@anteros/core 0.0.19 → 0.0.21

package/server/api.ts

@@ -1,4 +1,4 @@
-import type { Hono } from "hono"
+import type { Hono, Context } from "hono"
 import { cfg, safePublicConfig } from "./config";
 import type { ApiOptions } from "../types/api";
 import { getCollection } from "../database/collection";
@@ -244,11 +244,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     }
 
     // ─── Collection API ─────────────────────────────────────────────────
-    app.post(API_PREFIX, async (c) => {
+    app.post(API_PREFIX, async (c: Context<{ Variables: HonoVariables }>) => {
         let response: any;
         let body: any;
         let rest: InstanceType<typeof useRest>;
-        let canAccessToAction: boolean | undefined;
 
         try {
             const ContentType = c.req.header('Content-Type');
@@ -274,6 +273,9 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
 
+            // Store tenant in request context so nested useRest() calls (hooks, actions) resolve it
+            requestCtxStorage.set('tenant_id', tenant_id);
+
             const col = getCollection(collection, tenant_id)
             if (!col) {
                 throw new AppError('Collection `' + collection + '` not found', { status: 400, code: 'COLLECTION_NOT_FOUND' });
@@ -344,31 +346,15 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             // ── Access control ──
-            const access = col?.api?.access as Record<string, boolean | Function> | undefined;
-
-            if (access?.['*'] !== undefined && access?.[action] === undefined) {
-                if (typeof access['*'] === 'function') {
-                    canAccessToAction = await access['*']({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-                } else {
-                    canAccessToAction = access['*'] as boolean;
-                }
-                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-            }
-
-            if (access?.[action] !== undefined) {
-                canAccessToAction = typeof access[action] === 'function'
-                    ? await (access[action] as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken })
-                    : access[action] as boolean;
-                if (canAccessToAction !== true) throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-            }
-
-            if (canAccessToAction !== true) {
-                throw new AppError('Unauthorized', { status: 401, code: 'ACCESS_DENIED_TO_PERFORM_THIS_ACTION' });
-            }
+            // Faille 7: single implementation via evaluateAccess (checks expired/forged tokens)
+            await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c);
 
             // ── Execute action ──
             if (col.actions?.[action]) {
-                response = await col.actions[action]({ rest, data: body?.data, error: fn.error });
+                response = await col.actions[action]({
+                    rest, data: body?.data, error: fn.error,
+                    io, jwt: func.jwt, token: accessToken,
+                });
             } else {
                 const handler = crudHandlers[action];
                 if (!handler) throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
@@ -415,6 +401,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             const { service, tenant_id } = c.req.param() as { service: string, tenant_id: string };
             if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
             if (!service) throw new AppError('Service is required', { status: 400, code: 'SERVICE_REQUIRED' });
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const serviceInstance = cfg.services?.find(s => s.name === service && s._tenant_ === tenant_id) as Service;
             const { action } = c.req.param() as { action: string };
@@ -457,6 +444,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colUpload = getFileCollection(collection, tenant_id);
             if (!colUpload) {
@@ -469,6 +457,16 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
             }
 
+            // Faille 11: reject oversized bodies BEFORE parseBody buffers them in memory
+            const contentLength = Number(c.req.header('Content-Length') ?? 0);
+            const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
+            // multipart overhead (boundaries/headers) ≈ 64KB max
+            if (Number.isFinite(contentLength) && contentLength > 0 && contentLength > maxUploadSize + 64 * 1024) {
+                throw new AppError(`Request too large (max ${Math.round(maxUploadSize / 1024 / 1024)}MB)`, {
+                    code: 'FILE_TOO_LARGE', status: 413,
+                });
+            }
+
             const formData = await c.req.parseBody();
             const fileField = formData['file'] || formData['upload'];
             if (!fileField || !(fileField instanceof File)) {
@@ -498,6 +496,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colServe = getFileCollection(collection, tenant_id);
             if (!colServe) {
@@ -505,10 +504,12 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
             await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
-            const filename = basename(c.req.param('file') as string);
-            if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {
+            // Faille 18: validate the RAW path before basename (checks were dead code)
+            const rawFile = c.req.param('file') as string;
+            if (!rawFile || rawFile.startsWith('.') || rawFile.includes('..') || rawFile.includes('/') || rawFile.includes('\\')) {
                 throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
             }
+            const filename = basename(rawFile);
             const fileId = filename.replace(/\.[^.]+$/, '');
 
             const query = c.req.query();
@@ -529,6 +530,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             c.header('Content-Type', result.mimetype);
             if (result.size) c.header('Content-Length', String(result.size));
             c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            // Faille 4: SVG served as attachment (no inline execution)
+            if (result.attachment) {
+                c.header('Content-Disposition', `attachment; filename="${filename}"`);
+            }
             return c.newResponse(result.stream);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
@@ -544,6 +549,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             if (!cfg.tenants.find(t => t.id === tenant_id)) {
                 throw new AppError('Tenant `' + tenant_id + '` not found', { status: 400, code: 'TENANT_NOT_FOUND' });
             }
+            requestCtxStorage.set('tenant_id', tenant_id);
 
             const colDelete = getFileCollection(collection, tenant_id);
             if (!colDelete) {
@@ -567,7 +573,8 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     // ─── Public config ──────────────────────────────────────────────────
     app.get('/_dnax/config/:tenant_id', (c) => {
         const t = c.get('token');
-        if (!t?.value) {
+        // Faille 6: require a VERIFIED, non-expired token (not just any provided value)
+        if (!t?.decoded || t?.expired || !t?.provided) {
             return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
         }
         const { tenant_id } = c.req.param() as { tenant_id: string };

package/server/boot.ts

@@ -16,7 +16,12 @@ import { io, engineIo, websocket } from './io'
 import { loadServices } from '../lib/services'
 import { loadSockets } from '../lib/sockets'
 import { syncWorkflows } from '../lib/workflow'
+import { syncMcpTools } from '../lib/mcp'
 import { loadTenantsMiddlewares } from '../lib/middleware'
+import crypto from 'node:crypto';
+import os from 'node:os';
+import { registerMetrics, getMetrics, trackRequest } from './metrics';
+import { startMaster, aggregateMetrics } from './cluster';
 
 /** Check if a TCP port is already bound */
 async function isPortInUse(port: number): Promise<boolean> {
@@ -46,6 +51,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         await loadServices(); // load services
         await loadSockets(); // load websocket handlers
         await syncWorkflows();
+        await syncMcpTools(); // load MCP tools per tenant (mcp/**/*.tool.ts)
         await loadTenantsMiddlewares();
         loadRoutes(); // load routes
         //******************************* */
@@ -55,9 +61,8 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
         const hasAuth = cfg.collections?.some((c: any) => c.api?.auth?.enabled);
         let jwtSecret = cfg.server.jwt?.secret || Bun.env.JWT_SECRET;
         if (hasAuth && !jwtSecret) {
-            jwtSecret = Array.from({ length: 64 }, () =>
-                'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_'[Math.floor(Math.random() * 64)]
-            ).join('');
+            // CSPRNG: crypto.randomBytes (not Math.random — predictable)
+            jwtSecret = crypto.randomBytes(48).toString('base64url');
             try {
                 const envPath = '.env';
                 const exists = await Bun.file(envPath).exists();
@@ -76,16 +81,51 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         const PORT = (cfg.server.port || 4000);
         const NAME = cfg.server.name || process.env.APP_NAME || 'SERVER';
-        const useClusterMode = cfg.clusterMode || false;
-        const env = process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev';
-        // reusePort: cluster mode ON by default, dev mode OFF to detect zombies
-        const reusePort = cfg.server.reusePort ?? (useClusterMode && env !== 'dev');
+        // Widened to `string`: TS narrows `process.env.NODE_ENV` to a literal union
+        // ('development' | 'production' | 'test') and drops the 'dev' fallback branch.
+        const env: string = process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev';
+        // Bun's SO_REUSEPORT: multiple processes can bind the same port (spawn them yourself)
+        const reusePort = cfg.server.reusePort ?? false;
+        const isWorker = process.env.BUN_WORKER !== undefined;
+
+        // ── MASTER (cluster): spawn workers, aggregate metrics, supervise ──
+        if (reusePort && !isWorker) {
+            const workersCount = cfg.server.workers ?? os.availableParallelism();
+            console.log(`[cluster] Master ${process.pid} spawning ${workersCount} workers…`.gray.bold);
+
+            const master = startMaster({
+                workers: workersCount,
+                argv: [process.execPath, ...process.argv.slice(1)],
+                env: { ...(process.env as Record<string, string>) },
+            });
+
+            // Supervision port: aggregated /health (master does NOT serve the main port)
+            const metricsPort = cfg.server.metricsPort ?? PORT + 1;
+            const metricsServer = Bun.serve({
+                port: metricsPort,
+                fetch: (req) => {
+                    if (new URL(req.url).pathname === '/health') {
+                        return Response.json({
+                            status: 'ok',
+                            master: { pid: process.pid },
+                            ...aggregateMetrics(master.metrics()),
+                        });
+                    }
+                    return new Response('Not found', { status: 404 });
+                },
+            });
+
+            console.log(`[cluster] Aggregated /health → http://localhost:${metricsPort}/health`.gray);
+
+            // Keep the master alive
+            return { master, metricsServer } as any;
+        }
 
-        // Detect zombie: check if port is already in use in dev mode
+        // Detect zombie: check if port is already in use when NOT sharing the port
         if (!reusePort && env === 'dev') {
             const occupied = await isPortInUse(PORT);
             if (occupied) {
-                console.error(`\n⚠ Port ${PORT} is already in use. Possible zombie server.\n  → Kill it: lsof -ti :${PORT} | xargs kill -9\n  → Or set server.reusePort: true in config\n`.red.bold);
+                console.error(`\n⚠ Port ${PORT} is already in use. Possible zombie server.\n  → Kill it: lsof -ti :${PORT} | xargs kill -9\n`.red.bold);
                 process.exit(1);
             }
         }
@@ -95,25 +135,47 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         const server = Bun.serve({
             port: PORT,
-            reusePort,
+            reusePort: reusePort || isWorker,
             fetch: (req, server) => {
                 const url = new URL(req.url);
 
+                // Track every request for the built-in metrics (zero dependency)
+                const respond = (p: Response | Promise<Response>) =>
+                    Promise.resolve(p).then((res) => {
+                        trackRequest(req, res);
+                        return res;
+                    });
+
                 if (url.pathname === "/socket.io/") {
-                    return engineIo.handleRequest(req, server);
-                } else {
-                    return app.fetch(req, server);
+                    return respond(engineIo.handleRequest(req, server));
                 }
-
+                return respond(app.fetch(req, server));
             },
             websocket: websocket,
             maxRequestBodySize: 1024 * 1024 * 100, // 100MB
         })
 
+        // Register server for built-in metrics (GET /health)
+        registerMetrics(server);
+
+        // ── WORKER (cluster): report metrics to the master via IPC ──
+        if (isWorker && typeof process.send === 'function') {
+            setInterval(() => {
+                try {
+                    process.send!({
+                        type: 'metrics',
+                        pid: process.pid,
+                        metrics: getMetrics(),
+                    });
+                } catch {}
+            }, 5000);
+        }
+
         let box = '';
-        box += `${NAME}`.gray.underline + ` (PID: ${process.pid})\n\n`
+        const role = isWorker ? 'worker' : (reusePort ? 'master' : 'standalone');
+        box += `${NAME}`.gray.underline + ` (PID: ${process.pid}) — ${role}\n\n`
         box += `Env: ${env || 'dev'}`.green.bold + '\n'
-        box += `Cluster mode: ${useClusterMode ? 'On'.green.bold : 'Off'.red.bold}\n`.gray.bold
+        box += `reusePort: ${(reusePort || isWorker) ? 'On'.green.bold : 'Off'.red.bold}\n`.gray.bold
         box += `Url: http://localhost:${PORT}`.gray.bold;
         box += '\n\n';
         box += `Last boot: 🔄 ${dayjs().format('YYYY-MM-DD HH:mm:ss')}`.gray;

package/server/cluster.ts

@@ -0,0 +1,177 @@
+import type { Subprocess } from "bun";
+import type { MetricsSnapshot } from "./metrics";
+
+// ─── Master/worker cluster over Bun.reusePort + IPC ──────────────────────────
+//
+// Each worker is a full server bound to the same port (SO_REUSEPORT, round-robin
+// by the kernel). The master only supervises workers and aggregates their
+// metrics — it never serves the main HTTP port.
+
+export type MasterMetrics = Record<number, MetricsSnapshot>;
+
+export type MasterHandle = {
+  /** Currently running worker PIDs */
+  workers: { pid: number }[];
+  /** Latest metrics snapshot per worker PID (may be empty until first report) */
+  metrics(): MasterMetrics;
+  /** Kill + respawn a specific worker */
+  restart(pid: number): void;
+  /** Kill all workers */
+  shutdown(): void;
+};
+
+export type AggregatedMetrics = {
+  workers: number;
+  uptime: { min: number; max: number };
+  requests: {
+    total: number;
+    active: number;
+    errors: number;
+    perSecond: number;
+    byMethod: Record<string, number>;
+    byStatus: Record<string, number>;
+  };
+  memory: { rss: number; heapUsed: number };
+  cpu: { percent: number; cores: number };
+  pids: number[];
+};
+
+type WorkerEntry = {
+  proc: Subprocess;
+  metrics: MetricsSnapshot | null;
+  restarts: number;
+};
+
+const MAX_RESTARTS = 10;
+
+export function startMaster(options: {
+  workers: number;
+  argv: string[];
+  env: Record<string, string>;
+}): MasterHandle {
+  const { workers, argv, env } = options;
+  const entries = new Map<number, WorkerEntry>();
+  let stopping = false;
+
+  const spawn = (): number => {
+    const proc = Bun.spawn(argv, {
+      env: { ...env, BUN_WORKER: '1' },
+      stdout: 'inherit',
+      stderr: 'inherit',
+      ipc: (message: any) => {
+        if (message && typeof message === 'object' && message.type === 'metrics') {
+          const entry = entries.get(message.pid as number);
+          if (entry && message.metrics) {
+            entry.metrics = message.metrics as MetricsSnapshot;
+          }
+        }
+      },
+    });
+
+    entries.set(proc.pid, { proc, metrics: null, restarts: 0 });
+
+    proc.exited.then((code) => {
+      const entry = entries.get(proc.pid);
+      if (!entry) return;
+      entries.delete(proc.pid);
+
+      console.log(`[cluster] Worker ${proc.pid} exited (code ${code})`.yellow);
+      if (stopping) return;
+
+      if (entry.restarts >= MAX_RESTARTS) {
+        console.error(`[cluster] Worker ${proc.pid} exceeded ${MAX_RESTARTS} restarts — giving up`.red.bold);
+        return;
+      }
+
+      // Auto-respawn
+      const newPid = spawn();
+      const fresh = entries.get(newPid);
+      if (fresh) fresh.restarts = entry.restarts + 1;
+      console.log(`[cluster] Respawned worker ${proc.pid} → ${newPid} (attempt ${entry.restarts + 1})`.gray);
+    });
+
+    return proc.pid;
+  };
+
+  for (let i = 0; i < workers; i++) {
+    spawn();
+  }
+
+  return {
+    get workers() {
+      return [...entries.keys()].map((pid) => ({ pid }));
+    },
+
+    metrics() {
+      const out: MasterMetrics = {};
+      for (const [pid, entry] of entries) {
+        if (entry.metrics) out[pid] = entry.metrics;
+      }
+      return out;
+    },
+
+    restart(pid: number) {
+      const entry = entries.get(pid);
+      if (!entry) return;
+      entry.proc.kill();
+      // respawn happens in the proc.exited handler
+    },
+
+    shutdown() {
+      stopping = true;
+      for (const [, entry] of entries) {
+        entry.proc.kill();
+      }
+      entries.clear();
+    },
+  };
+}
+
+/** Merge per-worker snapshots into a single cluster-wide view. */
+export function aggregateMetrics(metrics: MasterMetrics): AggregatedMetrics {
+  const snapshots = Object.values(metrics);
+  const empty: AggregatedMetrics = {
+    workers: 0,
+    uptime: { min: 0, max: 0 },
+    requests: { total: 0, active: 0, errors: 0, perSecond: 0, byMethod: {}, byStatus: {} },
+    memory: { rss: 0, heapUsed: 0 },
+    cpu: { percent: 0, cores: 0 },
+    pids: [],
+  };
+
+  if (!snapshots.length) return empty;
+
+  const workers = snapshots.length;
+  const maxUptime = Math.max(...snapshots.map((m) => m.uptime));
+  const minUptime = Math.min(...snapshots.map((m) => m.uptime));
+  const totalReqs = snapshots.reduce((sum, m) => sum + m.requests.total, 0);
+
+  const byMethod: Record<string, number> = {};
+  const byStatus: Record<string, number> = {};
+  for (const m of snapshots) {
+    for (const [k, v] of Object.entries(m.requests.byMethod)) byMethod[k] = (byMethod[k] ?? 0) + v;
+    for (const [k, v] of Object.entries(m.requests.byStatus)) byStatus[k] = (byStatus[k] ?? 0) + v;
+  }
+
+  return {
+    workers,
+    uptime: { min: minUptime, max: maxUptime },
+    requests: {
+      total: totalReqs,
+      active: snapshots.reduce((sum, m) => sum + m.pendingRequests, 0),
+      errors: snapshots.reduce((sum, m) => sum + m.requests.errors, 0),
+      perSecond: maxUptime > 0 ? Math.round(totalReqs / maxUptime) : 0,
+      byMethod,
+      byStatus,
+    },
+    memory: {
+      rss: snapshots.reduce((sum, m) => sum + m.memory.rss, 0),
+      heapUsed: snapshots.reduce((sum, m) => sum + m.memory.heapUsed, 0),
+    },
+    cpu: {
+      percent: Math.round((snapshots.reduce((sum, m) => sum + m.cpu.percent, 0) / workers) * 10) / 10,
+      cores: snapshots[0]?.cpu.cores ?? 0,
+    },
+    pids: snapshots.map((m) => m.pid),
+  };
+}

package/server/config.ts

@@ -15,7 +15,6 @@ const cfg: Config = { // app Config
 
 function formatConfig(config: ServerConfig) { // format the config
 
-    cfg.clusterMode = config.clusterMode ?? true;
     cfg.server = {
         ...cfg.server,
         ...config.server,

package/server/env.ts

@@ -1,6 +1,8 @@
 /**
  * Hono context variables shared by middleware and route handlers.
  */
+import type { ConnInfo } from "hono/conninfo";
+
 export type HonoVariables = {
     /** Present when `Authorization: Bearer <jwt>` was sent and verification succeeded. */
     token?: {
@@ -13,4 +15,8 @@ export type HonoVariables = {
         /** Whether the token is expired */
         expired: boolean;
     };
+    /** Best-effort client IP, resolved once per request (real socket, or trusted proxy header when cfg.server.trustProxy). */
+    clientIp?: string;
+    /** Connection info (real socket address) — set once per request by the IP middleware. */
+    connInfo?: ConnInfo;
 };