@beignet/cli 0.0.23 → 0.0.24

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @beignet/cli
 
+## 0.0.24
+
+### Patch Changes
+
+- 9d518c0: Generate server-only boundary markers as side-effect imports so app linting can
+  keep a consistent unused-import rule.
+- d07a420: Redact Redis credentials from provider startup errors and show a production
+  hardening checklist when doctor reports deployment-readiness diagnostics.
+- 91bc9b5: Harden framework security defaults for generated tenancy, auth secrets, CORS,
+  body limits, uploads, devtools, OpenAPI, rate-limit IP sources, public storage,
+  and Meilisearch query fields.
+- Updated dependencies [9d518c0]
+- Updated dependencies [91bc9b5]
+  - @beignet/core@0.0.24
+
 ## 0.0.23
 
 ### Patch Changes

package/README.md

@@ -562,8 +562,10 @@ increment it on success. Stale updates become the generated
 
 Use `--auth` to generate authorization metadata, policy wiring, and use-case
 `ctx.gate.authorize(...)` calls. Use `--tenant` to scope repository reads and
-writes by `ctx.tenant`. Use `--events` to generate created, updated, and
-deleted domain events and publish them through `ctx.ports.eventBus`. The
+writes by `ctx.tenant`; generated request contexts resolve tenants from
+verified session metadata, while service contexts may pass an explicit
+`tenantId`. Use `--events` to generate created, updated, and deleted domain
+events and publish them through `ctx.ports.eventBus`. The
 starter ships no event bus, so `--events` also wires one: it adds
 `eventBus: EventBusPort` to `AppPorts`, defers the key in
 `infra/app-ports.ts`, registers `createInMemoryEventBusProvider()` in
@@ -880,6 +882,12 @@ Today it detects:
 - Notification dispatchers that bypass `ctx.ports.notifications`
 - Feature artifacts in non-canonical folders
 
+When production-readiness diagnostics are present, human `doctor` output also
+prints a production hardening checklist covering secrets and provider
+credentials, verified auth and tenant authority, exposed operational routes,
+CORS and proxy trust, upload and storage limits, readiness checks, worker
+shutdown, webhook secrets, and least-privilege provider credentials.
+
 Provider package diagnostics come from package-owned `beignet.provider`
 metadata in installed package manifests. The CLI does not import provider
 implementation modules to discover those facts, and it reports malformed

package/dist/inspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../src/inspect.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,aAAa,EAOlB,KAAK,qBAAqB,EAE3B,MAAM,aAAa,CAAC;AAkBrB,KAAK,iBAAiB,GAAG;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,UAAU,GACX,KAAK,GACL,MAAM,GACN,KAAK,GACL,OAAO,GACP,QAAQ,GACR,MAAM,GACN,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,wBAAwB,EAAE,CAAC;CAC3C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,aAAa,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC;CACzD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB,CAAC;AAuCF,wBAAsB,UAAU,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAsC3B;AAED,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,CAyDvB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAmB7D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,MAAM,CAkER;AAWD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAUnE"}
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../src/inspect.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,aAAa,EAOlB,KAAK,qBAAqB,EAE3B,MAAM,aAAa,CAAC;AAkBrB,KAAK,iBAAiB,GAAG;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,UAAU,GACX,KAAK,GACL,MAAM,GACN,KAAK,GACL,OAAO,GACP,QAAQ,GACR,MAAM,GACN,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,wBAAwB,EAAE,CAAC;CAC3C,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,aAAa,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC;CACzD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB,CAAC;AAuCF,wBAAsB,UAAU,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAsC3B;AAED,wBAAsB,gBAAgB,CACpC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,CAyDvB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAmB7D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,MAAM,CAwER;AAoDD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAUnE"}

package/dist/inspect.js

@@ -135,9 +135,46 @@ export function formatDoctor(result, options = {}) {
   ${diagnostic.message}`;
         }));
     }
+    const checklist = productionHardeningChecklist(result.diagnostics);
+    if (checklist.length > 0) {
+        lines.push("", paint("Production Hardening Checklist:", "bold"), "");
+        lines.push(...checklist.map((item) => `- ${item}`));
+    }
     lines.push("", formatDoctorFooter(result));
     return lines.join("\n");
 }
+const productionHardeningDiagnosticCodes = new Set([
+    "BEIGNET_AUTH_ROUTE_MISSING",
+    "BEIGNET_AUTH_TRUSTED_ORIGINS_MISSING",
+    "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
+    "BEIGNET_BILLING_CHECKOUT_IDEMPOTENCY_MISSING",
+    "BEIGNET_BILLING_ENTITLEMENTS_PROVIDER_MISSING",
+    "BEIGNET_BILLING_IDEMPOTENCY_PORT_MISSING",
+    "BEIGNET_CORS_CREDENTIALS_WILDCARD",
+    "BEIGNET_CRON_SECRET_MISSING",
+    "BEIGNET_DEVTOOLS_ROUTE_EXPOSED",
+    "BEIGNET_ENTITLEMENTS_PORT_MISSING",
+    "BEIGNET_PAYMENTS_STRIPE_MEMORY_PROVIDER",
+    "BEIGNET_PAYMENTS_WEBHOOK_ROUTE_MISSING",
+    "BEIGNET_PROVIDER_ENV_MISSING",
+    "BEIGNET_READINESS_ROUTE_MISSING",
+    "BEIGNET_TENANT_HEADER_AUTHORITY",
+    "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
+    "BEIGNET_UPLOAD_SIZE_LIMIT_MISSING",
+]);
+function productionHardeningChecklist(diagnostics) {
+    if (!diagnostics.some((diagnostic) => productionHardeningDiagnosticCodes.has(diagnostic.code))) {
+        return [];
+    }
+    return [
+        "Secrets and provider credentials are unique per environment, validated at startup, never committed, and never logged.",
+        "Auth routes, tenant resolution, authorization policies, and trusted origins derive authority from verified sessions, API keys, or trusted gateway metadata.",
+        "Devtools, OpenAPI, cron, webhooks, and operational routes have intentional exposure and app-owned authorization.",
+        "CORS origins, proxy IP trust, rate-limit keys, and request body limits match the production host topology.",
+        "Uploads and storage define max sizes, authorization or explicit public access, object visibility, safe content headers, and short direct-upload expirations.",
+        "Provider-backed dependencies have bounded readiness checks, worker shutdown behavior, webhook secrets, and least-privilege credentials.",
+    ];
+}
 function formatDoctorFooter(result) {
     const count = (severity) => result.diagnostics.filter((diagnostic) => diagnostic.severity === severity)
         .length;
@@ -1222,6 +1259,26 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
                 message: `${file} defines an upload without maxSizeBytes. Add an explicit size limit so upload behavior is predictable before deployment.`,
             });
         }
+        if (isFeatureUploadDefinition(file, config) &&
+            containsCallExpression(source, "defineUpload") &&
+            !/\bauthorize\s*(?:\(|:)/.test(source) &&
+            !/\baccess\s*:\s*["']public["']/.test(source)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_UPLOAD_AUTHORIZATION_MISSING",
+                file,
+                message: `${file} defines a protected upload without authorize(...). Add an authorize hook, or set access: "public" only for intentionally public uploads.`,
+            });
+        }
+        if (isRouteServerOrInfraFile(file, config) &&
+            containsRequestTenantHeaderAuthority(source)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_TENANT_HEADER_AUTHORITY",
+                file,
+                message: `${file} reads x-tenant-id and turns it into tenant authority. Resolve request tenants from verified auth/session claims or trusted gateway metadata instead of a caller-controlled header.`,
+            });
+        }
         if (isRouteServerOrInfraFile(file, config) &&
             containsCallExpression(source, "createCorsHooks") &&
             /\bcredentials\s*:\s*true\b/.test(source) &&
@@ -1234,6 +1291,17 @@ async function inspectProductionReadiness(targetDir, files, config, convention)
             });
         }
     }
+    for (const file of configFiles) {
+        const source = await readCachedSource(targetDir, file, sourceCache);
+        if (containsBetterAuthLocalSecret(source)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "BEIGNET_BETTER_AUTH_SECRET_PLACEHOLDER",
+                file,
+                message: `${file} contains the known local Better Auth placeholder secret. Keep it out of production configuration and require a unique BETTER_AUTH_SECRET before deployment.`,
+            });
+        }
+    }
     const providerEntries = await readProviderListEntries(targetDir, files, config, sourceCache);
     const stripeMemoryProviderMismatch = await hasStripeMemoryProviderMismatch(targetDir, sourceCache, configFiles, installedPackages, providerEntries);
     diagnostics.push(...(await inspectEntitlementsProductionReadiness(targetDir, files, config, sourceCache)), ...(await inspectPaymentsProductionReadiness(targetDir, files, config, sourceCache, installedPackages, stripeMemoryProviderMismatch)));
@@ -1323,6 +1391,19 @@ function containsReadinessCheck(source) {
         return false;
     return /\bchecks\s*:/.test(source) || /\.checkHealth\s*\(/.test(source);
 }
+function containsBetterAuthLocalSecret(source) {
+    if (!source.includes("local-dev-better-auth-secret-change-me"))
+        return false;
+    const hasProductionRuntimeGuard = /\bisProductionRuntime\s*=\s*process\.env\.NODE_ENV\s*===\s*["']production["']\s*&&\s*process\.env\.NEXT_PHASE\s*!==\s*["']phase-production-build["']/.test(source) &&
+        /BETTER_AUTH_SECRET\s*:\s*isProductionRuntime\s*\?\s*BetterAuthSecret\s*:\s*BetterAuthSecret\.default\(LOCAL_BETTER_AUTH_SECRET\)/s.test(source);
+    const hasProductionGuard = /BETTER_AUTH_SECRET\s*:\s*process\.env\.NODE_ENV\s*===\s*["']production["']\s*\?\s*BetterAuthSecret\s*:\s*BetterAuthSecret\.default\(LOCAL_BETTER_AUTH_SECRET\)/s.test(source);
+    return !(hasProductionRuntimeGuard || hasProductionGuard);
+}
+function containsRequestTenantHeaderAuthority(source) {
+    return (/(?:(?:\breq|\brequest)\.headers|(?<!\.)\bheaders)\.get\(\s*["']x-tenant-id["']\s*\)/.test(source) &&
+        (/\bcreateTenant\s*\(/.test(source) ||
+            /\btenant\s*:\s*\{?\s*id\s*:/.test(source)));
+}
 async function inspectEntitlementsProductionReadiness(targetDir, files, config, sourceCache) {
     if (!(await usesEntitlementChecks(targetDir, files, sourceCache)) ||
         (await appPortsIncludesPort(targetDir, files, config, sourceCache, "entitlements"))) {