@anteros/core 0.0.44 → 0.0.47

package/server/boot.ts

@@ -3,7 +3,6 @@ import { createApp, collectHeaders } from './hono'
 import { parseBootFlags, resolveCapabilities, conflictingBootFlags, offCapabilities, capabilitiesLabel, FULL_CAPABILITIES } from './flags'
 import type { BootCapabilities } from './flags'
 import type { ServerConfig } from '../types/config'
-import dayjs from 'dayjs';
 import pkg from '../package.json';
 import boxen from 'boxen';
 import "@colors/colors";
@@ -36,6 +35,13 @@ type BootAppOptions = ServerConfig & {
 
 }
 
+/** `YYYY-MM-DD HH:mm:ss` in **local** time — what the banner shows, from `Date` alone. */
+function stamp(date = new Date()): string {
+    const pad = (n: number) => String(n).padStart(2, '0');
+    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} `
+        + `${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`;
+}
+
 /**
  * Console banner — name / PID / role, env, reusePort, cache, replication.
  * `url` is omitted in replication-only mode (nothing is listening).
@@ -104,7 +110,7 @@ function renderBanner(opts: {
 
     box += url ? `Url: ${url}`.gray.bold : `Url: none — no API`.yellow.bold;
     box += '\n\n';
-    box += `Last boot: 🔄 ${dayjs().format('YYYY-MM-DD HH:mm:ss')}`.gray;
+    box += `Last boot: 🔄 ${stamp()}`.gray;
 
     return boxen(box, {
         title: ` @anteros/core ${pkg.version}`,
@@ -134,7 +140,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
             console.log('⚠ --replication-only conflicts with --no-replication/--api-only — running replication-only'.yellow);
         }
 
-        // Logging: configure from cfg.server.logging (console + file, e.g. logs/anteros.log)
+        // Logging: configure from cfg.server.logging (console + file, e.g. logs/app.log)
         logger.configure(cfg.server.logging);
         // File-only: the boxen banner already shows name / PID / URL / env on the console
         logger.file('Starting Anteros server', {
@@ -193,6 +199,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
                 for (const tenant of cfg.tenants ?? []) {
                     try { tenant.database?.client?.close(); } catch {}
                 }
+                try { await logger.flush(); } catch {}
                 process.exit(0);
             };
             process.once('SIGINT', () => shutdownReplicationOnly('SIGINT'));
@@ -293,6 +300,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
                 for (const tenant of cfg.tenants ?? []) {
                     try { tenant.database?.client?.close(); } catch {}
                 }
+                try { await logger.flush(); } catch {}
                 process.exit(0);
             };
             process.once('SIGINT', () => shutdownCluster('SIGINT'));
@@ -378,7 +386,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
             // Sockets are disabled by not serving `/socket.io/` (below): without an
             // explicit `server.upgrade()` call no client can ever open a websocket.
             websocket: websocket,
-            maxRequestBodySize: 1024 * 1024 * 100, // 100MB
+            maxRequestBodySize: Math.max(cfg.server.body?.maxSize ?? 16 * 1024 * 1024, 101 * 1024 * 1024), // 16MB normal, 100MB+overhead uploads
         })
 
         // Register server for built-in metrics (GET /health)
@@ -397,6 +405,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
             for (const tenant of cfg.tenants ?? []) {
                 try { tenant.database?.client?.close(); } catch {}
             }
+            try { await logger.flush(); } catch {}
             process.exit(0);
         };
         process.once('SIGINT', () => shutdownServer('SIGINT'));

package/server/hono.ts

@@ -18,6 +18,7 @@ import { initializeAgents } from "./agents";
 import { initializeMcp } from "./mcp";
 import { getGlobalMiddlewares } from "../lib/middleware";
 import { jwt } from "../utils/func";
+import { DEFAULT_REDACT_KEYS, isSensitiveKey, redactKeys } from "../lib/redact";
 import { AppError } from "../lib/error";
 import { getMetrics } from "./metrics";
 import { logger } from "../utils/logger";
@@ -27,17 +28,85 @@ import type { HonoVariables } from "./env";
  * Caddy-style header collection (array values); sensitive headers stripped
  * (`authorization`, `cookie`, `proxy-authorization`, `set-cookie`).
  */
+/** Request bodies are only read on demand (`logging.http.body`) — textual content types only. */
+type CapturedBody = { value: string; bytes: number; truncated: boolean };
+
+const TEXTUAL_BODY = /(^text\/)|json|xml|x-www-form-urlencoded|graphql/i;
+
+/** Methods whose body is captured by default (`logging.http.methods` overrides). */
+const DEFAULT_CAPTURE_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+
+async function captureBody(res: Response, maxBytes: number): Promise<CapturedBody | undefined> {
+    if (!res.body) return undefined;
+    const reader = res.body.getReader();
+    const chunks: Uint8Array[] = [];
+    let captured = 0;
+    let truncated = false;
+
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value || value.byteLength === 0) continue;
+
+        const remaining = maxBytes - captured;
+        if (value.byteLength > remaining) {
+            chunks.push(value.subarray(0, remaining));
+            captured = maxBytes;
+            truncated = true;
+            await reader.cancel().catch(() => {});
+            break;
+        }
+
+        chunks.push(value);
+        captured += value.byteLength;
+
+        if (captured === maxBytes) {
+            const next = await reader.read();
+            if (!next.done) truncated = true;
+            await reader.cancel().catch(() => {});
+            break;
+        }
+    }
+
+    const buffer = new Uint8Array(captured);
+    let offset = 0;
+    for (const chunk of chunks) {
+        buffer.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return { value: new TextDecoder().decode(buffer), bytes: captured, truncated };
+}
+
 export function collectHeaders(h: Headers): Record<string, string[]> {
     const EXCLUDE = ['authorization', 'cookie', 'proxy-authorization', 'set-cookie'];
+    const keys = redactKeys() ?? new Set(DEFAULT_REDACT_KEYS.map((key) => key.toLowerCase()));
     const out: Record<string, string[]> = {};
     for (const [name, value] of h.entries()) {
         const key = name.toLowerCase();
-        if (EXCLUDE.includes(key)) continue;
+        if (EXCLUDE.includes(key) || isSensitiveKey(key, keys)) continue;
         out[key] = [value];
     }
     return out;
 }
 
+/** Redact sensitive query-string parameters before they reach the access log. */
+export function redactUri(uri: string): string {
+    const separator = uri.indexOf('?');
+    if (separator === -1) return uri;
+    const pathname = uri.slice(0, separator);
+    const keys = redactKeys() ?? new Set(DEFAULT_REDACT_KEYS.map((key) => key.toLowerCase()));
+    const params = new URLSearchParams(uri.slice(separator + 1));
+    let changed = false;
+    for (const name of [...params.keys()]) {
+        if (isSensitiveKey(name, keys)) {
+            params.set(name, '[redacted]');
+            changed = true;
+        }
+    }
+    if (!changed) return uri;
+    return `${pathname}?${params.toString()}`;
+}
+
 // ─── Redis-backed rate limiting (C3) ─────────────────────────────────────────
 // Lazy singleton: created once per process and reused across createApp() calls.
 // Each increment falls back to the in-memory store if Redis is unavailable,
@@ -223,6 +292,25 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
     // Caddy-compatible JSONL payload: `request`/`resp_headers` blocks + flat fields.
     app.use(async (c, next) => {
         const start = performance.now();
+        // `logging.http.body` is opt-in: clone the body BEFORE the handler consumes it.
+        const loggingCfg = cfg.server.logging;
+        const httpCfg = loggingCfg?.http;
+        if (httpCfg?.enabled === false) {
+            await next();
+            return;
+        }
+        const maxBodyBytes = httpCfg?.maxBodyBytes ?? loggingCfg?.maxBodyBytes ?? 64 * 1024;
+        const captureEnabled = httpCfg?.body ?? httpCfg?.captureBody ?? loggingCfg?.captureBody ?? false;
+        const contentType = c.req.header('content-type') ?? '';
+        // GET is included by default too: some clients send a body on GET (non-standard but accepted).
+        const captureMethods = (httpCfg?.methods ?? httpCfg?.captureMethods ?? DEFAULT_CAPTURE_METHODS)
+            .map((method) => method.toUpperCase());
+        const hasBodyMethod = captureMethods.includes(c.req.method.toUpperCase());
+        const bodyPromise = captureEnabled
+            && hasBodyMethod
+            && TEXTUAL_BODY.test(contentType) && !contentType.includes('multipart/form-data')
+            ? captureBody(c.req.raw.clone(), maxBodyBytes).catch(() => undefined)
+            : undefined;
         try {
             await next();
         } finally {
@@ -231,7 +319,7 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             const conn = c.get('connInfo');
             const token = c.get('token');
             const url = new URL(c.req.raw.url);
-            const uri = url.pathname + url.search;
+            const uri = redactUri(url.pathname + url.search);
             const ip = c.get('clientIp') ?? 'unknown';
             const remoteIp = conn?.remote?.address ?? null;
             const remotePort = conn?.remote?.port ?? null;
@@ -250,6 +338,11 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
                 ip,
                 traceId: trace?.id ?? crypto.randomUUID(),
                 tenant: requestCtxStorage.get<string>('tenant_id') ?? null,
+                ...(bodyPromise ? await bodyPromise.then((body) => body && body.bytes > 0 ? {
+                    request_body: body.value,
+                    request_body_bytes: body.bytes,
+                    request_body_truncated: body.truncated,
+                } : {}) : {}),
                 request: {
                     headers: collectHeaders(c.req.raw.headers),
                     client_ip: ip,
@@ -286,6 +379,19 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         allowList: cfg.server?.ipRestriction?.allowList || [],
     }))
 
+    // Cross-Origin-Resource-Policy — the API keeps `same-origin` by default, but a
+    // served file must be embeddable by the app even when it lives on another origin
+    // (an `<img>` is a no-cors request: only CORP can block it). Registered before
+    // `secureHeaders` so this middleware writes the final value after it.
+    const securityCorp = cfg.server.security?.crossOriginResourcePolicy ?? 'same-origin';
+    const fileCorp = cfg.server.files?.crossOriginResourcePolicy ?? 'cross-origin';
+    app.use(async (c, next) => {
+        await next();
+        const segments = c.req.path.split('/');
+        const isFile = segments[1] === 'api' && segments[3] === 'files';
+        c.header('Cross-Origin-Resource-Policy', isFile ? fileCorp : securityCorp);
+    });
+
     // security headers
     app.use(secureHeaders({
         strictTransportSecurity: true,
@@ -294,13 +400,24 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         xXssProtection: true,
         referrerPolicy: true,
         removePoweredBy: true,
+        // Hono defaults CORP to `same-origin`; configurable (see `server.security`)
+        crossOriginResourcePolicy: securityCorp,
     }))
 
 
-    // body limit
-    app.use(bodyLimit({
-        maxSize: cfg.server.body?.maxSize ?? 1024 * 1024 * 100, // 100MB
-    }));
+    // Body limit — 16MB default for normal requests; the upload route gets the
+    // per-file allowance (100MB default) plus multipart overhead so a 100MB file
+    // is actually uploadable. `server.body.maxSize` raises both.
+    const DEFAULT_BODY_BYTES = 16 * 1024 * 1024;
+    const DEFAULT_UPLOAD_BYTES = 100 * 1024 * 1024;
+    const isUploadPath = (path: string) => /^\/api\/[^/]+\/upload\/[^/]+\/?$/.test(path);
+    app.use((c, next) => {
+        const configured = cfg.server.body?.maxSize ?? DEFAULT_BODY_BYTES;
+        const maxSize = isUploadPath(c.req.path)
+            ? Math.max(configured, DEFAULT_UPLOAD_BYTES + 1024 * 1024)
+            : configured;
+        return bodyLimit({ maxSize })(c, next);
+    });
 
     // ── Health & metrics (built-in, zero dependency) ──
     app.get('/health', (c) => {
@@ -390,6 +507,29 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
         })
     })
 
+    // Tenant-bound tokens (#35) — a JWT carrying a `tenant` claim only opens that
+    // tenant's routes. `requireTenantClaim` rejects claim-less (legacy) tokens once set.
+    app.use(async (c, next) => {
+        const token = (c as any).get('token') as { decoded: Record<string, unknown> | null; provided?: boolean } | undefined;
+        const claim = token?.decoded?.['tenant'] ?? token?.decoded?.['_tenant_'] ?? token?.decoded?.['tenant_id'];
+        // `c.req.param()` is not reliable inside a global middleware — read the path.
+        const segments = c.req.path.split('/').filter(Boolean);
+        const tenantId = segments[0] === 'api'
+            ? segments[1]
+            : segments[0] === '_dnax' && segments[1] === 'config'
+                ? segments[2]
+                : undefined;
+
+        if (token?.provided && claim === undefined && cfg.server.jwt?.requireTenantClaim === true) {
+            return c.json({ message: 'Tenant claim required', code: 'TENANT_CLAIM_REQUIRED' }, 401);
+        }
+        if (claim !== undefined && tenantId !== undefined && String(claim) !== tenantId) {
+            return c.json({ message: 'Token does not belong to this tenant', code: 'TENANT_MISMATCH' }, 401);
+        }
+
+        await next();
+    });
+
     // Global user-defined middlewares — has access to requestCtxStorage, asyncContextStorage, etc.
     for (const mw of getGlobalMiddlewares()) {
         app.use(mw.handler);

package/tests/access-log-body.test.ts

@@ -0,0 +1,253 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from "bun:test";
+import fs from "node:fs";
+import path from "node:path";
+import { createApp } from "../server/hono";
+import { cfg } from "../server/config";
+import { logger } from "../utils/logger";
+
+/**
+ * Opt-in request-body capture (`logging.captureBody`) — file-only access log.
+ * The handler must still receive the body intact (we read a clone).
+ */
+
+const DIR = path.join(import.meta.dir, ".tmp-access-body");
+let server: any;
+let url = "";
+let originalLogging: any;
+
+function readAccessEntries(): any[] {
+    const file = path.join(DIR, "app.log");
+    if (!fs.existsSync(file)) return [];
+    return fs.readFileSync(file, "utf-8")
+        .trim().split("\n").filter(Boolean)
+        .map((line) => JSON.parse(line))
+        .filter((entry) => entry.logger === "http.log.access");
+}
+
+async function boot(http: any = {}) {
+    cfg.server = {
+        ...cfg.server,
+        logging: { file: true, dir: DIR, console: false, level: "info", http },
+    };
+    const app = createApp();
+    app.post("/echo", async (c) => {
+        const contentType = c.req.header("content-type") ?? "";
+        if (contentType.includes("multipart/form-data")) {
+            await c.req.formData();
+            return c.json({ ok: true });
+        }
+        return c.json(await c.req.json());
+    });
+    app.put("/echo", async (c) => c.json(await c.req.json()));
+    app.get("/no-body", (c) => c.json({ ok: true }));
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = `${server.url.href.replace(/\/$/, "")}`;
+}
+
+beforeAll(() => {
+    originalLogging = cfg.server.logging;
+});
+
+beforeEach(() => {
+    fs.rmSync(DIR, { recursive: true, force: true });
+    fs.mkdirSync(DIR, { recursive: true });
+    logger.configure({ dir: DIR, file: true, console: false, level: "info" });
+});
+
+afterEach(() => {
+    try { server?.stop(true); } catch {}
+    server = null;
+    logger.configure({ file: false, console: false });
+    cfg.server = { ...cfg.server, logging: originalLogging };
+});
+
+afterAll(() => {
+    try { fs.rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("access log — request body capture", () => {
+    it("captures a JSON body without breaking the handler", async () => {
+        await boot({ body: true });
+        const res = await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email: "ada@example.com", password: "SuperSecret123!" }),
+        });
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({ email: "ada@example.com", password: "SuperSecret123!" });
+
+        await logger.flush();
+        const entry = readAccessEntries().find((line) => line.uri === "/echo");
+        expect(entry).toBeDefined();
+        expect(entry.request_body).toBe('{"email":"ada@example.com","password":"SuperSecret123!"}');
+        expect(entry.request_body_bytes).toBeGreaterThan(0);
+        expect(entry.request_body_truncated).toBe(false);
+    });
+
+    it("does not capture a body by default", async () => {
+        await boot({ body: false });
+        await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ secret: "hidden" }),
+        });
+
+        await logger.flush();
+        const entry = readAccessEntries().find((line) => line.uri === "/echo");
+        expect(entry).toBeDefined();
+        expect(entry.request_body).toBeUndefined();
+        expect("request_body" in entry).toBe(false);
+    });
+
+    it("truncates at maxBodyBytes", async () => {
+        await boot({ body: true, maxBodyBytes: 10 });
+        await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ value: "x".repeat(100) }),
+        });
+
+        await logger.flush();
+        const entry = readAccessEntries().find((line) => line.uri === "/echo");
+        expect(entry.request_body_truncated).toBe(true);
+        expect(entry.request_body.length).toBe(10);
+        expect(entry.request_body_bytes).toBe(10);
+    });
+
+    it("skips multipart bodies", async () => {
+        await boot({ body: true });
+        const form = new FormData();
+        form.append("file", new Blob(["binary"], { type: "application/octet-stream" }), "f.bin");
+        await fetch(`${url}/echo`, { method: "POST", body: form });
+
+        await logger.flush();
+        const entry = readAccessEntries().find((line) => line.uri === "/echo");
+        expect(entry).toBeDefined();
+        expect(entry.request_body).toBeUndefined();
+    });
+});
+
+describe("access log — HTTP options group", () => {
+    it("can disable the access log entirely", async () => {
+        await boot({ enabled: false });
+        await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ hidden: true }),
+        });
+        await logger.flush();
+        expect(readAccessEntries().length).toBe(0);
+
+        // The request itself is unaffected
+        const res = await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ ok: true }),
+        });
+        expect(res.status).toBe(200);
+    });
+
+    it("still accepts the deprecated top-level captureBody", async () => {
+        cfg.server = {
+            ...cfg.server,
+            logging: { file: true, dir: DIR, console: false, level: "info", captureBody: true },
+        };
+        const app = createApp();
+        app.post("/echo", async (c) => c.json(await c.req.json()));
+        server = Bun.serve({ port: 0, fetch: app.fetch });
+        url = `${server.url.href.replace(/\/$/, "")}`;
+
+        await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ legacy: true }),
+        });
+        await logger.flush();
+        const entry = readAccessEntries().find((line) => line.uri === "/echo");
+        expect(entry.request_body).toBe('{"legacy":true}');
+    });
+});
+
+describe("access log — GET", () => {
+    it("does not add request_body for a bodyless GET", async () => {
+        await boot({ body: true });
+        const res = await fetch(`${url}/no-body`);
+        expect(res.status).toBe(200);
+
+        await logger.flush();
+        const entry = readAccessEntries().find((line) => line.uri === "/no-body");
+        expect(entry).toBeDefined();
+        expect("request_body" in entry).toBe(false);
+    });
+});
+
+describe("access log — method selection", () => {
+    it("captures only the configured methods, case-insensitively", async () => {
+        await boot({ body: true, methods: ["post"] });
+
+        await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ captured: true }),
+        });
+        await fetch(`${url}/echo`, {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ captured: false }),
+        });
+        await logger.flush();
+
+        const entries = readAccessEntries().filter((line) => line.uri === "/echo");
+        const post = entries.find((line) => line.method === "POST");
+        const put = entries.find((line) => line.method === "PUT");
+        expect(post.request_body).toBe('{"captured":true}');
+        expect("request_body" in put).toBe(false);
+    });
+
+    it("an empty methods list disables body capture", async () => {
+        await boot({ body: true, methods: [] });
+        await fetch(`${url}/echo`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ hidden: true }),
+        });
+        await logger.flush();
+
+        const entry = readAccessEntries().find((line) => line.uri === "/echo");
+        expect(entry).toBeDefined();
+        expect("request_body" in entry).toBe(false);
+    });
+});
+
+describe("access log — deprecated option names", () => {
+    it("still accepts nested captureBody/captureMethods", async () => {
+        cfg.server = {
+            ...cfg.server,
+            logging: {
+                file: true, dir: DIR, console: false, level: "info",
+                http: { captureBody: true, captureMethods: ["POST"] },
+            },
+        };
+        const app = createApp();
+        app.post("/echo-deprecated", async (c) => c.json(await c.req.json()));
+        app.put("/echo-deprecated", async (c) => c.json(await c.req.json()));
+        server = Bun.serve({ port: 0, fetch: app.fetch });
+        url = `${server.url.href.replace(/\/$/, "")}`;
+
+        await fetch(`${url}/echo-deprecated`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ post: true }),
+        });
+        await fetch(`${url}/echo-deprecated`, {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ put: true }),
+        });
+        await logger.flush();
+
+        const entries = readAccessEntries().filter((line) => line.uri === "/echo-deprecated");
+        expect(entries.find((line) => line.method === "POST").request_body).toBe('{"post":true}');
+        expect("request_body" in entries.find((line) => line.method === "PUT")).toBe(false);
+    });
+});