@axium/server 0.2.2 → 0.3.1

package/dist/cli.js

@@ -1,24 +1,27 @@
 #!/usr/bin/env node
-import { Option, program } from 'commander';
+import { Argument, Option, program } from 'commander';
 import { styleText } from 'node:util';
-import { getByString, isJSON, pick, setByString } from 'utilium';
+import { getByString, isJSON, setByString } from 'utilium';
 import $pkg from '../package.json' with { type: 'json' };
 import * as config from './config.js';
 import * as db from './database.js';
-import { exit, output } from './io.js';
+import { _portActions, _portMethods, exit, handleError, output, restrictedPorts } from './io.js';
 program
     .version($pkg.version)
     .name('axium')
     .description('Axium server CLI')
     .configureHelp({ showGlobalOptions: true })
-    .option('-D, --debug', 'override debug mode', false)
+    .option('--debug', 'override debug mode')
+    .option('--no-debug', 'override debug mode')
     .option('-c, --config <path>', 'path to the config file');
-program.on('option:debug', () => config.set(pick(program.opts(), 'debug')));
+program.on('option:debug', () => config.set({ debug: true }));
 program.on('option:config', () => config.load(program.opts().config));
 program.hook('preAction', function (_, action) {
     config.loadDefaults();
     const opt = action.optsWithGlobals();
     opt.force && output.warn('--force: Protections disabled.');
+    if (opt.debug === false)
+        config.set({ debug: false });
 });
 // Options shared by multiple (sub)commands
 const opts = {
@@ -36,30 +39,13 @@ const axiumDB = program
     .description('manage the database')
     .option('-t, --timeout <ms>', 'how long to wait for commands to complete.', '1000')
     .addOption(opts.host);
-function db_output(state, message = '') {
-    switch (state) {
-        case 'start':
-            process.stdout.write(message + '... ');
-            break;
-        case 'log':
-        case 'warn':
-            process.stdout.write(styleText('yellow', message));
-            break;
-        case 'error':
-            process.stdout.write(styleText('red', message));
-            break;
-        case 'done':
-            console.log('done.');
-            break;
-    }
-}
 axiumDB
     .command('init')
     .description('initialize the database')
     .addOption(opts.force)
     .option('-s, --skip', 'Skip existing database and/or user')
     .action(async (opt) => {
-    await db.init({ ...opt, output: db_output }).catch((e) => {
+    await db.init(opt).catch((e) => {
         if (typeof e == 'number')
             process.exit(e);
         else
@@ -95,7 +81,7 @@ axiumDB
             output.warn(`Database has existing ${key}. Use --force if you really want to drop the database.`);
             process.exit(2);
         }
-    await db.uninstall({ ...opt, output: db_output }).catch(exit);
+    await db.uninstall(opt).catch(exit);
     await db.database.destroy();
 });
 axiumDB
@@ -111,12 +97,11 @@ axiumDB
             output.warn(`Database has existing ${key}. Use --force if you really want to wipe the database.`);
             process.exit(2);
         }
-    await db.wipe({ ...opt, output: db_output }).catch(exit);
+    await db.wipe(opt).catch(exit);
     await db.database.destroy();
 });
 const axiumConfig = program
     .command('config')
-    .alias('conf')
     .description('manage the configuration')
     .option('-j, --json', 'values are JSON encoded')
     .option('-g, --global', 'apply to the global config');
@@ -176,17 +161,22 @@ program
     await db.database.destroy();
     console.log('Credentials authentication:', config.auth.credentials ? styleText('yellow', 'enabled') : 'disabled');
 });
+program
+    .command('ports')
+    .description('Enable or disable use of restricted ports (e.g. 443)')
+    .addArgument(new Argument('<action>', 'The action to take').choices(_portActions))
+    .addOption(new Option('-m, --method <method>', 'the method to use').choices(_portMethods).default('node-cap'))
+    .option('-N, --node <path>', 'the path to the node binary')
+    .action(async (action, opt) => {
+    await restrictedPorts({ ...opt, action }).catch(handleError);
+});
 program
     .command('init')
     .description('Install Axium server')
     .addOption(opts.force)
     .addOption(opts.host)
     .action(async (opt) => {
-    await db.init({ ...opt, skip: opt.dbSkip, output: db_output }).catch((e) => {
-        if (typeof e == 'number')
-            process.exit(e);
-        else
-            exit(e);
-    });
+    await db.init({ ...opt, skip: opt.dbSkip }).catch(handleError);
+    await restrictedPorts({ method: 'node-cap', action: 'enable' }).catch(handleError);
 });
 program.parse();

package/dist/config.d.ts

@@ -43,10 +43,10 @@ export declare const Log: z.ZodObject<{
     level: z.ZodEnum<["error", "warn", "notice", "info", "debug"]>;
     console: z.ZodBoolean;
 }, "strip", z.ZodTypeAny, {
-    level: "debug" | "error" | "warn" | "notice" | "info";
+    level: "warn" | "error" | "debug" | "notice" | "info";
     console: boolean;
 }, {
-    level: "debug" | "error" | "warn" | "notice" | "info";
+    level: "warn" | "error" | "debug" | "notice" | "info";
     console: boolean;
 }>;
 export type Log = z.infer<typeof Log>;
@@ -67,13 +67,13 @@ export declare const Config: z.ZodObject<{
         secret: z.ZodOptional<z.ZodString>;
         secure_cookies: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     }, {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     }>;
@@ -101,10 +101,10 @@ export declare const Config: z.ZodObject<{
         level: z.ZodOptional<z.ZodEnum<["error", "warn", "notice", "info", "debug"]>>;
         console: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
         console?: boolean | undefined;
     }, {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
         console?: boolean | undefined;
     }>;
     web: z.ZodObject<{
@@ -115,10 +115,14 @@ export declare const Config: z.ZodObject<{
         prefix?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
+    log: {
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
+        console?: boolean | undefined;
+    };
     debug: boolean;
     auth: {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     };
@@ -129,18 +133,18 @@ export declare const Config: z.ZodObject<{
         user?: string | undefined;
         database?: string | undefined;
     };
-    log: {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
-        console?: boolean | undefined;
-    };
     web: {
         prefix?: string | undefined;
     };
 }, {
+    log: {
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
+        console?: boolean | undefined;
+    };
     debug: boolean;
     auth: {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     };
@@ -151,10 +155,6 @@ export declare const Config: z.ZodObject<{
         user?: string | undefined;
         database?: string | undefined;
     };
-    log: {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
-        console?: boolean | undefined;
-    };
     web: {
         prefix?: string | undefined;
     };
@@ -166,13 +166,13 @@ export declare const File: z.ZodObject<z.objectUtil.extendShape<{
         secret: z.ZodOptional<z.ZodOptional<z.ZodString>>;
         secure_cookies: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
     }, "strip", z.ZodTypeAny, {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     }, {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     }>>;
@@ -200,10 +200,10 @@ export declare const File: z.ZodObject<z.objectUtil.extendShape<{
         level: z.ZodOptional<z.ZodOptional<z.ZodEnum<["error", "warn", "notice", "info", "debug"]>>>;
         console: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
     }, "strip", z.ZodTypeAny, {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
         console?: boolean | undefined;
     }, {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
         console?: boolean | undefined;
     }>>;
     web: z.ZodOptional<z.ZodObject<{
@@ -216,10 +216,14 @@ export declare const File: z.ZodObject<z.objectUtil.extendShape<{
 }, {
     include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }>, "strip", z.ZodTypeAny, {
+    log?: {
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
+        console?: boolean | undefined;
+    } | undefined;
     debug?: boolean | undefined;
     auth?: {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     } | undefined;
@@ -230,19 +234,19 @@ export declare const File: z.ZodObject<z.objectUtil.extendShape<{
         user?: string | undefined;
         database?: string | undefined;
     } | undefined;
-    log?: {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
-        console?: boolean | undefined;
-    } | undefined;
     web?: {
         prefix?: string | undefined;
     } | undefined;
     include?: string[] | undefined;
 }, {
+    log?: {
+        level?: "warn" | "error" | "debug" | "notice" | "info" | undefined;
+        console?: boolean | undefined;
+    } | undefined;
     debug?: boolean | undefined;
     auth?: {
-        credentials?: boolean | undefined;
         debug?: boolean | undefined;
+        credentials?: boolean | undefined;
         secret?: string | undefined;
         secure_cookies?: boolean | undefined;
     } | undefined;
@@ -253,10 +257,6 @@ export declare const File: z.ZodObject<z.objectUtil.extendShape<{
         user?: string | undefined;
         database?: string | undefined;
     } | undefined;
-    log?: {
-        level?: "debug" | "error" | "warn" | "notice" | "info" | undefined;
-        console?: boolean | undefined;
-    } | undefined;
     web?: {
         prefix?: string | undefined;
     } | undefined;

package/dist/config.js

@@ -90,7 +90,7 @@ export function load(path, options = {}) {
     catch (e) {
         if (!options.optional)
             throw e;
-        logger.debug(`Skipping config at ${path} (${e.message})`);
+        debug && output.debug(`Skipping config at ${path} (${e.message})`);
         return;
     }
     const config = options.strict ? File.parse(json) : json;
@@ -116,7 +116,7 @@ export function saveTo(path, changed) {
     set(changed);
     const config = files.get(path) ?? {};
     Object.assign(config, { ...changed, db: { ...config.db, ...changed.db } });
-    logger.debug(`Wrote config to ${path}`);
+    debug && output.debug(`Wrote config to ${path}`);
     writeFileSync(path, JSON.stringify(config));
 }
 /**

package/dist/database.d.ts

@@ -2,6 +2,7 @@ import type { AdapterAccountType as db } from '@auth/core/adapters';
 import { Kysely, type GeneratedAlways } from 'kysely';
 import type { Preferences } from './auth.js';
 import * as config from './config.js';
+import { type MaybeOutput } from './io.js';
 export interface Schema {
     User: {
         id: GeneratedAlways<string>;
@@ -58,15 +59,9 @@ export interface Stats {
 }
 export declare function status(): Promise<Stats>;
 export declare function statusText(): Promise<string>;
-export type OpOutputState = 'done' | 'log' | 'warn' | 'error' | 'start';
-export type OpOutput = {
-    (state: 'done'): void;
-    (state: Exclude<OpOutputState, 'done'>, message: string): void;
-};
-export interface OpOptions {
+export interface OpOptions extends MaybeOutput {
     timeout: number;
     force: boolean;
-    output?: OpOutput;
 }
 export interface InitOptions extends OpOptions {
     skip: boolean;

package/dist/database.js

@@ -51,11 +51,10 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
 import { Kysely, PostgresDialect, sql } from 'kysely';
-import { exec } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import pg from 'pg';
 import * as config from './config.js';
-import { logger } from './io.js';
+import { _fixOutput, run } from './io.js';
 export let database;
 export function connect() {
     if (database)
@@ -87,35 +86,6 @@ export async function statusText() {
         throw typeof error == 'object' && 'message' in error ? error.message : error;
     }
 }
-/**
- * TS can't tell when we do this inline
- */
-function _fixOutput(opt) {
-    opt.output ??= () => { };
-}
-/**
- * Convenience function for `sudo -u postgres psql -c "${command}"`, plus `report` coolness.
- * @internal
- */
-async function execSQL(opts, command, message) {
-    let stderr;
-    try {
-        opts.output('start', message);
-        const { promise, resolve, reject } = Promise.withResolvers();
-        exec(`sudo -u postgres psql -c "${command}"`, opts, (err, _, _stderr) => {
-            stderr = _stderr.startsWith('ERROR:') ? _stderr.slice(6).trim() : _stderr;
-            if (err)
-                reject('[command]');
-            else
-                resolve();
-        });
-        await promise;
-        opts.output('done');
-    }
-    catch (error) {
-        throw error == '[command]' ? stderr?.slice(0, 100) || 'failed.' : typeof error == 'object' && 'message' in error ? error.message : error;
-    }
-}
 function shouldRecreate(opt) {
     if (opt.skip) {
         opt.output('warn', 'already exists. (skipped)\n');
@@ -134,9 +104,9 @@ export async function init(opt) {
         _fixOutput(opt);
         if (!config.db.password) {
             config.save({ db: { password: randomBytes(32).toString('base64') } }, true);
-            logger.debug('Generated password and wrote to global config');
+            opt.output('debug', 'Generated password and wrote to global config');
         }
-        const _sql = (command, message) => execSQL(opt, command, message);
+        const _sql = (command, message) => run(opt, message, `sudo -u postgres psql -c "${command}"`);
         await _sql('CREATE DATABASE axium', 'Creating database').catch(async (error) => {
             if (error != 'database "axium" already exists')
                 throw error;
@@ -258,9 +228,10 @@ export async function init(opt) {
  */
 export async function uninstall(opt) {
     _fixOutput(opt);
-    await execSQL(opt, 'DROP DATABASE axium', 'Dropping database');
-    await execSQL(opt, 'REVOKE ALL PRIVILEGES ON SCHEMA public FROM axium', 'Revoking schema privileges');
-    await execSQL(opt, 'DROP USER axium', 'Dropping user');
+    const _sql = (command, message) => run(opt, message, `sudo -u postgres psql -c "${command}"`);
+    await _sql('DROP DATABASE axium', 'Dropping database');
+    await _sql('REVOKE ALL PRIVILEGES ON SCHEMA public FROM axium', 'Revoking schema privileges');
+    await _sql('DROP USER axium', 'Dropping user');
 }
 /**
  * Removes all data from tables.

package/dist/io.d.ts

@@ -15,7 +15,52 @@ export declare const output: {
     log(message: string): void;
     debug(message: string): void;
 };
+/**
+ * Run a system command with the fancy "Example... done."
+ * @internal
+ */
+export declare function run(opts: WithOutput & {
+    timeout?: number;
+}, message: string, command: string): Promise<string>;
 /** Yet another convenience function */
 export declare function exit(message: string | Error, code?: number): never;
-/** Convenience function for `example... [done. / error]` */
-export declare function report<T>(promise: Promise<T>, message: string, success?: string): Promise<T>;
+export declare function handleError(e: number | string | Error): void;
+export type OutputState = 'done' | 'log' | 'warn' | 'error' | 'start' | 'debug';
+export interface Output {
+    (state: 'done'): void;
+    (state: Exclude<OutputState, 'done'>, message: string): void;
+}
+export interface MaybeOutput {
+    output?: Output | null | false;
+}
+export interface WithOutput {
+    output: Output;
+}
+export declare function defaultOutput(state: 'done'): void;
+export declare function defaultOutput(state: Exclude<OutputState, 'done'>, message: string): void;
+/**
+ * TS can't tell when we do this inline
+ * @internal
+ */
+export declare function _fixOutput<T extends MaybeOutput>(opt: T): asserts opt is T & WithOutput;
+/** @internal */
+export declare const _portMethods: readonly ["node-cap"];
+/** @internal */
+export declare const _portActions: readonly ["enable", "disable"];
+/**
+ * Options for working with restricted ports.
+ *
+ * Method:
+ * - `node-cap`: Use the `cap_net_bind_service` capability on the node binary.
+ */
+export interface PortOptions extends MaybeOutput {
+    method: (typeof _portMethods)[number];
+    action: (typeof _portActions)[number];
+    node?: string;
+}
+/**
+ * This changes if Axium can use restricted ports (like 80 and 443) without root privileges.
+ * Use of these ports is needed so the origin doesn't have a port.
+ * If the origin has a port, passkeys do not work correctly with some password managers.
+ */
+export declare function restrictedPorts(opt: PortOptions): Promise<void>;

package/dist/io.js

@@ -1,8 +1,10 @@
 import { Logger } from 'logzen';
-import { mkdirSync } from 'node:fs';
+import { exec, execSync } from 'node:child_process';
+import * as fs from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path/posix';
 import { styleText } from 'node:util';
+import { debug } from './config.js';
 /**
  * Find the Axium directory.
  * This directory includes things like config files, secrets, etc.
@@ -17,8 +19,8 @@ export function findDir(global) {
     return '.axium';
 }
 if (process.getuid?.() === 0)
-    mkdirSync('/etc/axium', { recursive: true });
-mkdirSync(findDir(false), { recursive: true });
+    fs.mkdirSync('/etc/axium', { recursive: true });
+fs.mkdirSync(findDir(false), { recursive: true });
 export const logger = new Logger({
     hideWarningStack: true,
     noGlobalConsole: true,
@@ -42,6 +44,30 @@ export const output = {
     },
 };
 logger.attach(output);
+/**
+ * Run a system command with the fancy "Example... done."
+ * @internal
+ */
+export async function run(opts, message, command) {
+    let stderr;
+    try {
+        opts.output('start', message);
+        const { promise, resolve, reject } = Promise.withResolvers();
+        exec(command, opts, (err, stdout, _stderr) => {
+            stderr = _stderr.startsWith('ERROR:') ? _stderr.slice(6).trim() : _stderr;
+            if (err)
+                reject('[command]');
+            else
+                resolve(stdout);
+        });
+        const value = await promise;
+        opts.output('done');
+        return value;
+    }
+    catch (error) {
+        throw error == '[command]' ? stderr?.slice(0, 100) || 'failed.' : typeof error == 'object' && 'message' in error ? error.message : error;
+    }
+}
 /** Yet another convenience function */
 export function exit(message, code = 1) {
     if (message instanceof Error)
@@ -49,15 +75,95 @@ export function exit(message, code = 1) {
     output.error(message);
     process.exit(code);
 }
-/** Convenience function for `example... [done. / error]` */
-export async function report(promise, message, success = 'done.') {
-    process.stdout.write(message + '... ');
-    try {
-        const result = await promise;
-        console.log(success);
-        return result;
+export function handleError(e) {
+    if (typeof e == 'number')
+        process.exit(e);
+    else
+        exit(e);
+}
+export function defaultOutput(state, message = '') {
+    switch (state) {
+        case 'start':
+            process.stdout.write(message + '... ');
+            break;
+        case 'debug':
+            debug && output.debug(message);
+            break;
+        case 'log':
+            console.log(message);
+            break;
+        case 'warn':
+            process.stdout.write(styleText('yellow', message));
+            break;
+        case 'error':
+            process.stdout.write(styleText('red', message));
+            break;
+        case 'done':
+            console.log('done.');
+            break;
     }
-    catch (error) {
-        throw typeof error == 'object' && 'message' in error ? error.message : error;
+}
+/**
+ * TS can't tell when we do this inline
+ * @internal
+ */
+export function _fixOutput(opt) {
+    if (opt.output === false)
+        opt.output = () => { };
+    else
+        opt.output ??= defaultOutput;
+}
+/** @internal */
+export const _portMethods = ['node-cap'];
+/** @internal */
+export const _portActions = ['enable', 'disable'];
+/**
+ * This changes if Axium can use restricted ports (like 80 and 443) without root privileges.
+ * Use of these ports is needed so the origin doesn't have a port.
+ * If the origin has a port, passkeys do not work correctly with some password managers.
+ */
+export async function restrictedPorts(opt) {
+    _fixOutput(opt);
+    opt.output('start', 'Checking for root privileges');
+    if (process.getuid?.() != 0)
+        throw 'root privileges are needed to change restricted ports.';
+    opt.output('done');
+    opt.output('start', 'Checking ports method');
+    if (!_portMethods.includes(opt.method))
+        throw 'invalid';
+    opt.output('done');
+    opt.output('start', 'Checking ports action');
+    if (!_portActions.includes(opt.action))
+        throw 'invalid';
+    opt.output('done');
+    switch (opt.method) {
+        case 'node-cap': {
+            const setcap = await run(opt, 'Finding setcap', 'command -v setcap')
+                .then(e => e.trim())
+                .catch(() => {
+                opt.output('warn', 'not in path.');
+                opt.output('start', 'Checking for /usr/sbin/setcap');
+                fs.accessSync('/usr/sbin/setcap', fs.constants.X_OK);
+                opt.output('done');
+                return '/usr/sbin/setcap';
+            });
+            opt.output('debug', 'Using setup at ' + setcap);
+            let { node } = opt;
+            node ||= await run(opt, 'Finding node', 'command -v node')
+                .then(e => e.trim())
+                .catch(() => {
+                opt.output('warn', 'not in path.');
+                opt.output('start', 'Checking for /usr/bin/node');
+                fs.accessSync('/usr/bin/node', fs.constants.X_OK);
+                opt.output('done');
+                return '/usr/bin/node';
+            });
+            opt.output('start', 'Resolving real path for node');
+            node = fs.realpathSync(node);
+            opt.output('done');
+            opt.output('debug', 'Using node at ' + node);
+            await run(opt, 'Setting ports capability', `${setcap} cap_net_bind_service=${opt.action == 'enable' ? '+' : '-'}ep ${node}`);
+            break;
+        }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.2.2",
+	"version": "0.3.1",
 	"author": "James Prevett <axium@jamespre.dev> (https://jamespre.dev)",
 	"funding": {
 		"type": "individual",