@anteros/core 0.0.39 → 0.0.41

package/lib/lifecycle.ts

@@ -0,0 +1,141 @@
+import path from "path";
+import fs from "fs/promises";
+import { cfg } from "../server/config";
+import { useRest } from "../database/rest";
+import { logger } from "../utils/logger";
+import {
+    replicationNow,
+    getReplicationState,
+    resetReplication,
+    seedReplication,
+} from "../database/replication";
+import type { Lifecycle, LifecycleReason } from "../types/lifecycle";
+import type { Tenant } from "../types/tenant";
+import type { TenantReplicationApi } from "../types/replication";
+
+/**
+ * Tenant-scoped replication API — like `rest`, the tenant is implicit. Built per
+ * tenant for the lifecycle context, so hooks never pass a tenant id.
+ */
+function tenantReplication(tenantId: string): TenantReplicationApi {
+    return {
+        now: () => replicationNow(tenantId),
+        state: (destinationId?: string, collection?: string) => getReplicationState(tenantId, destinationId, collection),
+        reset: (opts) => resetReplication(tenantId, opts),
+        seed: (value, opts) => seedReplication(tenantId, value, opts),
+    };
+}
+
+/** Lifecycles by tenant id — one `{tenant.dir}/lifecycle.ts` per tenant. */
+const lifecycles = new Map<string, Lifecycle>();
+/** Ensures `onDestroy` runs at most once per process. */
+let destroyed = false;
+
+/**
+ * Load `{tenant.dir}/lifecycle.ts` for every tenant. A missing file is fine —
+ * a tenant simply has no lifecycle.
+ */
+async function loadLifecycles(): Promise<void> {
+    lifecycles.clear();
+    destroyed = false;
+    for (const tenant of cfg.tenants ?? []) {
+        try {
+            const file = path.join(process.cwd(), tenant.dir, "lifecycle.ts");
+            if (!(await fs.exists(file))) continue;
+            const module = await import(file);
+            const lifecycle = module?.default;
+            if (lifecycle?._isLifecycle_) {
+                lifecycles.set(tenant.id, { ...lifecycle, _tenant_: tenant.id });
+            }
+        } catch (err: any) {
+            logger.file("error", "lifecycle: failed to load", { tenant: tenant.id, error: err?.message });
+        }
+    }
+}
+
+/** Tenant-scoped context passed to every hook. */
+function buildContext(tenant: Tenant, extra?: Record<string, any>) {
+    return {
+        tenant,
+        rest: new useRest({ tenant_id: tenant.id }),
+        logger,
+        cfg,
+        replication: tenantReplication(tenant.id),
+        ...(extra ?? {}),
+    } as any;
+}
+
+/**
+ * Run every `beforeBoot` hook, sequentially in `cfg.tenants` order. Blocking:
+ * a throwing hook aborts the boot (fail-fast).
+ */
+async function runBeforeBoot(): Promise<void> {
+    for (const tenant of cfg.tenants ?? []) {
+        const lifecycle = lifecycles.get(tenant.id);
+        if (!lifecycle?.enabled || !lifecycle.beforeBoot) continue;
+        try {
+            await lifecycle.beforeBoot(buildContext(tenant));
+            logger.file("lifecycle: beforeBoot", { tenant: tenant.id });
+        } catch (err: any) {
+            logger.error(`lifecycle beforeBoot failed for tenant '${tenant.id}'`, { error: err?.message, stack: err?.stack });
+            throw new Error(`[${tenant.id}] lifecycle beforeBoot failed: ${err?.message ?? err}`);
+        }
+    }
+}
+
+/**
+ * Run every `afterBoot` hook once the server is listening. Errors are logged
+ * but never fatal — the server is already serving.
+ */
+async function runAfterBoot(server: any, io: any): Promise<void> {
+    for (const tenant of cfg.tenants ?? []) {
+        const lifecycle = lifecycles.get(tenant.id);
+        if (!lifecycle?.enabled || !lifecycle.afterBoot) continue;
+        try {
+            await lifecycle.afterBoot(buildContext(tenant, { io, server }));
+            logger.file("lifecycle: afterBoot", { tenant: tenant.id });
+        } catch (err: any) {
+            logger.error(`lifecycle afterBoot failed for tenant '${tenant.id}'`, { error: err?.message });
+        }
+    }
+}
+
+/** Bound a promise with a timeout that rejects. */
+function withTimeout<T>(promise: Promise<T>, ms: number, message: string): Promise<T> {
+    let timer: ReturnType<typeof setTimeout>;
+    const timeout = new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new Error(message)), ms);
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer)) as Promise<T>;
+}
+
+/**
+ * Run every `onDestroy` hook on shutdown (once per process), before replication
+ * stops and DB clients close. Each hook is bounded by `destroyTimeout`.
+ */
+async function runOnDestroy(reason: LifecycleReason): Promise<void> {
+    if (destroyed) return;
+    destroyed = true;
+
+    for (const tenant of cfg.tenants ?? []) {
+        const lifecycle = lifecycles.get(tenant.id);
+        if (!lifecycle?.enabled || !lifecycle.onDestroy) continue;
+        try {
+            await withTimeout(
+                Promise.resolve(lifecycle.onDestroy(buildContext(tenant, { reason }))),
+                lifecycle.destroyTimeout ?? 10_000,
+                `lifecycle onDestroy timed out after ${lifecycle.destroyTimeout ?? 10_000}ms`,
+            );
+            logger.file("lifecycle: onDestroy", { tenant: tenant.id, reason });
+        } catch (err: any) {
+            logger.error(`lifecycle onDestroy failed for tenant '${tenant.id}'`, { error: err?.message });
+        }
+    }
+}
+
+export {
+    loadLifecycles,
+    runBeforeBoot,
+    runAfterBoot,
+    runOnDestroy,
+};

package/lib/redact.ts

@@ -0,0 +1,117 @@
+import { cfg } from "../server/config";
+
+/**
+ * Keys whose value is replaced by `[redacted]` before an audit entry is stored
+ * (in `_audit_` **and** in the local file backup), at any depth.
+ *
+ * Override with `server.audit.redact: ['…']`, disable with `server.audit.redact: false`.
+ */
+const DEFAULT_REDACT_KEYS = [
+    'password',
+    'passwd',
+    'pwd',
+    'token',
+    'auth_token',
+    'access_token',
+    'refresh_token',
+    'id_token',
+    'authorization',
+    'apikey',
+    'api_key',
+    'key',
+    'secret',
+    'cookie',
+    'session_id',
+    'otp',
+    'pin',
+]
+
+const REDACTED = '[redacted]'
+
+/** Depth guard — a pathological payload must never cost more than a bounded walk */
+const MAX_DEPTH = 8
+
+// Cache initialised for the default state (`redact` unset) — a sentinel like
+// `undefined` would be indistinguishable from the real, unset configuration.
+let cachedConfig: unknown = undefined
+let cachedKeys: Set<string> | null = new Set(DEFAULT_REDACT_KEYS.map((key) => key.toLowerCase()))
+
+/** Lower-cased redaction keys, or `null` when redaction is disabled */
+function redactKeys(): Set<string> | null {
+    const configured = cfg.server?.audit?.redact
+    if (configured !== cachedConfig) {
+        cachedConfig = configured
+        cachedKeys = configured === false
+            ? null
+            : new Set((configured ?? DEFAULT_REDACT_KEYS).map((key) => key.toLowerCase()))
+    }
+    return cachedKeys
+}
+
+/**
+ * Is this key sensitive? Exact match, case-insensitive, `-`/`.` normalised to `_`
+ * (`api-key` → `api_key`), plus the usual header prefix (`x-api-key` → `api_key`).
+ *
+ * Deliberately **not** a substring match: `key` must not match `monkey`.
+ */
+function isSensitiveKey(name: string, keys: Set<string>): boolean {
+    const normalized = name.toLowerCase().replace(/[-.]/g, '_')
+    if (keys.has(normalized)) return true
+    if (normalized.startsWith('x_')) return keys.has(normalized.slice(2))
+    return false
+}
+
+/**
+ * Replace the value of every sensitive key (see `isSensitiveKey`), at any depth.
+ * Arrays are traversed; **non-plain objects** (`Date`, `ObjectId`, `Buffer`,
+ * `Map`…) are left untouched so stored types are never altered.
+ *
+ * Returns the **same reference** when nothing matched — the common case (no
+ * sensitive key in the payload) costs the walk but no allocation.
+ */
+function redact(value: any, keys: Set<string>, depth = 0): any {
+    if (value === null || typeof value !== 'object' || depth > MAX_DEPTH) return value
+
+    if (Array.isArray(value)) {
+        let changed = false
+        const out = value.map((item) => {
+            const next = redact(item, keys, depth + 1)
+            if (next !== item) changed = true
+            return next
+        })
+        return changed ? out : value
+    }
+
+    const proto = Object.getPrototypeOf(value)
+    if (proto !== Object.prototype && proto !== null) return value
+
+    let changed = false
+    const out: Record<string, any> = {}
+    for (const [name, item] of Object.entries(value)) {
+        if (isSensitiveKey(name, keys)) {
+            out[name] = REDACTED
+            changed = true
+            continue
+        }
+        const next = redact(item, keys, depth + 1)
+        if (next !== item) changed = true
+        out[name] = next
+    }
+    return changed ? out : value
+}
+
+/** Redact an audit payload — `input`, `result`, `meta` or `request` */
+function redactPayload(value: any): any {
+    const keys = redactKeys()
+    if (!keys || value === undefined || value === null) return value
+    return redact(value, keys)
+}
+
+export {
+    DEFAULT_REDACT_KEYS,
+    REDACTED,
+    redactKeys,
+    isSensitiveKey,
+    redactPayload,
+    redact,
+}

package/lib/workflow.ts

@@ -28,7 +28,7 @@ async function syncWorkflows() {
             }
         }
 
-        // Créer les indexes sur _workflows_ pour les contextes définis
+        // Create the indexes on _workflows_ for the defined contexts
         for (const [key, wf] of workflows) {
           const tenantId = key.split(':')[0]
           if (!wf.context || !tenantId) continue

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/server/api.ts

@@ -15,9 +15,12 @@ import { getTenantMiddlewares } from "../lib/middleware";
 import type { ActivityInput } from "../types/activity";
 import * as os from 'node:os';
 import { basename } from 'node:path';
-import { handleUpload, handleServe, handleDelete } from "../lib/files";
+import { handleUpload, handleServe, handleDelete, type FileResult } from "../lib/files";
+import { getVarsDefinition } from "../database/vars";
+import { getTenant } from "../database/tenant";
 const API_PREFIX = '/api/:tenant_id/:collection/:action';
 const SERVICE_PREFIX = '/services/:tenant_id/:service/:action';
+const VARS_PREFIX = '/vars/:tenant_id/:action';
 const UPLOAD_PREFIX = '/upload/:tenant_id/:collection';
 const FILES_PREFIX = '/files/:tenant_id/:collection/:file';
 
@@ -346,15 +349,14 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
 
             // ── Access control ──
-            // Faille 7: single implementation via evaluateAccess (checks expired/forged tokens)
+            // Flaw 7: single implementation via evaluateAccess (checks expired/forged tokens)
             await evaluateAccess(col?.api?.access as any, action, rest, 'Action', c);
 
             // ── Execute action ──
             if (col.actions?.[action]) {
-                response = await col.actions[action]({
-                    rest, data: body?.data, error: fn.error,
-                    io, jwt: func.jwt, token: accessToken,
-                });
+                // Delegated to `rest.runAction` so the invocation is audited once,
+                // with the same context (`rest`, `io`, `data`, `token`, …)
+                response = await rest.runAction(collection, action, body?.data);
             } else {
                 const handler = crudHandlers[action];
                 if (!handler) throw new AppError('Action `' + action + '` not found', { status: 400, code: 'ACTION_NOT_FOUND' });
@@ -382,6 +384,97 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
         }
     });
 
+    // ─── Vars API ───────────────────────────────────────────────────────
+    app.post(VARS_PREFIX, async (c) => {
+        let rest: InstanceType<typeof useRest> | undefined;
+        let tenant_id = '';
+        let action = '';
+        let ns = '';
+        let body: any;
+        const logStart = Date.now();
+        try {
+            const ContentType = c.req.header('Content-Type');
+            if (ContentType?.includes('application/json')) {
+                try { body = await c.req.json(); } catch {
+                    throw new AppError('Invalid JSON body', { status: 400, code: 'INVALID_JSON_BODY' });
+                }
+            } else {
+                body = {};
+            }
+
+            const params = c.req.param() as { tenant_id: string; action: string };
+            tenant_id = params.tenant_id;
+            action = params.action;
+            ns = body?.ns;
+
+            if (!tenant_id) throw new AppError('Tenant ID is required', { status: 400, code: 'TENANT_ID_REQUIRED' });
+            if (!action) throw new AppError('Action is required', { status: 400, code: 'ACTION_REQUIRED' });
+            if (!ns) throw new AppError('Variables namespace is required', { status: 400, code: 'NAMESPACE_REQUIRED' });
+            if (!getTenant(tenant_id)) throw new AppError('Tenant not found', { status: 400, code: 'TENANT_NOT_FOUND' });
+
+            requestCtxStorage.set('tenant_id', tenant_id);
+
+            // Only namespaces declared with `define.Vars` are reachable, and their
+            // `api.access` gates every action (no rules = denied).
+            const definition = getVarsDefinition(tenant_id, ns);
+            if (!definition) throw new AppError(`Variables namespace '${ns}' not found`, { status: 400, code: 'NAMESPACE_NOT_FOUND' });
+
+            rest = new useRest({ internal: false, tenant_id });
+            await evaluateAccess(definition.api?.access as any, action, rest, `vars:${ns}`, c);
+
+            const vars = rest.vars;
+            const { key, value, meta, ttl, scope, where, entries, by } = body ?? {};
+            let response: any;
+
+            switch (action) {
+                case 'set': await vars.set(ns, key, value, { meta, ttl, scope }); response = { ok: true }; break;
+                case 'setMany': await vars.setMany(ns, entries ?? {}, { meta, ttl, scope }); response = { ok: true }; break;
+                case 'get': response = { value: await vars.get(ns, key, { scope }) }; break;
+                case 'entry': response = { entry: await vars.entry(ns, key, { scope }) }; break;
+                case 'entries': response = { entries: await vars.entries(ns, { scope, where }) }; break;
+                case 'all': response = { vars: await vars.all(ns, { scope, where }) }; break;
+                case 'del': response = { ok: await vars.del(ns, key, { scope }) }; break;
+                case 'has': response = { exists: await vars.has(ns, key, { scope }) }; break;
+                case 'incr': response = { value: await vars.incr(ns, key, by, { scope, ttl }) }; break;
+                case 'expire': response = { ok: await vars.expire(ns, key, ttl, { scope }) }; break;
+                case 'clear': response = { deleted: await vars.clear(ns, { scope }) }; break;
+                default: throw new AppError(`Action '${action}' not found`, { status: 400, code: 'ACTION_NOT_FOUND' });
+            }
+
+            // Audit — never store `value` / `meta` (they may hold secrets).
+            const accessToken = getAccessToken(c);
+            await logActivity({
+                rest,
+                tenant_id,
+                action,
+                collection: `_vars_:${ns}`,
+                status: 'success',
+                input: { ns, key, scope, ttl },
+                result: ['get', 'all', 'entry', 'entries'].includes(action) ? response : undefined,
+                duration: Date.now() - logStart,
+                token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
+            });
+            return c.json(response);
+        } catch (err: any) {
+            if (cfg?.debug) console.error(err);
+            if (rest && tenant_id && ns) {
+                const accessToken = getAccessToken(c);
+                await logActivity({
+                    rest,
+                    tenant_id,
+                    action,
+                    collection: `_vars_:${ns}`,
+                    status: 'error',
+                    input: { ns },
+                    error: { message: err?.message, code: err?.code || 'INTERNAL_VARS_ERROR' },
+                    duration: Date.now() - logStart,
+                    token: { decoded: accessToken.decoded, value: null, provided: true, expired: false },
+                }).catch(() => {});
+            }
+            return errorResponse(c, err);
+        }
+    });
+
     // ─── Service API ────────────────────────────────────────────────────
     app.post(SERVICE_PREFIX, async (c) => {
         try {
@@ -415,21 +508,10 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             const serviceAccess = serviceInstance.api?.access as Record<string, boolean | Function> | undefined;
             await evaluateAccess(serviceAccess as any, action, rest, action, c);
 
-            // Re-read accessToken for the action handler
-            const accessToken = getAccessToken(c);
-
-            const logStart = Date.now();
-            try {
-                const response = await serviceInstance.actions[action]({
-                    data: body?.data, error: fn.error, io, jwt: func.jwt, token: accessToken, rest,
-                });
-
-                await logActivity({ rest, tenant_id, action, collection: service, status: 'success', input: body?.data, result: response, duration: Date.now() - logStart, token: { decoded: accessToken.decoded, value: null, provided: true, expired: false } });
-                return c.json(response);
-            } catch (err: any) {
-                await logActivity({ rest, tenant_id, action, collection: service, status: 'error', input: body?.data, error: { message: err?.message, code: err?.code || 'INTERNAL_SERVICE_ERROR' }, duration: Date.now() - logStart, token: { decoded: accessToken.decoded, value: null, provided: true, expired: false } }).catch(() => {});
-                throw err;
-            }
+            // No `logActivity` here: the call is delegated to `rest.runService()`, which
+            // audits it once (`action: 'runService'`, `internal: false`, params only)
+            const response = await rest.runService(service, action, body?.data);
+            return c.json(response);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
             return errorResponse(c, err);
@@ -457,7 +539,9 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
             }
 
-            // Faille 11: reject oversized bodies BEFORE parseBody buffers them in memory
+            // Security: reject oversized bodies BEFORE parseBody buffers them in memory.
+            // `maxSize` doubles as the TOTAL request allowance → a multi-file upload must
+            // fit within it (each file is also validated individually in handleUpload).
             const contentLength = Number(c.req.header('Content-Length') ?? 0);
             const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
             // multipart overhead (boundaries/headers) ≈ 64KB max
@@ -467,21 +551,38 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 });
             }
 
-            const formData = await c.req.parseBody();
-            const fileField = formData['file'] || formData['upload'];
-            if (!fileField || !(fileField instanceof File)) {
+            const formData = await c.req.parseBody({ all: true }); // repeated fields → arrays; a single occurrence stays a single value
+
+            // Collect files from both accepted field names (single or multiple)
+            const files: File[] = [];
+            for (const key of ['file', 'upload']) {
+                const raw = formData[key];
+                const values = Array.isArray(raw) ? raw : raw ? [raw] : [];
+                for (const value of values) {
+                    if (value instanceof File) files.push(value);
+                }
+            }
+            if (!files.length) {
                 throw new AppError('No file provided. Use field name "file" or "upload".', { code: 'FILE_REQUIRED', status: 400 });
             }
 
+            // Metadata: non-file fields. Single value → scalar (unchanged contract),
+            // repeated under the same name → array.
             const data: Record<string, any> = {};
             for (const [key, value] of Object.entries(formData)) {
-                if (key !== 'file' && key !== 'upload' && !(value instanceof File)) {
-                    data[key] = value;
-                }
+                if (key === 'file' || key === 'upload') continue;
+                const list = (Array.isArray(value) ? value : [value]) as any[];
+                if (list.some((v) => v instanceof File)) continue;
+                data[key] = list.length === 1 ? list[0] : list;
             }
 
-            const result = await handleUpload({ collection, tenant_id, file: fileField, data });
-            return c.json(result);
+            // One document per file (per-file validation: MIME, size, storage, replication).
+            // 1 file → single object (backward compatible), N files → array (SDK contract).
+            const results: FileResult[] = [];
+            for (const file of files) {
+                results.push(await handleUpload({ collection, tenant_id, file, data }));
+            }
+            return c.json(results.length === 1 ? results[0] : results);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
             return errorResponse(c, err);
@@ -504,7 +605,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             }
             await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
-            // Faille 18: validate the RAW path before basename (checks were dead code)
+            // Flaw 18: validate the RAW path before basename (checks were dead code)
             const rawFile = c.req.param('file') as string;
             if (!rawFile || rawFile.startsWith('.') || rawFile.includes('..') || rawFile.includes('/') || rawFile.includes('\\')) {
                 throw new AppError('Invalid filename', { status: 400, code: 'INVALID_FILENAME' });
@@ -530,7 +631,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
             c.header('Content-Type', result.mimetype);
             if (result.size) c.header('Content-Length', String(result.size));
             c.header('Cache-Control', 'public, max-age=31536000, immutable');
-            // Faille 4: SVG served as attachment (no inline execution)
+            // Flaw 4: SVG served as attachment (no inline execution)
             if (result.attachment) {
                 c.header('Content-Disposition', `attachment; filename="${filename}"`);
             }
@@ -573,7 +674,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
     // ─── Public config ──────────────────────────────────────────────────
     app.get('/_dnax/config/:tenant_id', (c) => {
         const t = c.get('token');
-        // Faille 6: require a VERIFIED, non-expired token (not just any provided value)
+        // Flaw 6: require a VERIFIED, non-expired token (not just any provided value)
         if (!t?.decoded || t?.expired || !t?.provided) {
             return c.json({ message: 'Authentication required', code: 'AUTH_REQUIRED' }, 401);
         }