@ahmed-3m/idea2prototype 0.9.1 → 1.0.1

package/skills/idea2prototype/templates/features/api-crud/route.tmpl.mjs

@@ -1,26 +1,56 @@
 // Idea2Prototype feature: api-crud — resource "{{resource}}"
 // Contract: handlers return [status, payload]; the server sends payload as JSON.
 // Persistence: JSON file at data/{{resource}}.json (created on first write).
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 
 const STORE_PATH = join(process.cwd(), 'data', '{{resource}}.json');
-let cache = null;
+let ready = null; // memoized cold load: concurrent first callers share ONE array
 
-async function load() {
-  if (cache) return cache;
-  try {
-    cache = JSON.parse(await readFile(STORE_PATH, 'utf8'));
-  } catch {
-    cache = [];
+function load() {
+  if (!ready) {
+    ready = (async () => {
+      let cache = null;
+      let raw = null;
+      try {
+        raw = await readFile(STORE_PATH, 'utf8');
+      } catch (err) {
+        if (err?.code !== 'ENOENT') console.error(`[{{resource}}] could not read data store (${err?.code ?? err}) — starting empty`);
+      }
+      if (raw !== null) {
+        try {
+          cache = JSON.parse(raw);
+        } catch {
+          cache = null;
+        }
+      }
+      if (raw === null || cache === null || !Array.isArray(cache)) {
+        // A store that exists but is corrupt (unparseable, or not a list) must
+        // never be silently wiped — the next persist() would overwrite data
+        // that may still be recoverable. Quarantine it, say so loudly, start
+        // empty. If even the quarantine rename fails, do NOT pretend it is
+        // safe: the original file WILL be overwritten by the next persist.
+        if (raw !== null) {
+          const quarantine = `${STORE_PATH}.corrupt-${Date.now().toString(36)}`;
+          try {
+            await rename(STORE_PATH, quarantine);
+            console.error(`[{{resource}}] data store is not a valid JSON list — quarantined as ${quarantine}; starting empty`);
+          } catch (err) {
+            console.error(`[{{resource}}] data store is corrupt AND could not be quarantined (${err?.code ?? err}) — the next write will overwrite it`);
+          }
+        }
+        cache = [];
+      }
+      return cache;
+    })();
   }
-  return cache;
+  return ready;
 }
 
 async function persist() {
   await mkdir(join(process.cwd(), 'data'), { recursive: true });
-  await writeFile(STORE_PATH, JSON.stringify(cache, null, 2));
+  await writeFile(STORE_PATH, JSON.stringify(await load(), null, 2));
 }
 
 function requireObject(body) {
@@ -38,7 +68,9 @@ export default [
       POST: async ({ body }) => {
         const bad = requireObject(body);
         if (bad) return bad;
-        const item = { id: randomUUID(), createdAt: new Date().toISOString(), ...body };
+        // body first: the server owns id + createdAt — a client-sent id would
+        // otherwise duplicate (or shadow) an existing item
+        const item = { ...body, id: randomUUID(), createdAt: new Date().toISOString() };
         (await load()).push(item);
         await persist();
         return [201, item];
@@ -58,7 +90,7 @@ export default [
         const list = await load();
         const index = list.findIndex((x) => x.id === params.id);
         if (index === -1) return [404, { error: 'not found' }];
-        list[index] = { ...list[index], ...body, id: list[index].id };
+        list[index] = { ...list[index], ...body, id: list[index].id, createdAt: list[index].createdAt };
         await persist();
         return [200, list[index]];
       },

package/skills/idea2prototype/templates/features/api-crud/test.tmpl.mjs

@@ -40,6 +40,27 @@ test('{{resource}} CRUD roundtrip', async () => {
   }
 });
 
+test('{{resource}} ignores client-sent id and createdAt', async () => {
+  const app = await start(0);
+  const base = `http://127.0.0.1:${app.port}/api/{{resource}}`;
+  try {
+    const spoof = { id: 'client-chosen', createdAt: '1999-01-01T00:00:00.000Z', title: 'spoof' };
+    const a = await (await fetch(base, { method: 'POST', headers: JSON_HEADERS, body: JSON.stringify(spoof) })).json();
+    const b = await (await fetch(base, { method: 'POST', headers: JSON_HEADERS, body: JSON.stringify(spoof) })).json();
+    assert.notEqual(a.id, 'client-chosen');
+    assert.notEqual(a.id, b.id, 'two creates must never share an id');
+    assert.notEqual(a.createdAt, spoof.createdAt);
+
+    const put = await (await fetch(`${base}/${a.id}`, { method: 'PUT', headers: JSON_HEADERS, body: JSON.stringify(spoof) })).json();
+    assert.equal(put.id, a.id);
+    assert.equal(put.createdAt, a.createdAt);
+
+    for (const item of [a, b]) await fetch(`${base}/${item.id}`, { method: 'DELETE' });
+  } finally {
+    await app.close();
+  }
+});
+
 test('{{resource}} rejects non-object bodies', async () => {
   const app = await start(0);
   try {

package/skills/idea2prototype/templates/features/auth-local/route.tmpl.mjs

@@ -3,7 +3,7 @@
 // Compose into other routes: import { requireAuth } from './auth.mjs'
 //   methods: { GET: requireAuth(async (ctx) => [200, { hello: ctx.user.username }]) }
 import { createHmac, randomUUID, scryptSync, timingSafeEqual } from 'node:crypto';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
 const USERS_FILE = join(process.cwd(), 'data', 'users.json');
@@ -11,22 +11,51 @@ const SECRET_FILE = join(process.cwd(), 'data', '.auth-secret');
 const COOKIE_NAME = 'i2p_session';
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 
-let usersCache = null;
+let usersReady = null; // memoized cold load: concurrent first callers share ONE array
 let secretCache = null;
 
-async function loadUsers() {
-  if (usersCache) return usersCache;
-  try {
-    usersCache = JSON.parse(await readFile(USERS_FILE, 'utf8'));
-  } catch {
-    usersCache = [];
+function loadUsers() {
+  if (!usersReady) {
+    usersReady = (async () => {
+      let usersCache = null;
+      let raw = null;
+      try {
+        raw = await readFile(USERS_FILE, 'utf8');
+      } catch (err) {
+        if (err?.code !== 'ENOENT') console.error(`[auth] could not read users store (${err?.code ?? err}) — starting empty`);
+      }
+      if (raw !== null) {
+        try {
+          usersCache = JSON.parse(raw);
+        } catch {
+          usersCache = null;
+        }
+      }
+      if (raw === null || usersCache === null || !Array.isArray(usersCache)) {
+        // A users store that exists but is corrupt must never be silently
+        // wiped — the next register would overwrite every account. Quarantine,
+        // say so, start empty (accounts can be re-registered; the old file is
+        // preserved). If the rename itself fails, say THAT loudly too.
+        if (raw !== null) {
+          const quarantine = `${USERS_FILE}.corrupt-${Date.now().toString(36)}`;
+          try {
+            await rename(USERS_FILE, quarantine);
+            console.error(`[auth] users store is not a valid JSON list — quarantined as ${quarantine}; starting empty`);
+          } catch (err) {
+            console.error(`[auth] users store is corrupt AND could not be quarantined (${err?.code ?? err}) — the next write will overwrite it`);
+          }
+        }
+        usersCache = [];
+      }
+      return usersCache;
+    })();
   }
-  return usersCache;
+  return usersReady;
 }
 
 async function persistUsers() {
   await mkdir(join(process.cwd(), 'data'), { recursive: true });
-  await writeFile(USERS_FILE, JSON.stringify(usersCache, null, 2));
+  await writeFile(USERS_FILE, JSON.stringify(await loadUsers(), null, 2));
 }
 
 async function getSecret() {
@@ -147,6 +176,11 @@ export default [
   {
     path: '/api/auth/logout',
     methods: {
+      // Clears the BROWSER cookie only. Session tokens are stateless HMAC —
+      // there is no server-side session store, so a token copied before
+      // logout keeps authenticating until it expires (SESSION_TTL_MS).
+      // Anything user-facing on top of this demo should shorten the TTL or
+      // add a server-side revocation list.
       POST: async () => [200, { ok: true }, { 'set-cookie': clearedCookie() }],
     },
   },

package/skills/idea2prototype/templates/features/rate-limit/route.tmpl.mjs

@@ -3,9 +3,7 @@
 // Compose into any route handler: import { rateLimit } from './ratelimit.mjs'
 //   methods: { GET: rateLimit({ max: 10, windowMs: 60_000 })(async (ctx) => [200, { ok: true }]) }
 
-const buckets = new Map(); // key -> { count, resetAt }
 const CLEANUP_INTERVAL_MS = 60_000;
-let lastCleanup = 0;
 
 /**
  * Wrap a route handler with a per-key fixed-window limiter.
@@ -15,8 +13,12 @@ let lastCleanup = 0;
  * e.g. keyFn: (ctx) => ctx.req.headers['x-forwarded-for'] ?? 'local'.
  * Over-limit requests get 429 + Retry-After; allowed ones pass
  * through with X-RateLimit-* headers merged into the response.
+ * Each rateLimit({...}) instance owns its OWN buckets: independently
+ * configured wrappers never drain each other's budget.
  */
 export function rateLimit({ max = 60, windowMs = 60_000, keyFn } = {}) {
+  const buckets = new Map(); // key -> { count, resetAt }
+  let lastCleanup = 0;
   return (handler) => async (ctx) => {
     const key = keyFn ? keyFn(ctx) : (ctx.req?.socket?.remoteAddress ?? 'local');
     const now = Date.now();

package/skills/idea2prototype/templates/features/rate-limit/test.tmpl.mjs

@@ -3,8 +3,8 @@ import assert from 'node:assert/strict';
 import { start } from '../server.mjs';
 import { rateLimit } from '../routes/ratelimit.mjs';
 
-// NOTE: both tests share the module-level rate buckets; the second test uses
-// custom keys so it is independent of the first test's IP bucket.
+// NOTE: each rateLimit({...}) instance owns its own buckets (the map lives
+// inside the factory) — that independence is pinned by the third test.
 
 test('GET /api/ping allows max then returns 429 with limit headers', async (t) => {
   const app = await start(0);
@@ -46,3 +46,23 @@ test('rateLimit: custom keyFn isolates clients into separate buckets', async ()
   const retryAfter = Number(second[2]['Retry-After']);
   assert.ok(retryAfter >= 59 && retryAfter <= 60, `unexpected Retry-After ${retryAfter}`);
 });
+
+test('rateLimit: independently configured wrappers never share budget', async () => {
+  // exhaust a tight limiter, then prove a loose limiter's FIRST request
+  // still sees a full budget (module-level buckets used to leak the count
+  // across wrappers — cross-route lockout)
+  const tight = rateLimit({ max: 1, windowMs: 60_000, keyFn: (ctx) => ctx.key })(
+    async () => [200, { which: 'tight' }],
+  );
+  const loose = rateLimit({ max: 50, windowMs: 60_000, keyFn: (ctx) => ctx.key })(
+    async () => [200, { which: 'loose' }],
+  );
+
+  await tight({ key: 'carol', req: {} }); // tight budget spent
+  assert.equal((await tight({ key: 'carol', req: {} }))[0], 429);
+
+  const [status, , headers] = await loose({ key: 'carol', req: {} }); // same client, other route
+  assert.equal(status, 200); // NOT locked out by the tight wrapper
+  assert.equal(headers['X-RateLimit-Limit'], '50');
+  assert.equal(headers['X-RateLimit-Remaining'], '49'); // full budget, not 48
+});

package/skills/idea2prototype/templates/features/upload/route.tmpl.mjs

@@ -1,28 +1,31 @@
 // Idea2Prototype feature: upload — multipart/form-data file uploads with a
 // zero-dependency parser. Files land in uploads/, served back by id.
 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
-import { extname, join } from 'node:path';
+import { basename, extname, join, sep } from 'node:path';
 import { randomUUID } from 'node:crypto';
 
 const UPLOAD_DIR = join(process.cwd(), 'uploads');
 const MAX_FILE_BYTES = 5 * 1024 * 1024;
 
-const MIME = {
+// Uploads are served from the app's own origin, so anything a browser would
+// EXECUTE (html, svg, js) must never come back as active content — that is
+// stored XSS riding the user's session. Only these passive types render
+// inline; everything else is sent as application/octet-stream + attachment.
+// Every response also carries nosniff + a sandboxing CSP (belt and braces).
+const INLINE_MIME = {
   '.txt': 'text/plain; charset=utf-8',
   '.md': 'text/plain; charset=utf-8',
   '.json': 'application/json; charset=utf-8',
   '.csv': 'text/csv; charset=utf-8',
-  '.html': 'text/html; charset=utf-8',
-  '.js': 'text/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
   '.png': 'image/png',
   '.jpg': 'image/jpeg',
   '.jpeg': 'image/jpeg',
   '.gif': 'image/gif',
-  '.svg': 'image/svg+xml',
   '.webp': 'image/webp',
-  '.pdf': 'application/pdf',
-  '.zip': 'application/zip',
+};
+const SAFE_HEADERS = {
+  'x-content-type-options': 'nosniff',
+  'content-security-policy': "default-src 'none'; sandbox",
 };
 
 // Parse a multipart/form-data buffer into parts. Minimal per RFC 7578: each
@@ -82,7 +85,8 @@ export default [
     methods: {
       GET: async ({ params }) => {
         const full = join(UPLOAD_DIR, params.name);
-        if (!full.startsWith(UPLOAD_DIR)) return [400, { error: 'bad path' }];
+        // sep-boundary: without it, a sibling like uploads-x/ would pass the prefix check
+        if (!full.startsWith(UPLOAD_DIR + sep)) return [400, { error: 'bad path' }];
         try {
           const fileStat = await stat(full);
           if (!fileStat.isFile()) return [404, { error: 'not found' }];
@@ -90,7 +94,15 @@ export default [
           return [404, { error: 'not found' }];
         }
         const data = await readFile(full);
-        return [200, data, { 'content-type': MIME[extname(full).toLowerCase()] ?? 'application/octet-stream' }];
+        const inline = INLINE_MIME[extname(full).toLowerCase()];
+        return [200, data, inline
+          ? { ...SAFE_HEADERS, 'content-type': inline }
+          : {
+              ...SAFE_HEADERS,
+              'content-type': 'application/octet-stream',
+              // re-sanitized: files dropped into uploads/ by hand skip safeName()
+              'content-disposition': `attachment; filename="${basename(full).replace(/[^a-zA-Z0-9._-]/g, '_')}"`,
+            }];
       },
     },
   },

package/skills/idea2prototype/templates/features/upload/test.tmpl.mjs

@@ -26,6 +26,29 @@ test('upload roundtrip: multipart POST then fetch back', async () => {
   }
 });
 
+// Stored XSS guard: an uploaded page must never render as active content on
+// the app's own origin — it comes back as an inert download instead.
+test('uploaded html/svg is served as an attachment, never as active content', async () => {
+  const app = await start(0);
+  const base = `http://127.0.0.1:${app.port}`;
+  try {
+    for (const [name, type] of [['evil.html', 'text/html'], ['evil.svg', 'image/svg+xml']]) {
+      const form = new FormData();
+      form.append('file', new Blob(['<script>alert(1)</script>'], { type }), name);
+      const info = await (await fetch(`${base}/api/uploads`, { method: 'POST', body: form })).json();
+      const fetched = await fetch(`${base}${info.url}`);
+      assert.equal(fetched.status, 200);
+      assert.equal(fetched.headers.get('content-type'), 'application/octet-stream');
+      assert.match(fetched.headers.get('content-disposition') ?? '', /^attachment; filename="[\w.-]+"$/);
+      assert.equal(fetched.headers.get('x-content-type-options'), 'nosniff');
+      assert.match(fetched.headers.get('content-security-policy') ?? '', /sandbox/);
+      await fetched.arrayBuffer();
+    }
+  } finally {
+    await app.close();
+  }
+});
+
 test('upload rejects non-multipart and unknown ids', async () => {
   const app = await start(0);
   const base = `http://127.0.0.1:${app.port}`;
@@ -42,6 +65,10 @@ test('upload rejects non-multipart and unknown ids', async () => {
 
     const traversal = await fetch(`${base}/api/uploads/..%2Fserver.mjs`);
     assert.ok(traversal.status === 400 || traversal.status === 404);
+
+    // a sibling directory sharing the prefix (uploads-x) must not pass the guard
+    const sibling = await fetch(`${base}/api/uploads/..%2Fuploads-x%2Fevil.html`);
+    assert.equal(sibling.status, 400);
   } finally {
     await app.close();
   }

package/skills/idea2prototype/templates/features/worker-jobs/jobs.tmpl.mjs

@@ -19,11 +19,31 @@ let ready = null; // memoized cold load: concurrent first callers share ONE arra
 function load() {
   if (!ready) {
     ready = (async () => {
+      let raw = null;
       try {
-        jobs = JSON.parse(await readFile(STORE_PATH, 'utf8'));
+        raw = await readFile(STORE_PATH, 'utf8');
       } catch (err) {
-        if (err?.code !== 'ENOENT') {
-          console.error(`[jobs] could not read ${STORE_PATH} (${err?.message ?? err}) — starting empty`);
+        if (err?.code !== 'ENOENT') console.error(`[jobs] could not read store (${err?.code ?? err}) — starting empty`);
+      }
+      if (raw !== null) {
+        try {
+          jobs = JSON.parse(raw);
+        } catch {
+          jobs = null;
+        }
+      }
+      if (raw === null || jobs === null || !Array.isArray(jobs)) {
+        // A store that exists but is corrupt must never be silently wiped —
+        // the next persist would overwrite recoverable job history. Quarantine
+        // it, say so loudly, start empty.
+        if (raw !== null) {
+          const quarantine = `${STORE_PATH}.corrupt-${Date.now().toString(36)}`;
+          try {
+            await rename(STORE_PATH, quarantine);
+            console.error(`[jobs] store is not a valid JSON list — quarantined as ${quarantine}; starting empty`);
+          } catch (err) {
+            console.error(`[jobs] store is corrupt AND could not be quarantined (${err?.code ?? err}) — the next write will overwrite it`);
+          }
         }
         jobs = [];
       }

package/skills/idea2prototype/templates/library/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "0.9.1",
+  "version": "1.0.1",
   "template": "library",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/web/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "0.9.1",
+  "version": "1.0.1",
   "template": "web",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/web/server.mjs

@@ -52,22 +52,42 @@ function matchRoute(route, url) {
 function readRawBody(req, limit = 10e6) {
   return new Promise((resolve, reject) => {
     let size = 0;
+    let tooLarge = false;
     const chunks = [];
     req.on('data', (chunk) => {
       size += chunk.length;
+      // Oversize policy: drain up to 2x limit so a clean 413 can still be
+      // delivered at end(); past 2x, destroy the socket to bound the cost of
+      // absorbing junk — those clients see a connection reset, deliberately.
       if (size > limit) {
-        reject(new Error('body too large'));
-        req.destroy();
+        tooLarge = true;
+        if (size > limit * 2) {
+          req.destroy();
+          const err = new Error('body too large');
+          err.code = 'BODY_TOO_LARGE';
+          reject(err);
+        }
       } else {
         chunks.push(chunk);
       }
     });
-    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('end', () => {
+      if (tooLarge) {
+        const err = new Error('body too large');
+        err.code = 'BODY_TOO_LARGE';
+        reject(err);
+      } else {
+        resolve(Buffer.concat(chunks));
+      }
+    });
     req.on('error', reject);
   });
 }
 
 function sendJson(res, status, payload, headers = {}) {
+  // Handlers are user code — a bogus status must degrade to a clean 500, not
+  // throw inside writeHead and leak Node internals ("Invalid status code: b").
+  if (!Number.isInteger(status) || status < 100 || status > 599) status = 500;
   if (status === 204 || status === 304) {
     res.writeHead(status, headers);
     return res.end();
@@ -76,7 +96,9 @@ function sendJson(res, status, payload, headers = {}) {
     res.writeHead(status, { 'content-length': payload.length, ...headers });
     return res.end(payload);
   }
-  const data = JSON.stringify(payload);
+  // [status] with no payload serializes as null — JSON.stringify(undefined)
+  // returns undefined and Buffer.byteLength would throw on it.
+  const data = JSON.stringify(payload ?? null);
   res.writeHead(status, {
     'content-type': 'application/json; charset=utf-8',
     'content-length': Buffer.byteLength(data),
@@ -105,7 +127,10 @@ export async function start(port = Number(process.env.PORT ?? 3000)) {
           try {
             raw = await readRawBody(req);
           } catch (err) {
-            return sendJson(res, 400, { error: err.message });
+            if (err.code === 'BODY_TOO_LARGE') {
+              return sendJson(res, 413, { error: 'body too large' });
+            }
+            return sendJson(res, 400, { error: String(err?.message ?? err) });
           }
           if ((req.headers['content-type'] ?? '').includes('multipart/form-data')) {
             ctx.rawBody = raw;
@@ -122,6 +147,12 @@ export async function start(port = Number(process.env.PORT ?? 3000)) {
         // ctx.res (e.g. Server-Sent Events) returns nothing — the stream
         // stays open past this request; don't try to send a JSON response.
         if (res.headersSent || res.writableEnded) return;
+        // Contract-violating returns (a bare string, undefined, ...) must be
+        // a clean 500 — destructuring them would leak parser plumbing
+        // ("result is not iterable") into the response.
+        if (!Array.isArray(result)) {
+          return sendJson(res, 500, { error: 'handler returned an invalid result (expected [status, payload, headers?])' });
+        }
         const [status, payload, headers] = result;
         return sendJson(res, status, payload, headers);
       }

package/skills/idea2prototype/templates/worker/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "0.9.1",
+  "version": "1.0.1",
   "template": "worker",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/worker/worker.mjs

@@ -14,11 +14,31 @@ let ready = null; // memoized cold load: concurrent first callers share ONE arra
 function load() {
   if (!ready) {
     ready = (async () => {
+      let raw = null;
       try {
-        jobs = JSON.parse(await readFile(STORE_PATH, 'utf8'));
+        raw = await readFile(STORE_PATH, 'utf8');
       } catch (err) {
-        if (err?.code !== 'ENOENT') {
-          console.error(`[jobs] could not read ${STORE_PATH} (${err?.message ?? err}) — starting empty`);
+        if (err?.code !== 'ENOENT') console.error(`[jobs] could not read store (${err?.code ?? err}) — starting empty`);
+      }
+      if (raw !== null) {
+        try {
+          jobs = JSON.parse(raw);
+        } catch {
+          jobs = null;
+        }
+      }
+      if (raw === null || jobs === null || !Array.isArray(jobs)) {
+        // A store that exists but is corrupt must never be silently wiped —
+        // the next persist would overwrite recoverable job history. Quarantine
+        // it, say so loudly, start empty.
+        if (raw !== null) {
+          const quarantine = `${STORE_PATH}.corrupt-${Date.now().toString(36)}`;
+          try {
+            await rename(STORE_PATH, quarantine);
+            console.error(`[jobs] store is not a valid JSON list — quarantined as ${quarantine}; starting empty`);
+          } catch (err) {
+            console.error(`[jobs] store is corrupt AND could not be quarantined (${err?.code ?? err}) — the next write will overwrite it`);
+          }
         }
         jobs = [];
       }