@bakery-framework/core 1.2.3 → 2.0.0-alpha.1

package/src/utils/http/credential.ts

@@ -0,0 +1,70 @@
+/**
+ * Shared-credential check for plugin surfaces (`plugin({ credential:
+ * import.meta.env.SOME_KEY })`).
+ *
+ * One implementation, deliberately in core: the db-explorer and analytics
+ * plugins each need it and per-plugin copies of security code drift. It owns
+ * *only* the comparison — no logins, no sessions, no backoff.
+ *
+ * A credential is presented three ways, in this order of preference:
+ *
+ *   - `x-<name>` header (scriptable, never logged by default)
+ *   - `Authorization: Bearer <credential>`
+ *   - `?<name>=<credential>` query, for a human opening a URL in a browser
+ *     who cannot set a header — the caller is expected to strip it from the
+ *     URL client-side; it *does* reach server logs, which is documented, and
+ *     the header forms exist for anything automated.
+ *
+ * An empty or missing configured credential **disables** this path rather
+ * than matching everything: `credential: import.meta.env.KEY` with the
+ * variable unset must mean "off", not "open".
+ *
+ * The compare is constant-time. A plain `===` on a secret is a timing oracle,
+ * and `timingSafeEqual` costs one line — but it throws on length mismatch, so
+ * the length is checked first (which leaks only the length, never the bytes).
+ */
+
+import { timingSafeEqual } from 'node:crypto'
+
+export function credentialMatches(
+  configured: string | undefined,
+  presented: string | null | undefined,
+): boolean {
+  if (!configured || !presented) return false
+
+  const a = Buffer.from(configured)
+  const b = Buffer.from(presented)
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
+}
+
+/**
+ * Pull a presented credential off a request: the `x-<name>` header, a Bearer
+ * token, or the `<name>` query parameter, in that order. Returns `null` when
+ * none is present. `name` is the header/query key — `db-key`, `analytics-key`.
+ */
+export function readCredential(req: Request, name: string): string | null {
+  const header = req.headers.get(`x-${name}`)
+  if (header) return header
+
+  const bearer = req.headers
+    .get('authorization')
+    ?.replace(/^Bearer\s+/i, '')
+    .trim()
+  if (bearer) return bearer
+
+  return new URL(req.url).searchParams.get(name)
+}
+
+/**
+ * The whole check in one call: does the request present `configured` under
+ * `name`? `false` for an unset credential or an absent presentation.
+ */
+export function requestHasCredential(
+  req: Request,
+  configured: string | undefined,
+  name: string,
+): boolean {
+  if (!configured) return false
+  return credentialMatches(configured, readCredential(req, name))
+}

package/src/utils/http/dom.ts

@@ -1,3 +1,4 @@
+import { readdir } from 'node:fs/promises'
 import { LRUCache } from '../../cache/lru'
 import { Bakery, hostStore } from '../../core/bakery'
 import type { MapOf } from '../../types'
@@ -16,16 +17,6 @@ export function clearHeadBodyCache() {
 
 export { headBodyCache }
 
-type PackageJson = {
-  name: string
-  version: string
-  main?: string
-  module?: string
-  browser?: string | MapOf<string>
-  dependencies?: MapOf<string>
-  devDependencies?: MapOf<string>
-}
-
 let depMap = ''
 
 const hostDepMaps = new Map<string, string>()
@@ -34,22 +25,14 @@ const hostDepMaps = new Map<string, string>()
  * Normalise one import-map entry, for both the process-level map and the
  * per-host maps.
  *
- * There used to be two copies of this, and they had drifted into disagreeing
- * about *what* they tested: `initHostImportMaps` switched on the entry key,
- * `initImportMap` tested the entry value. `{ foo: './.server/client/utils' }`
- * was rewritten by one path and silently left alone by the other. One helper,
- * two callers, so they cannot disagree again.
+ * One helper, two callers, deliberately: they used to be separate copies that
+ * had drifted into testing different things — one switched on the entry key,
+ * the other on the entry value — so the same input normalised two ways
+ * depending on which path saw it.
  *
- * The `.server/client/utils` special cases both copies carried are gone rather
- * than reconciled. `.server/` is the pre-split layout: those two string
- * literals were the last references to it anywhere in `packages`, `apps`,
- * `docs` or `tests`, and the directory they name no longer exists, so a value
- * pointing at it is a broken path either way. It normalises as an ordinary
- * relative specifier now.
- *
- * `@client/utils` stays, and stays keyed on the *key*: it is a live alias — it
- * is the default `importMap` entry in `core/config.ts` — and the browser
- * runtime is served from a fixed URL, so the target is not the app's to choose.
+ * `@client/utils` is keyed on the *key*: it is a live alias, the default
+ * `importMap` entry in `core/config.ts`, and the browser runtime is served from
+ * a fixed URL, so the target is not the app's to choose.
  */
 function normalizeImportEntry(key: string, value: unknown): [string, string] {
   const cleanKey = key.replace(/\*$/, '')
@@ -85,53 +68,79 @@ export function initHostImportMaps() {
   }
 }
 
-function resolveDepModule(pkgData: PackageJson, baseMod: string): string {
-  if (is.string(pkgData.browser)) return pkgData.browser as string
+let installedCache: Promise<string[]> | null = null
 
-  if (is.object(pkgData.browser)) {
-    const cleanBase = baseMod.replace(/^\.\//, '')
-    const browserField = pkgData.browser as MapOf<string>
-    const lookupKeys = [baseMod, `./${cleanBase}`, cleanBase]
-    const matchedOverride = lookupKeys.find(key => browserField[key])
+/**
+ * Every installed package, top level and scoped, as `name` and `name/`.
+ *
+ * Read from `node_modules` rather than from `dependencies`, and the difference
+ * is the whole point: a package can be installed and imported without being
+ * declared — a transitive one, or a dependency someone forgot to add — and the
+ * browser's failure for a specifier the map misses names its own rule rather
+ * than the missing entry: *"Failed to resolve module specifier 'pkg'. Relative
+ * references must start with either "/", "./", or "../"."*
+ *
+ * Cheap — one `readdir` per scope, no `package.json` reads — and memoised per
+ * process besides: the import map reads it at boot, `bundleModule` on every
+ * bundle (as its `external` list), and a `readdir` sweep per bundle is pure
+ * waste. A dev restart is a new process, so an install still shows up.
+ */
+export function installedPackages(): Promise<string[]> {
+  installedCache ??= readInstalledPackages()
+  return installedCache
+}
+
+async function readInstalledPackages(): Promise<string[]> {
+  const root = fs.resolve(fs.cwd, 'node_modules')
+  const [err, entries] = await Try.catch(() => readdir(root))
+  if (err || !entries) return []
+
+  const names: string[] = []
+  for (const entry of entries) {
+    // `.bin`, `.cache` and friends are not packages.
+    if (entry.startsWith('.')) continue
 
-    return matchedOverride ? browserField[matchedOverride] : baseMod
+    if (!entry.startsWith('@')) {
+      names.push(entry)
+      continue
+    }
+
+    const [scopeErr, scoped] = await Try.catch(() =>
+      readdir(`${root}/${entry}`),
+    )
+    if (scopeErr || !scoped) continue
+    for (const name of scoped) {
+      if (!name.startsWith('.')) names.push(`${entry}/${name}`)
+    }
   }
 
-  return baseMod
+  return names
 }
 
+/**
+ * Build the browser import map.
+ *
+ * **Resolution happens at the other end of the URL, and rewriting happens
+ * nowhere.** An entry maps a package to `/_nm/<name>`; `NMHandler` hands that to
+ * `Bun.build`, which applies real browser resolution — `exports` maps,
+ * conditions, the `browser` field. Naming an entry file here instead would mean
+ * reimplementing all of that, badly.
+ *
+ * Covering every installed package is what removes the need for a compile-time
+ * rewrite of bare specifiers, and the map reaches code the compiler never sees:
+ * an inline `<script type="module">` in an `.html` page arrives at the browser
+ * with its imports intact.
+ *
+ * App-declared `importMap` entries are applied last and win. One of them,
+ * `@client/utils`, does not point into `node_modules` at all.
+ */
 export async function initImportMap() {
-  const pkgContent = await Try(() =>
-    Bun.file(fs.resolve(fs.cwd, 'package.json')).json(),
-  )
-  const pkg: any = pkgContent || {}
   const map = Bakery.config.importMap || {}
-  const deps = pkg.dependencies || {}
-
   const resolvedMap: MapOf<string> = {}
 
-  const imports = await Promise.all(
-    Object.keys(deps).map(async dep => {
-      const pkgData = await Try(
-        Bun.file(`./node_modules/${dep}/package.json`).json(),
-      )
-
-      return { dep, pkgData: pkgData as PackageJson | null }
-    }),
-  )
-
-  for (const { dep, pkgData } of imports) {
-    if (!pkgData) continue
-
-    const actualName = pkgData.name || dep
-    resolvedMap[`${actualName}/`] = `/_nm/${actualName}/`
-
-    const baseMod = pkgData.module || pkgData.main || 'index.js'
-    const mod = resolveDepModule(pkgData, baseMod)
-
-    const finalMod = typeof mod === 'string' ? mod : 'index.js'
-    resolvedMap[actualName] =
-      `/_nm/${actualName}/${finalMod.replace(/^\.\//, '')}`
+  for (const name of await installedPackages()) {
+    resolvedMap[`${name}/`] = `/_nm/${name}/`
+    resolvedMap[name] = `/_nm/${name}`
   }
 
   for (const [k, v] of Object.entries(map)) {
@@ -149,8 +158,8 @@ export namespace DOMTools {
     return `<script type="importmap">${map}</script>`
   }
 
-  export function params(params: MapOf<string>) {
-    const newParams: MapOf<string> = {}
+  export function params(params: MapOf<unknown>) {
+    const newParams: MapOf<unknown> = {}
 
     for (const [k, v] of Object.entries(params)) {
       if (k.startsWith('$$')) continue

package/src/utils/http/html.ts

@@ -80,7 +80,7 @@ export const STREAM_THRESHOLD_BYTES = 64 * 1024
 
 export async function injectIfHtml(
   data: string | Response | Blob,
-  params?: MapOf<string>,
+  params?: MapOf<unknown>,
   injects?: HtmlInjects,
 ): Promise<Response | null> {
   if (data instanceof Response && isInjected(data)) return data
@@ -127,7 +127,7 @@ export async function injectIfHtml(
  * streamed path's fallback both come through here. */
 function bufferedResponse(
   content: string,
-  params: MapOf<string> | undefined,
+  params: MapOf<unknown> | undefined,
   injects: HtmlInjects | undefined,
   responseInit: ResponseInit & { headers?: any },
 ): Response {
@@ -182,7 +182,7 @@ function getConfigInjects() {
  * into a pull callback, where the AsyncLocalStorage host context that
  * `getConfigInjects` and `DOMTools.importMap` read may no longer be live.
  */
-function computeInjects(params: MapOf<string>, injects: HtmlInjects) {
+function computeInjects(params: MapOf<unknown>, injects: HtmlInjects) {
   const configInjects = getConfigInjects()
   const paramsStr = DOMTools.params(params)
 
@@ -235,7 +235,7 @@ function rewriteFontsUrls(html: string): string {
 
 export function assembleHtml(
   content: string,
-  params: MapOf<string> = {},
+  params: MapOf<unknown> = {},
   injects: HtmlInjects = {},
 ) {
   const frags = computeInjects(params, injects)

package/src/utils/http/index.ts

@@ -1,4 +1,5 @@
 export * from './body'
+export * from './credential'
 export * from './csrf'
 export * from './dom'
 export * from './escape'

package/src/utils/isomorphic/misc.ts

@@ -15,6 +15,22 @@ export function any<T = any>(value: any): T {
   return value
 }
 
+/**
+ * A hex id of `length` characters, from `crypto.getRandomValues`.
+ *
+ * Isomorphic, and moving it here is what made it so: it lived in
+ * `client/utils.ts` as a browser global only, so the same call in a server
+ * block was a ReferenceError — reported from an app. `crypto` is a global in
+ * both runtimes; nothing here is browser-specific.
+ */
+export function randomId(length = 8) {
+  const arr = new Uint8Array(Math.ceil(length / 2))
+  crypto.getRandomValues(arr)
+  return Array.from(arr, dec => dec.toString(16).padStart(2, '0'))
+    .join('')
+    .slice(0, length)
+}
+
 export function repeat(n: number): number[]
 export function repeat<T>(n: number, fn: (i: number) => T): T[]
 export function repeat<T>(n: number, fn?: (i: number) => T): unknown[] {