (let i = 0; i < exprs.length; i++) {
+              const expr = exprs[i];
+              if (
+                expr.type === "MemberExpression" &&
+                expr.object.type === "Identifier" &&
+                expr.object.name === "API_CONFIG" &&
+                expr.property.type === "Identifier" &&
+                expr.property.name === "SUPABASE_URL" &&
+                quasis[i + 1] &&
+                /^\/functions\b/.test(quasis[i + 1].value.raw)
+              ) {
+                context.report({ node: expr, messageId: "useFnConstant" });
+              }
+            }
+          },
+        };
+      },
+    },
+
+    "no-direct-edge-url": {
+      meta: {
+        type: "problem",
+        docs: {
+          description:
+            "Disallow using API_CONFIG.EDGE_URL directly to construct URLs",
+        },
+        messages: {
+          useNamedConstant:
+            "Don't use API_CONFIG.EDGE_URL directly — use the named API_CONFIG.*_URL constants instead (e.g. API_CONFIG.AUTH_ME_URL). Add a new constant in api.ts if one is missing.",
+        },
+        schema: [],
+      },
+      create(context) {
+        return {
+          MemberExpression(node) {
+            if (
+              node.object.type === "Identifier" &&
+              node.object.name === "API_CONFIG" &&
+              node.property.type === "Identifier" &&
+              node.property.name === "EDGE_URL"
+            ) {
+              context.report({ node, messageId: "useNamedConstant" });
+            }
+          },
+        };
+      },
+    },
+  },
+};
+
+export default plugin;

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "1tube",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lofcz/1tube.git"
+  },
+  "homepage": "https://github.com/lofcz/1tube",
+  "bugs": {
+    "url": "https://github.com/lofcz/1tube/issues"
+  },
+  "exports": {
+    "./eslint-plugin": "./eslint-plugin.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "eslint-plugin.js",
+    "src",
+    "deno.json",
+    "deno.lock",
+    "README.md",
+    "LICENSE",
+    ".env.example"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "dev": "deno task dev",
+    "serve": "deno task serve",
+    "typecheck": "deno check src/server.ts eslint-plugin.js",
+    "check": "deno cache src/server.ts",
+    "prepublishOnly": "bun run typecheck && bun run check"
+  },
+  "dependencies": {
+    "hono": "^4"
+  }
+}

package/src/discovery.ts

@@ -0,0 +1,69 @@
+/**
+ * Discovers and loads edge function modules from the filesystem.
+ *
+ * Scans `functionsDir` for subdirectories containing an `index.ts`.
+ * Skips directories starting with `_` or ending with `_shared`.
+ * Each discovered module is dynamically imported — the top-level `serve()` call
+ * in the module registers the handler via the global FunctionRegistry.
+ */
+
+import { join, toFileUrl } from "jsr:@std/path@^1";
+import type { FunctionRegistry } from "./registry.ts";
+
+export async function discoverAndLoad(
+  functionsDir: string,
+  registry: FunctionRegistry,
+): Promise<{ loaded: string[]; skipped: string[]; errors: Array<{ name: string; error: string }> }> {
+  const loaded: string[] = [];
+  const skipped: string[] = [];
+  const errors: Array<{ name: string; error: string }> = [];
+
+  const resolvedDir = await Deno.realPath(functionsDir);
+
+  const entries: string[] = [];
+  for await (const entry of Deno.readDir(resolvedDir)) {
+    if (!entry.isDirectory) continue;
+    if (entry.name.startsWith("_") || entry.name.endsWith("_shared")) {
+      skipped.push(entry.name);
+      continue;
+    }
+    entries.push(entry.name);
+  }
+
+  entries.sort();
+
+  for (const name of entries) {
+    const indexPath = join(resolvedDir, name, "index.ts");
+
+    try {
+      await Deno.stat(indexPath);
+    } catch {
+      skipped.push(name);
+      continue;
+    }
+
+    registry.setCurrentFunction(name);
+
+    try {
+      await import(toFileUrl(indexPath).href);
+      loaded.push(name);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      errors.push({ name, error: msg });
+
+      const isEnvIssue =
+        msg.includes("is required") ||
+        msg.includes("must be set") ||
+        msg.includes("API key") ||
+        msg.includes("undefined");
+
+      if (isEnvIssue) {
+        console.error(`[1tube] Failed to load "${name}" (missing env var): ${msg}`);
+      } else {
+        console.error(`[1tube] Failed to load "${name}": ${msg}`);
+      }
+    }
+  }
+
+  return { loaded, skipped, errors };
+}

package/src/gateway/auth.ts

@@ -0,0 +1,88 @@
+/**
+ * JWT authentication for the gateway.
+ *
+ * Validates HMAC-SHA256 JWTs using the same secret as Supabase,
+ * producing tokens fully compatible with Supabase RLS policies.
+ */
+
+import type { AuthContext, JWTPayload } from "../registry.ts";
+
+const JWT_SECRET = Deno.env.get("JWT_SECRET") || "";
+if (!JWT_SECRET) {
+  console.warn("[1tube] JWT_SECRET not set — authenticated endpoints will reject all requests");
+}
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+let _cachedKey: CryptoKey | null = null;
+
+async function getKey(): Promise<CryptoKey> {
+  if (_cachedKey) return _cachedKey;
+  _cachedKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(JWT_SECRET),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"],
+  );
+  return _cachedKey;
+}
+
+function base64UrlDecode(str: string): Uint8Array {
+  const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+}
+
+function parseBearer(header: string | null): string | null {
+  if (!header) return null;
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  return match ? match[1] : null;
+}
+
+async function verifyToken(token: string): Promise<JWTPayload | null> {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const key = await getKey();
+    const sigBytes = base64UrlDecode(signatureB64);
+
+    const isValid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      sigBytes.buffer as ArrayBuffer,
+      encoder.encode(`${headerB64}.${payloadB64}`),
+    );
+    if (!isValid) return null;
+
+    const payload = JSON.parse(decoder.decode(base64UrlDecode(payloadB64))) as JWTPayload;
+
+    if (payload.exp < Math.floor(Date.now() / 1000)) return null;
+
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Validate the Authorization header and return an AuthContext, or null if invalid.
+ */
+export async function validateRequest(req: Request): Promise<AuthContext | null> {
+  const token = parseBearer(req.headers.get("Authorization"));
+  if (!token) return null;
+
+  const payload = await verifyToken(token);
+  if (!payload) return null;
+
+  return {
+    userId: payload.sub,
+    email: payload.email,
+    payload,
+    rawToken: token,
+  };
+}

package/src/gateway/cors.ts

@@ -0,0 +1,25 @@
+/**
+ * CORS handling for the gateway.
+ * Mirrors the Supabase Edge Functions CORS behavior.
+ */
+
+import type { Context, Next } from "npm:hono@4";
+
+const CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Headers":
+    "authorization, x-client-info, apikey, content-type, x-application-name, user-agent",
+  "Access-Control-Allow-Methods": "POST, GET, OPTIONS, PUT, PATCH, DELETE",
+};
+
+export async function corsMiddleware(c: Context, next: Next) {
+  if (c.req.method === "OPTIONS") {
+    return new Response(null, { status: 204, headers: CORS_HEADERS });
+  }
+
+  await next();
+
+  for (const [key, value] of Object.entries(CORS_HEADERS)) {
+    c.res.headers.set(key, value);
+  }
+}

package/src/gateway/logging.ts

@@ -0,0 +1,122 @@
+/**
+ * Structured request logging and metrics collection.
+ *
+ * Logs every request as a JSON line to stdout.
+ * Tracks per-function metrics (count, latency, errors) for the /metrics endpoint.
+ */
+
+import type { Context, Next } from "npm:hono@4";
+
+export interface FunctionMetrics {
+  invocations: number;
+  errors: number;
+  totalDurationMs: number;
+  lastInvocation: number;
+}
+
+const metricsMap = new Map<string, FunctionMetrics>();
+let globalRequests = 0;
+let globalErrors = 0;
+const startedAt = Date.now();
+
+function getMetrics(name: string): FunctionMetrics {
+  let m = metricsMap.get(name);
+  if (!m) {
+    m = { invocations: 0, errors: 0, totalDurationMs: 0, lastInvocation: 0 };
+    metricsMap.set(name, m);
+  }
+  return m;
+}
+
+export async function loggingMiddleware(c: Context, next: Next) {
+  const start = performance.now();
+  const fnName = c.req.path.replace("/functions/v1/", "") || "unknown";
+
+  await next();
+
+  const durationMs = Math.round(performance.now() - start);
+  const status = c.res.status;
+  const isError = status >= 400;
+
+  const m = getMetrics(fnName);
+  m.invocations++;
+  m.totalDurationMs += durationMs;
+  m.lastInvocation = Date.now();
+  globalRequests++;
+
+  if (isError) {
+    m.errors++;
+    globalErrors++;
+  }
+
+  const userId = (c.get("userId") as string) || null;
+  const userTag = userId ? ` [user:${userId.slice(0, 8)}]` : "";
+  const statusColor = isError ? "\x1b[31m" : "\x1b[32m";
+  const reset = "\x1b[0m";
+  const dim = "\x1b[2m";
+
+  const line = `\x1b[36m[1tube]${reset} ${c.req.method} /functions/v1/${fnName} → ${statusColor}${status}${reset} ${dim}(${durationMs}ms)${reset}${userTag}`;
+
+  if (isError) {
+    console.error(line);
+  } else {
+    console.log(line);
+  }
+}
+
+/**
+ * Returns collected metrics for the /metrics endpoint.
+ */
+export function getCollectedMetrics(): {
+  uptime_ms: number;
+  total_requests: number;
+  total_errors: number;
+  functions: Record<string, FunctionMetrics>;
+} {
+  return {
+    uptime_ms: Date.now() - startedAt,
+    total_requests: globalRequests,
+    total_errors: globalErrors,
+    functions: Object.fromEntries(metricsMap),
+  };
+}
+
+/**
+ * Prometheus-compatible text format for /metrics.
+ */
+export function getPrometheusMetrics(): string {
+  const lines: string[] = [];
+
+  lines.push("# HELP onetube_uptime_seconds Gateway uptime in seconds");
+  lines.push("# TYPE onetube_uptime_seconds gauge");
+  lines.push(`onetube_uptime_seconds ${Math.floor((Date.now() - startedAt) / 1000)}`);
+
+  lines.push("# HELP onetube_requests_total Total number of function invocations");
+  lines.push("# TYPE onetube_requests_total counter");
+  lines.push(`onetube_requests_total ${globalRequests}`);
+
+  lines.push("# HELP onetube_errors_total Total number of error responses");
+  lines.push("# TYPE onetube_errors_total counter");
+  lines.push(`onetube_errors_total ${globalErrors}`);
+
+  lines.push("# HELP onetube_function_invocations_total Invocations per function");
+  lines.push("# TYPE onetube_function_invocations_total counter");
+  for (const [name, m] of metricsMap) {
+    lines.push(`onetube_function_invocations_total{function="${name}"} ${m.invocations}`);
+  }
+
+  lines.push("# HELP onetube_function_errors_total Errors per function");
+  lines.push("# TYPE onetube_function_errors_total counter");
+  for (const [name, m] of metricsMap) {
+    lines.push(`onetube_function_errors_total{function="${name}"} ${m.errors}`);
+  }
+
+  lines.push("# HELP onetube_function_duration_ms_avg Average request duration per function");
+  lines.push("# TYPE onetube_function_duration_ms_avg gauge");
+  for (const [name, m] of metricsMap) {
+    const avg = m.invocations > 0 ? Math.round(m.totalDurationMs / m.invocations) : 0;
+    lines.push(`onetube_function_duration_ms_avg{function="${name}"} ${avg}`);
+  }
+
+  return lines.join("\n") + "\n";
+}

package/src/gateway/rate-limit.ts

@@ -0,0 +1,85 @@
+/**
+ * In-memory token bucket rate limiter.
+ * Keyed by user ID (authenticated) or IP (public endpoints).
+ */
+
+import type { Context, Next } from "npm:hono@4";
+
+interface Bucket {
+  tokens: number;
+  lastRefill: number;
+}
+
+interface RateLimitConfig {
+  /** Requests per minute (default). */
+  defaultRpm: number;
+  /** Per-function overrides. */
+  overrides: Record<string, number>;
+  /** Max buckets to track before evicting oldest. */
+  maxBuckets: number;
+}
+
+const DEFAULT_CONFIG: RateLimitConfig = {
+  defaultRpm: 120,
+  overrides: {
+    "ai-chat": 30,
+    "pdf-generate": 10,
+    "discussion-chat": 30,
+    "questions-generate": 20,
+  },
+  maxBuckets: 10_000,
+};
+
+const buckets = new Map<string, Bucket>();
+
+function getOrCreateBucket(key: string, rpm: number): Bucket {
+  const now = Date.now();
+  let bucket = buckets.get(key);
+
+  if (!bucket) {
+    if (buckets.size >= DEFAULT_CONFIG.maxBuckets) {
+      const oldest = buckets.keys().next().value!;
+      buckets.delete(oldest);
+    }
+    bucket = { tokens: rpm, lastRefill: now };
+    buckets.set(key, bucket);
+    return bucket;
+  }
+
+  const elapsed = (now - bucket.lastRefill) / 60_000;
+  const refill = Math.floor(elapsed * rpm);
+  if (refill > 0) {
+    bucket.tokens = Math.min(rpm, bucket.tokens + refill);
+    bucket.lastRefill = now;
+  }
+
+  return bucket;
+}
+
+function resolveKey(c: Context): string {
+  const userId = c.get("userId") as string | undefined;
+  if (userId) return `user:${userId}`;
+
+  return `ip:${c.req.header("x-forwarded-for") || c.req.header("x-real-ip") || "unknown"}`;
+}
+
+export function createRateLimiter(config: Partial<RateLimitConfig> = {}) {
+  const cfg = { ...DEFAULT_CONFIG, ...config };
+
+  return async (c: Context, next: Next) => {
+    const fnName = c.req.param("name");
+    const rpm = (fnName && cfg.overrides[fnName]) || cfg.defaultRpm;
+    const key = `${resolveKey(c)}:${fnName || "global"}`;
+    const bucket = getOrCreateBucket(key, rpm);
+
+    if (bucket.tokens <= 0) {
+      return c.json(
+        { error: "Rate limit exceeded", retryAfterSeconds: Math.ceil(60 / rpm) },
+        429,
+      );
+    }
+
+    bucket.tokens--;
+    await next();
+  };
+}

package/src/health.ts

@@ -0,0 +1,27 @@
+/**
+ * Health check and metrics endpoints.
+ */
+
+import type { Context } from "npm:hono@4";
+import type { FunctionRegistry } from "./registry.ts";
+import { getCollectedMetrics, getPrometheusMetrics } from "./gateway/logging.ts";
+
+export function createHealthHandler(registry: FunctionRegistry) {
+  return (c: Context) => {
+    const metrics = getCollectedMetrics();
+    return c.json({
+      status: "ok",
+      function_count: registry.size,
+      functionList: registry.list(),
+      ...metrics,
+    });
+  };
+}
+
+export function createMetricsHandler() {
+  return (c: Context) => {
+    return new Response(getPrometheusMetrics(), {
+      headers: { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" },
+    });
+  };
+}

package/src/registry.ts

@@ -0,0 +1,83 @@
+/**
+ * Global function registry that captures handlers from edge function modules.
+ *
+ * When a function module calls `serve(handler, opts)` from `_shared/handler.ts`,
+ * the shim checks for `globalThis.__edgeFunctionRegistry`. If present, the handler
+ * is stored here instead of starting a Deno.serve() per function.
+ */
+
+export interface AuthContext {
+  userId: string;
+  email: string;
+  payload: JWTPayload;
+  rawToken: string;
+}
+
+export interface JWTPayload {
+  sub: string;
+  email: string;
+  exp: number;
+  iat: number;
+  role: string;
+  iss: string;
+  aud: string;
+}
+
+export type AuthenticatedHandler = (
+  req: Request,
+  auth: AuthContext,
+) => Response | Promise<Response>;
+
+export type PublicHandler = (req: Request) => Response | Promise<Response>;
+
+export interface RegisteredFunction {
+  handler: AuthenticatedHandler | PublicHandler;
+  isPublic: boolean;
+  /** Per-function wall clock timeout in ms. Undefined = use gateway default. 
+   *  Only compatible with 1tube edge functions runtime. Ignored by Supabase Edge Functions runtime.
+  */
+  timeoutMs?: number;
+}
+
+export class FunctionRegistry {
+  private handlers = new Map<string, RegisteredFunction>();
+  private _currentName = "";
+
+  /** Set by the discovery loader before importing each function module. */
+  setCurrentFunction(name: string): void {
+    this._currentName = name;
+  }
+
+  /**
+   * Called by the `serve()` shim in `_shared/handler.ts`.
+   * Captures the handler instead of starting a server.
+   */
+  register(
+    handler: AuthenticatedHandler | PublicHandler,
+    opts: { public: boolean; timeoutMs?: number },
+  ): void {
+    if (!this._currentName) {
+      throw new Error(
+        "[1tube] registry.register() called without setCurrentFunction(). " +
+        "This is a bug in the function loader.",
+      );
+    }
+    this.handlers.set(this._currentName, {
+      handler,
+      isPublic: opts.public,
+      timeoutMs: opts.timeoutMs,
+    });
+  }
+
+  get(name: string): RegisteredFunction | undefined {
+    return this.handlers.get(name);
+  }
+
+  list(): string[] {
+    return [...this.handlers.keys()].sort();
+  }
+
+  get size(): number {
+    return this.handlers.size;
+  }
+}