@c15t/backend 2.0.0-rc.4 → 2.0.0-rc.5

package/src/init.ts

@@ -1,88 +0,0 @@
-import type { C15TContext, C15TOptions } from '~/types';
-import { createRegistry } from './db/registry';
-import { DB } from './db/schema';
-import { withTenantScope } from './db/tenant-scope';
-import {
-	createTelemetryOptions,
-	isTelemetryEnabled,
-} from './utils/create-telemetry-options';
-import { initLogger } from './utils/logger';
-
-/**
- * Initializes the c15t backend context.
- *
- * Telemetry (tracing and metrics) is opt-in and disabled by default.
- * Users must:
- * 1. Set up their own OpenTelemetry SDK (Node.js, Bun, edge runtime, etc.)
- * 2. Pass enabled: true and optionally a tracer/meter to the telemetry config
- *
- * @example
- * ```typescript
- * // User sets up their own SDK before calling init
- * import { NodeSDK } from '@opentelemetry/sdk-node';
- * const sdk = new NodeSDK({ ... });
- * sdk.start();
- *
- * // Then pass telemetry config
- * const instance = c15tInstance({
- *   telemetry: {
- *     enabled: true,
- *     tracer: trace.getTracer('my-app'),
- *     meter: metrics.getMeter('my-app'),
- *   },
- * });
- * ```
- */
-export const init = (options: C15TOptions): C15TContext => {
-	const appName = options.appName || 'c15t';
-
-	const logger = initLogger({
-		...options.logger,
-		appName: String(appName),
-	});
-
-	// Create telemetry options (validates and merges with defaults)
-	const telemetryOptions = createTelemetryOptions(
-		String(appName),
-		options.telemetry,
-		options.tenantId
-	);
-
-	// Log telemetry status
-	if (isTelemetryEnabled(options)) {
-		logger.debug('Telemetry is enabled', {
-			hasTracer: !!telemetryOptions?.tracer,
-			hasMeter: !!telemetryOptions?.meter,
-			attributes: telemetryOptions?.defaultAttributes,
-		});
-	} else {
-		logger.debug('Telemetry is disabled (opt-in required)');
-	}
-
-	// Initialize core components
-	const db = options.tablePrefix ? DB.names.prefix(options.tablePrefix) : DB;
-	const client = db.client(options.adapter);
-
-	const rawOrm = client.orm('2.0.0');
-	const orm = options.tenantId
-		? withTenantScope(rawOrm, options.tenantId)
-		: rawOrm;
-
-	// Destructure ipAddress config to avoid type conflict with C15TContext.ipAddress (resolved string)
-	const { ipAddress: _ipAddressConfig, ...baseOptions } = options;
-
-	const context: C15TContext = {
-		...baseOptions,
-		appName,
-		logger,
-		db: orm,
-		registry: createRegistry({
-			db: orm,
-			ctx: {
-				logger,
-			},
-		}),
-	};
-
-	return context;
-};

package/src/middleware/auth/index.ts

@@ -1,11 +0,0 @@
-/**
- * Authentication middleware exports.
- *
- * @packageDocumentation
- */
-
-export {
-	extractBearerToken,
-	validateApiKey,
-	validateRequestAuth,
-} from './validate-api-key';

package/src/middleware/auth/validate-api-key.test.ts

@@ -1,86 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-	extractBearerToken,
-	validateApiKey,
-	validateRequestAuth,
-} from './validate-api-key';
-
-describe('extractBearerToken', () => {
-	it('should extract token from valid Bearer header', () => {
-		expect(extractBearerToken('Bearer sk_live_abc123')).toBe('sk_live_abc123');
-	});
-
-	it('should return null for non-Bearer auth', () => {
-		expect(extractBearerToken('Basic abc123')).toBeNull();
-	});
-
-	it('should return null for missing Bearer prefix', () => {
-		expect(extractBearerToken('sk_live_abc123')).toBeNull();
-	});
-
-	it('should return null for null header', () => {
-		expect(extractBearerToken(null)).toBeNull();
-	});
-
-	it('should return null for empty header', () => {
-		expect(extractBearerToken('')).toBeNull();
-	});
-
-	it('should handle extra spaces', () => {
-		expect(extractBearerToken('Bearer  abc123')).toBeNull(); // Two spaces
-	});
-});
-
-describe('validateApiKey', () => {
-	const validKeys = ['sk_live_abc123', 'sk_live_def456'];
-
-	it('should return true for valid key', () => {
-		expect(validateApiKey('sk_live_abc123', validKeys)).toBe(true);
-		expect(validateApiKey('sk_live_def456', validKeys)).toBe(true);
-	});
-
-	it('should return false for invalid key', () => {
-		expect(validateApiKey('sk_live_invalid', validKeys)).toBe(false);
-	});
-
-	it('should return false for null token', () => {
-		expect(validateApiKey(null, validKeys)).toBe(false);
-	});
-
-	it('should return false for undefined keys', () => {
-		expect(validateApiKey('sk_live_abc123', undefined)).toBe(false);
-	});
-
-	it('should return false for empty keys array', () => {
-		expect(validateApiKey('sk_live_abc123', [])).toBe(false);
-	});
-
-	it('should be case-sensitive', () => {
-		expect(validateApiKey('SK_LIVE_ABC123', validKeys)).toBe(false);
-	});
-});
-
-describe('validateRequestAuth', () => {
-	const validKeys = ['sk_live_abc123'];
-
-	it('should return true for valid Authorization header', () => {
-		const headers = new Headers();
-		headers.set('Authorization', 'Bearer sk_live_abc123');
-		expect(validateRequestAuth(headers, validKeys)).toBe(true);
-	});
-
-	it('should return false for invalid token', () => {
-		const headers = new Headers();
-		headers.set('Authorization', 'Bearer sk_live_invalid');
-		expect(validateRequestAuth(headers, validKeys)).toBe(false);
-	});
-
-	it('should return false for missing Authorization header', () => {
-		const headers = new Headers();
-		expect(validateRequestAuth(headers, validKeys)).toBe(false);
-	});
-
-	it('should return false for undefined headers', () => {
-		expect(validateRequestAuth(undefined, validKeys)).toBe(false);
-	});
-});

package/src/middleware/auth/validate-api-key.ts

@@ -1,107 +0,0 @@
-/**
- * API key validation utilities.
- *
- * @packageDocumentation
- */
-
-/**
- * Extracts the Bearer token from an Authorization header.
- *
- * @param authHeader - The Authorization header value
- * @returns The token if valid Bearer format, null otherwise
- *
- * @example
- * ```typescript
- * extractBearerToken('Bearer sk_live_abc123'); // 'sk_live_abc123'
- * extractBearerToken('Basic abc123'); // null
- * extractBearerToken('sk_live_abc123'); // null
- * ```
- */
-export function extractBearerToken(authHeader: string | null): string | null {
-	if (!authHeader) {
-		return null;
-	}
-
-	const parts = authHeader.split(' ');
-	if (parts.length !== 2 || parts[0] !== 'Bearer') {
-		return null;
-	}
-
-	return parts[1] || null;
-}
-
-/**
- * Validates an API key against the configured keys.
- *
- * @param token - The token to validate
- * @param validKeys - Array of valid API keys
- * @returns True if the token is valid
- *
- * @remarks
- * Uses timing-safe comparison to prevent timing attacks.
- * If no keys are configured, returns false.
- */
-export function validateApiKey(
-	token: string | null,
-	validKeys: string[] | undefined
-): boolean {
-	if (!token || !validKeys || validKeys.length === 0) {
-		return false;
-	}
-
-	// Use timing-safe comparison to prevent timing attacks
-	return validKeys.some((key) => timingSafeEqual(token, key));
-}
-
-/**
- * Timing-safe string comparison to prevent timing attacks.
- *
- * @param a - First string
- * @param b - Second string
- * @returns True if strings are equal
- */
-function timingSafeEqual(a: string, b: string): boolean {
-	if (a.length !== b.length) {
-		// Still do comparison to maintain constant time
-		let result = 0;
-		for (let i = 0; i < a.length; i++) {
-			result |= a.charCodeAt(i) ^ (b.charCodeAt(i % b.length) || 0);
-		}
-		return false;
-	}
-
-	let result = 0;
-	for (let i = 0; i < a.length; i++) {
-		result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-	}
-	return result === 0;
-}
-
-/**
- * Validates authentication from request headers.
- *
- * @param headers - Request headers
- * @param validKeys - Array of valid API keys
- * @returns True if the request has a valid API key
- *
- * @example
- * ```typescript
- * const headers = new Headers();
- * headers.set('Authorization', 'Bearer sk_live_abc123');
- *
- * validateRequestAuth(headers, ['sk_live_abc123']); // true
- * validateRequestAuth(headers, ['sk_live_other']); // false
- * ```
- */
-export function validateRequestAuth(
-	headers: Headers | undefined,
-	validKeys: string[] | undefined
-): boolean {
-	if (!headers) {
-		return false;
-	}
-
-	const authHeader = headers.get('Authorization');
-	const token = extractBearerToken(authHeader);
-	return validateApiKey(token, validKeys);
-}

package/src/middleware/cors/cors.test.ts

@@ -1,135 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { createCORSOptions } from './cors';
-
-/**
- * Helper to call the origin function or return a default value
- */
-const callOrigin = async (
-	origin: string | string[] | ((origin: string) => string | null) | undefined,
-	value: string
-): Promise<string | null> => {
-	if (typeof origin === 'function') {
-		return origin(value);
-	}
-	if (origin === '*') {
-		return value || '*';
-	}
-	if (Array.isArray(origin)) {
-		return origin.includes(value) ? value : null;
-	}
-	return origin === value ? value : null;
-};
-
-describe('createCORSOptions (unit)', () => {
-	describe('configuration shape', () => {
-		it('returns expected defaults when no trustedOrigins provided', async () => {
-			const config = createCORSOptions();
-			expect(config.credentials).toBe(true);
-			expect(config.maxAge).toBe(600);
-			expect(config.allowHeaders).toEqual([
-				'Content-Type',
-				'Authorization',
-				'x-request-id',
-				'x-c15t-country',
-				'x-c15t-region',
-				'accept-language',
-			]);
-			expect(config.methods).toEqual([
-				'GET',
-				'POST',
-				'PUT',
-				'DELETE',
-				'PATCH',
-				'OPTIONS',
-			]);
-			// For default config, origin is '*' string
-			expect(config.origin).toBe('*');
-		});
-	});
-
-	describe('wildcard "*"', () => {
-		it('allows any concrete origin and echoes it back', async () => {
-			const config = createCORSOptions(['*']);
-			expect(await callOrigin(config.origin, 'http://localhost:3002')).toBe(
-				'http://localhost:3002'
-			);
-			// missing origin -> '*'
-			expect(await callOrigin(config.origin, '')).toBe('*');
-		});
-	});
-
-	describe('specific origins', () => {
-		it('allows trusted origin and rejects untrusted', async () => {
-			const config = createCORSOptions(['http://localhost:3002']);
-			expect(await callOrigin(config.origin, 'http://localhost:3002')).toBe(
-				'http://localhost:3002'
-			);
-			expect(
-				await callOrigin(config.origin, 'http://malicious-site.com')
-			).toBeNull();
-		});
-
-		it('treats localhost variants (ports, IPs) as trusted when "localhost" provided', async () => {
-			const config = createCORSOptions(['localhost']);
-			expect(await callOrigin(config.origin, 'http://localhost:1234')).toBe(
-				'http://localhost:1234'
-			);
-			expect(await callOrigin(config.origin, 'http://127.0.0.1:3000')).toBe(
-				'http://127.0.0.1:3000'
-			);
-			expect(await callOrigin(config.origin, 'http://[::1]:3000')).toBe(
-				'http://[::1]:3000'
-			);
-		});
-	});
-
-	describe('www and non-www variants', () => {
-		it('allows www when non-www is trusted', async () => {
-			const config = createCORSOptions(['http://c15t.com']);
-			expect(await callOrigin(config.origin, 'http://www.c15t.com')).toBe(
-				'http://www.c15t.com'
-			);
-		});
-
-		it('allows non-www when www is trusted', async () => {
-			const config = createCORSOptions(['http://www.c15t.com']);
-			expect(await callOrigin(config.origin, 'http://c15t.com')).toBe(
-				'http://c15t.com'
-			);
-		});
-	});
-
-	describe('ports and protocols', () => {
-		it('matches with exact port when provided', async () => {
-			const config = createCORSOptions(['localhost:3002']);
-			expect(await callOrigin(config.origin, 'http://localhost:3002')).toBe(
-				'http://localhost:3002'
-			);
-			expect(
-				await callOrigin(config.origin, 'http://localhost:4000')
-			).toBeNull();
-		});
-
-		it('is protocol-agnostic for host comparison', async () => {
-			const config = createCORSOptions(['example.com']);
-			expect(await callOrigin(config.origin, 'http://example.com')).toBe(
-				'http://example.com'
-			);
-			expect(await callOrigin(config.origin, 'https://www.example.com')).toBe(
-				'https://www.example.com'
-			);
-		});
-	});
-
-	describe('invalid or missing origins', () => {
-		it('returns null for clearly invalid origins', async () => {
-			const config = createCORSOptions(['example.com']);
-			expect(await callOrigin(config.origin, '::::invalid::::')).toBeNull();
-		});
-
-		it('returns "*" when origin header is missing/empty', async () => {
-			const config = createCORSOptions(['*']);
-			expect(await callOrigin(config.origin, '')).toBe('*');
-		});
-	});
-});

package/src/middleware/cors/cors.ts

@@ -1,186 +0,0 @@
-/**
- * CORS middleware utility for c15t that handles origin validation and CORS headers
- *
- * @packageDocumentation
- */
-
-/**
- * CORS configuration options compatible with Hono's cors middleware
- */
-export interface CorsOptions {
-	origin: string | string[] | ((origin: string) => string | null);
-	methods?: string[];
-	allowMethods?: string[];
-	allowHeaders?: string[];
-	maxAge?: number;
-	credentials?: boolean;
-	exposeHeaders?: string[];
-}
-
-/** Regular expression to match www prefix in domain names */
-const WWW_REGEX = /^www\./;
-
-/** Regular expression to match protocol and www prefix in URLs */
-const PROTOCOL_WWW_REGEX = /^https?:\/\/(www\.)?/;
-
-/**
- * Supported HTTP methods for CORS
- */
-const SUPPORTED_METHODS = [
-	'GET',
-	'POST',
-	'PUT',
-	'DELETE',
-	'PATCH',
-	'OPTIONS',
-] as const;
-
-/**
- * Supported headers for CORS requests
- */
-const SUPPORTED_HEADERS = [
-	'Content-Type',
-	'Authorization',
-	'x-request-id',
-	'x-c15t-country',
-	'x-c15t-region',
-	'accept-language',
-] as const;
-
-/**
- * Normalizes an origin string by removing protocol and www prefix
- *
- * @param origin - The origin URL to normalize
- * @returns Normalized origin string without protocol and www prefix
- */
-function normalizeOrigin(origin: string): string {
-	try {
-		// Handle bare domains like 'localhost' or 'example.com'
-		if (
-			!origin.includes('://') &&
-			!origin.includes(':') &&
-			!origin.includes('/')
-		) {
-			return origin.toLowerCase();
-		}
-		// Add protocol if missing
-		const originWithProtocol =
-			origin.startsWith('http://') ||
-			origin.startsWith('https://') ||
-			origin.startsWith('ws://') ||
-			origin.startsWith('wss://')
-				? origin
-				: `http://${origin}`;
-		const url = new URL(originWithProtocol);
-		const hostname = url.hostname.replace(WWW_REGEX, '');
-		// Return without protocol to match both http and https
-		return `${hostname}${url.port ? `:${url.port}` : ''}`;
-	} catch {
-		// Fallback: remove www manually and protocol
-		return origin.replace(PROTOCOL_WWW_REGEX, '').replace(WWW_REGEX, '');
-	}
-}
-
-/**
- * Expands a list of origins to include www variants
- *
- * @param origins - Array of origin strings to expand
- * @returns Array of origins including www variants
- */
-function expandWithWWW(origins: string[]): string[] {
-	const expanded = new Set<string>();
-	for (const origin of origins) {
-		if (origin === '*') {
-			expanded.add('*');
-			continue;
-		}
-		const normalized = normalizeOrigin(origin);
-		expanded.add(normalized);
-		// Add www version if not already present
-		if (!normalized.includes('www.')) {
-			expanded.add(`www.${normalized}`);
-		}
-	}
-	return Array.from(expanded);
-}
-
-/**
- * Creates CORS options configuration for Hono's cors middleware
- *
- * @param trustedOrigins - Array of allowed origin patterns or single string. Can include wildcards ('*').
- * If undefined, defaults to allowing all origins without credentials.
- *
- * @returns Hono CORS configuration object
- *
- * @example
- * ```ts
- * const corsOptions = createCORSOptions(['http://localhost:3000', 'https://example.com']);
- * app.use('*', cors(corsOptions));
- * ```
- */
-export function createCORSOptions(
-	trustedOrigins?: string[] | string
-): CorsOptions {
-	// If trustedOrigins is undefined or empty, return default config that allows all origins
-	if (!trustedOrigins) {
-		return {
-			origin: '*',
-			credentials: true,
-			allowHeaders: [...SUPPORTED_HEADERS],
-			maxAge: 600,
-			allowMethods: [...SUPPORTED_METHODS],
-			methods: [...SUPPORTED_METHODS],
-		};
-	}
-
-	// Convert string to array if needed
-	const origins = Array.isArray(trustedOrigins)
-		? trustedOrigins
-		: [trustedOrigins];
-	if (origins.length === 0) {
-		return {
-			origin: '*',
-			credentials: true,
-			allowHeaders: [...SUPPORTED_HEADERS],
-			maxAge: 600,
-			allowMethods: [...SUPPORTED_METHODS],
-			methods: [...SUPPORTED_METHODS],
-		};
-	}
-
-	const expandedTrusted = expandWithWWW(origins);
-
-	return {
-		origin: (origin) => {
-			if (!origin) {
-				return '*';
-			}
-			const normalizedOrigin = normalizeOrigin(origin);
-			if (expandedTrusted.includes('*')) {
-				return origin;
-			}
-			// Check if the origin matches any trusted origin
-			const isTrusted = expandedTrusted.some((trusted) => {
-				const normalizedTrusted = normalizeOrigin(trusted);
-				// For localhost, match both with and without port
-				if (normalizedTrusted === 'localhost') {
-					return (
-						normalizedOrigin === 'localhost' ||
-						normalizedOrigin.startsWith('localhost:') ||
-						normalizedOrigin === '127.0.0.1' ||
-						normalizedOrigin.startsWith('127.0.0.1:') ||
-						normalizedOrigin === '[::1]' ||
-						normalizedOrigin.startsWith('[::1]:')
-					);
-				}
-				return normalizedTrusted === normalizedOrigin;
-			});
-			return isTrusted ? origin : null;
-		},
-		credentials: true,
-		allowHeaders: [...SUPPORTED_HEADERS],
-		maxAge: 600,
-		allowMethods: [...SUPPORTED_METHODS],
-		methods: [...SUPPORTED_METHODS],
-	};
-}