@bhooai/nexus-core 2.0.13 → 2.0.15

package/src/http/Server.ts

@@ -25,6 +25,14 @@ export interface ServerOptions {
   keyFile?: string;
   /** Called for each error to produce a JSON error body. */
   onError?: (err: NexusError, ctx: RequestContext) => unknown;
+  /**
+   * Full custom error renderer (e.g. content-negotiated HTML via
+   * ErrorHandler.render). When provided it takes precedence over `onError`.
+   * If it leaves the response unwritten, the legacy JSON body is used.
+   */
+  renderError?: (err: unknown, ctx: RequestContext) => Promise<void> | void;
+  /** Custom 404 renderer for unmatched routes. Falls back to JSON. */
+  renderNotFound?: (ctx: RequestContext) => Promise<void> | void;
 }
 
 /**
@@ -56,7 +64,7 @@ export class NexusServer {
     return this;
   }
 
-  listen(port: number, host: string = '0.0.0.0'): Promise<void> {
+  listen(port: number, host: string = 'localhost'): Promise<void> {
     return new Promise((resolve) => {
       this.server.listen(port, host, () => resolve());
     });
@@ -83,7 +91,7 @@ export class NexusServer {
     try {
       await this.runPipeline(ctx);
     } catch (err) {
-      this.handleError(err, ctx);
+      await this.handleError(err, ctx);
     }
   }
 
@@ -97,6 +105,14 @@ export class NexusServer {
     await next();
 
     if (!ctx.res.writableEnded) {
+      if (this.opts.renderNotFound) {
+        try {
+          await this.opts.renderNotFound(ctx);
+        } catch (err) {
+          await this.handleError(err, ctx);
+        }
+        if (ctx.res.writableEnded) return;
+      }
       ctx.json({ error: { code: 'NOT_FOUND', message: `No route for ${ctx.method} ${ctx.path}` } }, 404);
     }
   }
@@ -122,8 +138,16 @@ export class NexusServer {
     };
   }
 
-  private handleError(err: unknown, ctx: RequestContext): void {
+  private async handleError(err: unknown, ctx: RequestContext): Promise<void> {
     if (ctx.res.writableEnded) return;
+    if (this.opts.renderError) {
+      try {
+        await this.opts.renderError(err, ctx);
+      } catch {
+        // Fall through to the legacy JSON body below.
+      }
+      if (ctx.res.writableEnded) return;
+    }
     const ne = toNexusError(err);
     const body = this.opts.onError ? this.opts.onError(ne, ctx) : defaultErrorBody(ne);
     if (!ctx.res.headersSent) {

package/src/http/static.ts

@@ -38,7 +38,7 @@ export function serveStatic(root: string, options: { index?: string; prefix?: st
       return;
     }
     const requestPath = prefix ? ctx.path.slice(prefix.length) || '/' : ctx.path;
-    const safe = normalize(requestPath).replace(/^(\.\.[/\\])+/, '');
+    const safe = normalize(requestPath).replace(/^(\.\.[/\\])+/, '').replace(/^[/\\]+/, '');
     let filePath = join(root, safe);
     if (isOutside(root, filePath)) {
       throw new NotFoundError();

package/tests/config.test.ts

@@ -28,10 +28,33 @@ describe('configFromEnv', () => {
 });
 
 describe('mergeConfig', () => {
+  it('defaults apps[] to an empty array', () => {
+    const cfg = mergeConfig({ auth: { jwt: { secret: 'supersecret' } } });
+    expect(cfg.apps).toEqual([]);
+  });
+
+  it('accepts an apps[] layout and validates entries', () => {
+    const cfg = mergeConfig({
+      apps: [
+        { name: 'backend', port: 4000 },
+        { name: 'backend-shop', port: 4001, enabled: false },
+      ],
+      auth: { jwt: { secret: 'supersecret' } },
+    });
+    expect(cfg.apps).toEqual([
+      { name: 'backend', port: 4000, enabled: undefined },
+      { name: 'backend-shop', port: 4001, enabled: false },
+    ]);
+  });
+
+  it('rejects an invalid apps[] port', () => {
+    expect(() => mergeConfig({ apps: [{ name: 'a', port: 0 }], auth: { jwt: { secret: 'supersecret' } } })).toThrow();
+  });
+
   it('applies user overrides over defaults and validates', () => {
     const cfg = mergeConfig({ server: { port: 5000 }, auth: { jwt: { secret: 'supersecret' } } });
     expect(cfg.server.port).toBe(5000);
-    expect(cfg.server.host).toBe('127.0.0.1'); // default retained
+    expect(cfg.server.host).toBe('localhost'); // default retained
     expect(cfg.auth.jwt.secret).toBe('supersecret');
   });
 

package/tests/fusion-userstore.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { fusion } from '../../nexus-fusion/src/index.js';
+import { FusionUserStore } from '../src/app/userStore.js';
+
+describe('FusionUserStore', () => {
+  const dbs: Array<{ close(): void }> = [];
+  afterEach(() => {
+    for (const db of dbs.splice(0)) db.close();
+  });
+
+  function freshStore() {
+    const db = fusion('main', 'prod'); // in-memory (no dir)
+    dbs.push(db);
+    return new FusionUserStore(db);
+  }
+
+  it('reads empty collections without throwing', async () => {
+    const store = freshStore();
+    expect(await store.count()).toBe(0);
+    expect(await store.countAdmins()).toBe(0);
+    expect(await store.list(10)).toEqual([]);
+    expect(await store.findByEmail('nobody@x.com')).toBeNull();
+    expect(await store.findById('nope')).toBeNull();
+    expect(await store.findOAuthUser('google', 'g9')).toBeNull();
+  });
+
+  it('creates + finds by email (lowercased) and id', async () => {
+    const store = freshStore();
+    const created = await store.create({ email: 'Alice@Example.com', name: 'Alice', roles: ['user'] });
+    expect(created.email).toBe('alice@example.com');
+    expect(await store.findByEmail('ALICE@example.com')).toMatchObject({ email: 'alice@example.com' });
+    expect(await store.findById(String(created._id))).toMatchObject({ name: 'Alice' });
+    expect(await store.findForLogin('alice@example.com')).toMatchObject({ name: 'Alice' });
+  });
+
+  it('rejects duplicate emails', async () => {
+    const store = freshStore();
+    await store.create({ email: 'dup@x.com', roles: ['user'] });
+    await expect(store.create({ email: 'dup@x.com', roles: ['user'] })).rejects.toThrow();
+  });
+
+  it('updates name/password/roles and counts admins', async () => {
+    const store = freshStore();
+    const a = await store.create({ email: 'a@x.com', roles: ['admin'] });
+    await store.create({ email: 'b@x.com', roles: ['user'] });
+    expect(await store.count()).toBe(2);
+    expect(await store.countAdmins()).toBe(1);
+    await store.setName(String(a._id), 'A2');
+    expect((await store.findById(String(a._id)))?.name).toBe('A2');
+    await store.setPassword(String(a._id), 'hash123');
+    expect(await store.findPasswordHash(String(a._id))).toBe('hash123');
+    await store.setRoles(String(a._id), ['user']);
+    expect(await store.countAdmins()).toBe(0);
+    const listed = await store.list(10);
+    expect(listed).toHaveLength(2);
+  });
+
+  it('links + finds OAuth identities', async () => {
+    const store = freshStore();
+    const u = await store.create({ email: 'o@x.com', roles: ['user'] });
+    expect(await store.findOAuthUser('google', 'g1')).toBeNull();
+    await store.linkOAuth(String(u._id), 'google', 'g1');
+    expect(await store.findOAuthUser('google', 'g1')).toMatchObject({ email: 'o@x.com' });
+    // Idempotent re-link.
+    await store.linkOAuth(String(u._id), 'google', 'g1');
+    expect((await store.findById(String(u._id)))?.oauthAccounts).toHaveLength(1);
+  });
+});