@axium/server 0.9.0 → 0.10.0

package/dist/routes.d.ts

@@ -1,9 +1,10 @@
 import type { RequestMethod } from '@axium/core/requests';
-import type { LoadEvent, RequestEvent } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
 import type { Component } from 'svelte';
 import type z from 'zod/v4';
 type _Params = Partial<Record<string, string>>;
-export type EndpointHandlers<Params extends _Params = _Params> = Partial<Record<RequestMethod, (event: RequestEvent<Params>) => object | Promise<object>>>;
+type MaybePromise<T> = T | Promise<T>;
+export type EndpointHandlers<Params extends _Params = _Params> = Partial<Record<RequestMethod, (event: RequestEvent<Params>) => MaybePromise<object | Response>>>;
 export type RouteParamOptions = z.ZodType;
 export interface CommonRouteOptions<Params extends _Params = _Params> {
     path: string;
@@ -15,6 +16,7 @@ export interface CommonRouteOptions<Params extends _Params = _Params> {
  * A route with server-side handlers for different HTTP methods.
  */
 export interface ServerRouteOptions<Params extends _Params = _Params> extends CommonRouteOptions<Params>, EndpointHandlers<Params> {
+    api?: boolean;
 }
 export interface WebRouteOptions extends CommonRouteOptions {
     load?(event: RequestEvent): object | Promise<object>;
@@ -25,31 +27,28 @@ export type RouteOptions = ServerRouteOptions | WebRouteOptions;
 export interface RouteCommon {
     path: string;
     params?: Record<string, RouteParamOptions>;
-    [kBuiltin]: boolean;
 }
 export interface ServerRoute extends RouteCommon, EndpointHandlers {
+    api: boolean;
     server: true;
 }
 export interface WebRoute extends RouteCommon {
     server: false;
-    load?(event: LoadEvent): object | Promise<object>;
-    page?: Component;
+    load?(event: RequestEvent): object | Promise<object>;
+    page: Component;
 }
 export type Route = ServerRoute | WebRoute;
 /**
  * @internal
  */
 export declare const routes: Map<string, Route>;
-declare const kBuiltin: unique symbol;
-export declare function addRoute(opt: RouteOptions, _routeMap?: Map<string, Route>): void;
+export declare function addRoute(opt: RouteOptions): void;
 /**
  * Resolve a request URL into a route.
  * This handles parsing of parameters in the URL.
  */
-export declare function resolveRoute<T extends Route>(event: RequestEvent | LoadEvent, _routeMap?: Map<string, T>): T | undefined;
-/**
- * This function marks all existing routes as built-in.
- * @internal
- */
-export declare function _markDefaults(): void;
+export declare function resolveRoute(event: {
+    url: URL;
+    params?: object;
+}): Route | undefined;
 export {};

package/dist/routes.js

@@ -1,39 +1,47 @@
+import { apps } from './apps.js';
+import config from './config.js';
+import { output } from './io.js';
+import { _unique } from './state.js';
 /**
  * @internal
  */
-export const routes = new Map();
-const kBuiltin = Symbol('kBuiltin');
-export function addRoute(opt, _routeMap = routes) {
-    const route = { ...opt, server: !('page' in opt), [kBuiltin]: false };
+export const routes = _unique('routes', new Map());
+export function addRoute(opt) {
+    const route = { ...opt, server: !('page' in opt) };
     if (!route.path.startsWith('/')) {
         throw new Error(`Route path must start with a slash: ${route.path}`);
     }
-    if (route.path.startsWith('/api/') && !route.server) {
+    if (route.path.startsWith('/api/'))
+        route.api = true;
+    if (route.api && !route.server)
         throw new Error(`API routes cannot have a client page: ${route.path}`);
-    }
-    _routeMap.set(route.path, route);
+    routes.set(route.path, route);
+    output.debug('Added route: ' + route.path);
 }
 /**
  * Resolve a request URL into a route.
  * This handles parsing of parameters in the URL.
  */
-export function resolveRoute(event, _routeMap = routes) {
+export function resolveRoute(event) {
     const { pathname } = event.url;
-    if (_routeMap.has(pathname) && !pathname.split('/').some(p => p.startsWith(':')))
-        return _routeMap.get(pathname);
+    if (routes.has(pathname) && !pathname.split('/').some(p => p.startsWith(':')))
+        return routes.get(pathname);
     // Otherwise we must have a parameterized route
-    routes: for (const route of _routeMap.values()) {
+    _routes: for (const route of routes.values()) {
         const params = {};
         // Split the path and route into parts, zipped together
         const pathParts = pathname.split('/').filter(Boolean);
+        // Skips routes in disabled apps
+        if (apps.has(pathParts[0]) && config.apps.disabled.includes(pathParts[0]))
+            continue;
         for (const routePart of route.path.split('/').filter(Boolean)) {
             const pathPart = pathParts.shift();
             if (!pathPart)
-                continue routes;
+                continue _routes;
             if (pathPart == routePart)
                 continue;
             if (!routePart.startsWith(':'))
-                continue routes;
+                continue _routes;
             params[routePart.slice(1)] = pathPart;
         }
         // we didn't find a match, since an exact match would have been found already
@@ -43,12 +51,3 @@ export function resolveRoute(event, _routeMap = routes) {
         return route;
     }
 }
-/**
- * This function marks all existing routes as built-in.
- * @internal
- */
-export function _markDefaults() {
-    for (const route of routes.values()) {
-        route[kBuiltin] = true;
-    }
-}

package/dist/serve.d.ts

@@ -0,0 +1,7 @@
+import type { Server } from 'node:http';
+export interface ServeOptions {
+    secure: boolean;
+    ssl_key: string;
+    ssl_cert: string;
+}
+export declare function serve(opt: Partial<ServeOptions>): Promise<Server>;

package/dist/serve.js

@@ -0,0 +1,11 @@
+import { readFileSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { createServer as createSecureServer } from 'node:https';
+import config from './config.js';
+const _handlerPath = '../build/handler.js';
+export async function serve(opt) {
+    const { handler } = await import(_handlerPath);
+    if (!opt.secure && !config.web.secure)
+        return createServer(handler);
+    return createSecureServer({ key: readFileSync(opt.ssl_key || config.web.ssl_key), cert: readFileSync(opt.ssl_cert || config.web.ssl_cert) }, handler);
+}

package/dist/state.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Prevent duplicate shared state.
+ */
+export declare function _unique<T>(id: string, value: T): T;

package/dist/state.js

@@ -0,0 +1,22 @@
+import { styleText } from 'node:util';
+const sym = Symbol.for('Axium:state');
+globalThis[sym] ||= Object.create({ _errored: false });
+/**
+ * Prevent duplicate shared state.
+ */
+export function _unique(id, value) {
+    const state = globalThis[sym];
+    const _err = new Error();
+    Error.captureStackTrace(_err, _unique);
+    const stack = _err.stack.slice(6);
+    if (!(id in state)) {
+        state[id] = { value, stack };
+        return value;
+    }
+    if (!state._errored) {
+        console.error(styleText('red', 'Duplicate Axium server state! You might have multiple instances of the same module loaded.'));
+        state._errored = true;
+    }
+    console.warn(styleText('yellow', `Mitigating duplicate state! (${id})\n${stack}\nFrom original\n${state[id].stack}`));
+    return state[id].value;
+}

package/dist/sveltekit.d.ts

@@ -0,0 +1,8 @@
+import type { RequestEvent, ResolveOptions } from '@sveltejs/kit';
+/**
+ * @internal
+ */
+export declare function handle({ event, resolve, }: {
+    event: RequestEvent;
+    resolve: (event: RequestEvent, opts?: ResolveOptions) => Promise<Response>;
+}): Promise<Response>;

package/dist/sveltekit.js

@@ -0,0 +1,90 @@
+import { error, json, redirect } from '@sveltejs/kit';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path/posix';
+import { render } from 'svelte/server';
+import z from 'zod/v4';
+import { config } from './config.js';
+import { resolveRoute } from './routes.js';
+async function handleAPIRequest(event, route) {
+    const method = event.request.method;
+    const _warnings = [];
+    if (route.api && !event.request.headers.get('Accept')?.includes('application/json')) {
+        _warnings.push('Only application/json is supported');
+        event.request.headers.set('Accept', 'application/json');
+    }
+    for (const [key, type] of Object.entries(route.params || {})) {
+        if (!type)
+            continue;
+        try {
+            event.params[key] = type.parse(event.params[key]);
+        }
+        catch (e) {
+            error(400, `Invalid parameter: ${z.prettifyError(e)}`);
+        }
+    }
+    if (typeof route[method] != 'function')
+        error(405, `Method ${method} not allowed for ${route.path}`);
+    const result = await route[method](event);
+    if (result instanceof Response)
+        return result;
+    result._warnings ||= [];
+    result._warnings.push(..._warnings);
+    return json(result);
+}
+function handleError(e) {
+    if ('body' in e)
+        return json(e.body, { status: e.status });
+    console.error(e);
+    return json({ message: 'Internal Error' + (config.debug ? ': ' + e.message : '') }, { status: 500 });
+}
+const templatePath = join(import.meta.dirname, '../web/template.html');
+const template = readFileSync(templatePath, 'utf-8');
+function fillTemplate({ head, body }, env = {}, nonce = '') {
+    return (template
+        .replace('%sveltekit.head%', head)
+        .replace('%sveltekit.body%', body)
+        .replace(/%sveltekit\.assets%/g, config.web.assets)
+        // Unused for now.
+        .replace(/%sveltekit\.nonce%/g, nonce)
+        .replace(/%sveltekit\.env\.([^%]+)%/g, (_match, capture) => env[capture] ?? ''));
+}
+/**
+ * @internal
+ */
+export async function handle({ event, resolve, }) {
+    const route = resolveRoute(event);
+    if (!route && event.url.pathname === '/')
+        redirect(303, '/_axium/default');
+    if (config.debug)
+        console.log(event.request.method.padEnd(7), route ? route.path : event.url.pathname);
+    if (!route)
+        return await resolve(event).catch(handleError);
+    if (route.server == true) {
+        if (route.api)
+            return await handleAPIRequest(event, route).catch(handleError);
+        const run = route[event.request.method];
+        if (typeof run !== 'function') {
+            error(405, `Method ${event.request.method} not allowed for ${route.path}`);
+        }
+        try {
+            const result = await run(event);
+            if (result instanceof Response)
+                return result;
+            return json(result);
+        }
+        catch (e) {
+            return handleError(e);
+        }
+    }
+    const data = await route.load?.(event);
+    const body = fillTemplate(render(route.page));
+    return new Response(body, {
+        headers: {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-cache, no-store, must-revalidate',
+            Pragma: 'no-cache',
+            Expires: '0',
+        },
+        status: 200,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.9.0",
+	"version": "0.10.0",
 	"author": "James Prevett <axium@jamespre.dev> (https://jamespre.dev)",
 	"funding": {
 		"type": "individual",
@@ -20,12 +20,16 @@
 	"exports": {
 		".": "./dist/index.js",
 		"./*": "./dist/*.js",
-		"./web": "./web/index.js",
-		"./web/*": "./web/*"
+		"./web/*": "./web/*",
+		"./$routes": "./routes",
+		"./svelte.config.js": "./svelte.config.js"
 	},
 	"files": [
+		"assets",
 		"dist",
-		"web"
+		"routes",
+		"web",
+		"svelte.config.js"
 	],
 	"bin": {
 		"axium": "dist/cli.js"
@@ -34,12 +38,13 @@
 		"build": "tsc"
 	},
 	"peerDependencies": {
-		"@axium/core": ">=0.3.0",
 		"@axium/client": ">=0.0.2",
+		"@axium/core": ">=0.3.0",
 		"utilium": "^2.3.8",
 		"zod": "^3.25.61"
 	},
 	"dependencies": {
+		"@axium/server": "file:.",
 		"@simplewebauthn/server": "^13.1.1",
 		"@sveltejs/kit": "^2.20.2",
 		"@types/pg": "^8.11.11",

package/svelte.config.js

@@ -0,0 +1,36 @@
+import node from '@sveltejs/adapter-node';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+import { join } from 'node:path/posix';
+
+/**
+ * Paths relative to the directory of this file.
+ * This allows this file to be imported from other projects and still resolve to the correct paths.
+ */
+const fixed = p => join(import.meta.dirname, p);
+
+/** @type {import('@sveltejs/kit').Config} */
+export default {
+	compilerOptions: {
+		runes: true,
+	},
+	preprocess: vitePreprocess({ script: true }),
+	vitePlugin: {
+		exclude: '@axium/server/**',
+	},
+	kit: {
+		adapter: node(),
+		alias: {
+			$stores: fixed('web/stores'),
+			$lib: fixed('web/lib'),
+		},
+		files: {
+			routes: 'routes',
+			lib: fixed('web/lib'),
+			assets: fixed('assets'),
+			appTemplate: fixed('web/template.html'),
+			hooks: {
+				server: fixed('web/hooks.server.ts'),
+			},
+		},
+	},
+};

package/web/hooks.server.ts

@@ -1,12 +1,17 @@
+import '@axium/server/api/index';
 import { loadDefaultConfigs } from '@axium/server/config';
 import { clean, database } from '@axium/server/database';
-import { _markDefaults } from '@axium/server/routes';
-import './api/index.js';
+import { dirs, logger } from '@axium/server/io';
+import { allLogLevels } from 'logzen';
+import { createWriteStream } from 'node:fs';
+import { join } from 'node:path/posix';
 
-_markDefaults();
+logger.attach(createWriteStream(join(dirs.at(-1), 'server.log')), { output: allLogLevels });
 await loadDefaultConfigs();
 await clean({});
 
 process.on('beforeExit', async () => {
 	await database.destroy();
 });
+
+export { handle } from '@axium/server/sveltekit';

package/web/lib/Dialog.svelte

@@ -1,6 +1,5 @@
 <script>
 	let { children, dialog = $bindable(), ...rest } = $props();
-	import './styles.css';
 </script>
 
 <dialog bind:this={dialog} {...rest}>

package/web/lib/FormDialog.svelte

@@ -2,7 +2,6 @@
 	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
 	import Dialog from './Dialog.svelte';
-	import './styles.css';
 
 	function resolveRedirectAfter() {
 		const maybe = page.url.searchParams.get('after');

package/web/lib/icons/Icon.svelte

@@ -1,16 +1,11 @@
 <script lang="ts">
-	import light from './light.svg';
-	import solid from './solid.svg';
-	import regular from './regular.svg';
-	const urls = { light, solid, regular };
 	const { i } = $props();
-
 	const [style, id] = $derived(i.includes('/') ? i.split('/') : ['solid', i]);
-	const url = $derived(urls[style]);
+	const href = $derived(`/icons/${style}.svg#${id}`);
 </script>
 
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="1em" height="1em">
-	<use href="{url}#{id}" />
+	<use {href} />
 </svg>
 
 <style>

package/web/template.html

@@ -0,0 +1,18 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="utf-8" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<meta name="color-scheme" content="dark light" />
+		<link rel="stylesheet" href="%sveltekit.assets%/styles.css" />
+		<link rel="preload" href="%sveltekit.assets%/icons/light.svg" as="image" type="image/svg+xml" />
+		<link rel="preload" href="%sveltekit.assets%/icons/regular.svg" as="image" type="image/svg+xml" />
+		<link rel="preload" href="%sveltekit.assets%/icons/solid.svg" as="image" type="image/svg+xml" />
+		%sveltekit.head%
+	</head>
+
+	<body>
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>

package/web/tsconfig.json

@@ -1,8 +1,9 @@
 {
+	"$schema": "https://json.schemastore.org/tsconfig",
 	"extends": "../.svelte-kit/tsconfig.json",
 	"compilerOptions": {
-		"target": "ES2021",
+		"target": "ES2023",
 		"lib": ["ESNext", "DOM", "DOM.Iterable"]
 	},
-	"include": ["**/*.ts", "**/*.svelte"]
+	"include": ["./**/*", "../lib"]
 }

package/web/api/metadata.ts

@@ -1,35 +0,0 @@
-import type { Result } from '@axium/core/api';
-import { requestMethods } from '@axium/core/requests';
-import { config } from '@axium/server/config';
-import { plugins } from '@axium/server/plugins';
-import { addRoute, routes } from '@axium/server/routes';
-import { error } from '@sveltejs/kit';
-import pkg from '../../package.json' with { type: 'json' };
-
-addRoute({
-	path: '/api/metadata',
-	async GET(): Result<'GET', 'metadata'> {
-		if (config.api.disable_metadata) {
-			error(401, { message: 'API metadata is disabled' });
-		}
-
-		return {
-			version: pkg.version,
-			routes: Object.fromEntries(
-				routes
-					.entries()
-					.filter(([path]) => path.startsWith('/api/'))
-					.map(([path, route]) => [
-						path,
-						{
-							params: Object.fromEntries(
-								Object.entries(route.params || {}).map(([key, type]) => [key, type ? type.def.type : null])
-							),
-							methods: requestMethods.filter(m => m in route),
-						},
-					])
-			),
-			plugins: Object.fromEntries(plugins.values().map(plugin => [plugin.id, plugin.version])),
-		};
-	},
-});

package/web/api/passkeys.ts

@@ -1,56 +0,0 @@
-import type { Result } from '@axium/core/api';
-import { PasskeyChangeable } from '@axium/core/schemas';
-import { getPasskey } from '@axium/server/auth';
-import { database as db } from '@axium/server/database';
-import { addRoute } from '@axium/server/routes';
-import { error } from '@sveltejs/kit';
-import { omit } from 'utilium';
-import z from 'zod/v4';
-import { checkAuth, parseBody, withError } from './utils';
-
-addRoute({
-	path: '/api/passkeys/:id',
-	params: {
-		id: z.string(),
-	},
-	async GET(event): Result<'GET', 'passkeys/:id'> {
-		const passkey = await getPasskey(event.params.id);
-		await checkAuth(event, passkey.userId);
-		return omit(passkey, 'counter', 'publicKey');
-	},
-	async PATCH(event): Result<'PATCH', 'passkeys/:id'> {
-		const body = await parseBody(event, PasskeyChangeable);
-		const passkey = await getPasskey(event.params.id);
-		await checkAuth(event, passkey.userId);
-		const result = await db
-			.updateTable('passkeys')
-			.set(body)
-			.where('id', '=', passkey.id)
-			.returningAll()
-			.executeTakeFirstOrThrow()
-			.catch(withError('Could not update passkey'));
-
-		return omit(result, 'counter', 'publicKey');
-	},
-	async DELETE(event): Result<'DELETE', 'passkeys/:id'> {
-		const passkey = await getPasskey(event.params.id);
-		await checkAuth(event, passkey.userId);
-
-		const { count } = await db
-			.selectFrom('passkeys')
-			.select(db.fn.countAll().as('count'))
-			.where('userId', '=', passkey.userId)
-			.executeTakeFirstOrThrow();
-
-		if (Number(count) <= 1) error(409, 'At least one passkey is required');
-
-		const result = await db
-			.deleteFrom('passkeys')
-			.where('id', '=', passkey.id)
-			.returningAll()
-			.executeTakeFirstOrThrow()
-			.catch(withError('Could not delete passkey'));
-
-		return omit(result, 'counter', 'publicKey');
-	},
-});

package/web/api/readme.md

@@ -1 +0,0 @@
-This is the web-facing API, not a TypeScript API. In this directory you'll find the `addRoute` calls for the built-in `/api` routes along with the utilities and other helpers used.

package/web/api/register.ts

@@ -1,83 +0,0 @@
-/** Register a new user. */
-import type { Result } from '@axium/core/api';
-import { APIUserRegistration } from '@axium/core/schemas';
-import { createPasskey, getUser, getUserByEmail } from '@axium/server/auth';
-import config from '@axium/server/config';
-import { database as db, type Schema } from '@axium/server/database';
-import { addRoute } from '@axium/server/routes';
-import { generateRegistrationOptions, verifyRegistrationResponse } from '@simplewebauthn/server';
-import { error, type RequestEvent } from '@sveltejs/kit';
-import { randomUUID } from 'node:crypto';
-import z from 'zod/v4';
-import { createSessionData, parseBody, withError } from './utils.js';
-
-// Map of user ID => challenge
-const registrations = new Map<string, string>();
-
-async function OPTIONS(event: RequestEvent): Result<'OPTIONS', 'register'> {
-	const { name, email } = await parseBody(event, z.object({ name: z.string().optional(), email: z.email().optional() }));
-
-	const userId = randomUUID();
-	const user = await getUser(userId);
-	if (user) error(409, { message: 'Generated UUID is already in use, please retry.' });
-
-	const options = await generateRegistrationOptions({
-		rpName: config.auth.rp_name,
-		rpID: config.auth.rp_id,
-		userName: email ?? userId,
-		userDisplayName: name,
-		attestationType: 'none',
-		excludeCredentials: [],
-		authenticatorSelection: {
-			residentKey: 'preferred',
-			userVerification: 'preferred',
-			authenticatorAttachment: 'platform',
-		},
-	});
-
-	registrations.set(userId, options.challenge);
-
-	return { userId, options };
-}
-
-async function POST(event: RequestEvent): Result<'POST', 'register'> {
-	const { userId, email, name, response } = await parseBody(event, APIUserRegistration);
-
-	const existing = await getUserByEmail(email);
-	if (existing) error(409, { message: 'Email already in use' });
-
-	const expectedChallenge = registrations.get(userId);
-	if (!expectedChallenge) error(404, { message: 'No registration challenge found for this user' });
-	registrations.delete(userId);
-
-	const { verified, registrationInfo } = await verifyRegistrationResponse({
-		response,
-		expectedChallenge,
-		expectedOrigin: config.auth.origin,
-	}).catch(() => error(400, { message: 'Verification failed' }));
-
-	if (!verified || !registrationInfo) error(401, { message: 'Verification failed' });
-
-	await db
-		.insertInto('users')
-		.values({ id: userId, name, email } as Schema['users'])
-		.executeTakeFirstOrThrow()
-		.catch(withError('Failed to create user'));
-
-	await createPasskey({
-		transports: [],
-		...registrationInfo.credential,
-		userId,
-		deviceType: registrationInfo.credentialDeviceType,
-		backedUp: registrationInfo.credentialBackedUp,
-	}).catch(e => error(500, { message: 'Failed to create passkey' + (config.debug ? `: ${e.message}` : '') }));
-
-	return await createSessionData(event, userId);
-}
-
-addRoute({
-	path: '/api/register',
-	params: {},
-	OPTIONS,
-	POST,
-});

package/web/api/schemas.ts

@@ -1,22 +0,0 @@
-import type { AuthenticatorTransportFuture } from '@simplewebauthn/server';
-import z from 'zod/v4';
-
-const transports = ['ble', 'cable', 'hybrid', 'internal', 'nfc', 'smart-card', 'usb'] satisfies AuthenticatorTransportFuture[];
-
-export const authenticatorAttachment = z.enum(['platform', 'cross-platform'] satisfies AuthenticatorAttachment[]).optional();
-
-export const PasskeyRegistration = z.object({
-	id: z.string(),
-	rawId: z.string(),
-	response: z.object({
-		clientDataJSON: z.string(),
-		attestationObject: z.string(),
-		authenticatorData: z.string().optional(),
-		transports: z.array(z.enum(transports)).optional(),
-		publicKeyAlgorithm: z.number().optional(),
-		publicKey: z.string().optional(),
-	}),
-	authenticatorAttachment,
-	clientExtensionResults: z.record(z.any(), z.any()),
-	type: z.literal('public-key'),
-});