@carlos-tzin/tzin 0.1.6 → 0.1.8

package/dist/auth.d.ts

@@ -0,0 +1,76 @@
+import type { Middleware } from './middleware.js';
+export interface AuthUser {
+    id: string;
+    [key: string]: unknown;
+}
+export interface AuthConfig {
+    /** Secret key for JWT signing/verification */
+    secret: string;
+    /** Token issuer (optional) */
+    issuer?: string;
+    /** Token audience (optional) */
+    audience?: string;
+    /** Token expiration (default: '1h') */
+    expiresIn?: string;
+    /** Custom token extractor (default: Bearer header) */
+    extractToken?: (req: Request) => string | null;
+    /** Called when auth fails */
+    onUnauthorized?: (req: Request, reason: string) => Response | Promise<Response>;
+}
+export interface JwtPayload {
+    sub: string;
+    iat: number;
+    exp: number;
+    iss?: string;
+    aud?: string;
+    [key: string]: unknown;
+}
+/** Typed key for the authenticated user */
+export declare const AUTH_USER: import("./context.js").ContextKey<AuthUser>;
+/**
+ * Sign a JWT token.
+ */
+export declare function signJwt(payload: Record<string, unknown>, secret: string, options?: {
+    expiresIn?: string;
+    issuer?: string;
+    audience?: string;
+}): string;
+/**
+ * Verify a JWT token.
+ */
+export declare function verifyJwt(token: string, secret: string, options?: {
+    issuer?: string;
+    audience?: string;
+}): JwtPayload;
+/**
+ * Bearer token authentication middleware.
+ *
+ * Validates the Authorization: Bearer <token> header and attaches
+ * the decoded user to ctx.set(AUTH_USER, user).
+ *
+ * @example
+ * ```ts
+ * import { bearerAuth, AUTH_USER } from '@carlos-tzin/tzin/auth'
+ *
+ * const app = createApp(routes, {
+ *   middleware: [bearerAuth({ secret: process.env.JWT_SECRET! })],
+ * })
+ *
+ * // In handler:
+ * const user = ctx.require(AUTH_USER)
+ * ```
+ */
+export declare function bearerAuth(config: AuthConfig): Middleware;
+/**
+ * Optional auth middleware - doesn't fail if no token,
+ * but validates if present.
+ */
+export declare function optionalAuth(config: AuthConfig): Middleware;
+/**
+ * API key authentication middleware.
+ * Checks for a header like X-API-Key.
+ */
+export declare function apiKeyAuth(config: {
+    key: string;
+    header?: string;
+}): Middleware;

package/dist/auth.js

@@ -0,0 +1,177 @@
+import { defineContext } from './context.js';
+// ── Context Key ──────────────────────────────────────────────────────
+/** Typed key for the authenticated user */
+export const AUTH_USER = defineContext('auth_user');
+// ── JWT Utilities (minimal, no dependencies) ────────────────────────
+function base64UrlEncode(data) {
+    return Buffer.from(data).toString('base64url');
+}
+function base64UrlDecode(data) {
+    return Buffer.from(data, 'base64url').toString();
+}
+function hmacSign(data, secret) {
+    const { createHmac } = require('node:crypto');
+    return createHmac('sha256', secret).update(data).digest('base64url');
+}
+/**
+ * Sign a JWT token.
+ */
+export function signJwt(payload, secret, options) {
+    const header = { alg: 'HS256', typ: 'JWT' };
+    const now = Math.floor(Date.now() / 1000);
+    const exp = options?.expiresIn ? parseDuration(options.expiresIn) : 3600;
+    const fullPayload = {
+        ...payload,
+        iat: now,
+        exp: now + exp,
+        ...(options?.issuer && { iss: options.issuer }),
+        ...(options?.audience && { aud: options.audience }),
+    };
+    const headerEncoded = base64UrlEncode(JSON.stringify(header));
+    const payloadEncoded = base64UrlEncode(JSON.stringify(fullPayload));
+    const signature = hmacSign(`${headerEncoded}.${payloadEncoded}`, secret);
+    return `${headerEncoded}.${payloadEncoded}.${signature}`;
+}
+/**
+ * Verify a JWT token.
+ */
+export function verifyJwt(token, secret, options) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        throw new Error('Invalid JWT format');
+    const [headerEncoded, payloadEncoded, signature] = parts;
+    const expectedSig = hmacSign(`${headerEncoded}.${payloadEncoded}`, secret);
+    if (signature !== expectedSig)
+        throw new Error('Invalid JWT signature');
+    const payload = JSON.parse(base64UrlDecode(payloadEncoded));
+    if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+        throw new Error('Token expired');
+    }
+    if (options?.issuer && payload.iss !== options.issuer) {
+        throw new Error('Invalid issuer');
+    }
+    if (options?.audience && payload.aud !== options.audience) {
+        throw new Error('Invalid audience');
+    }
+    return payload;
+}
+function parseDuration(str) {
+    const match = str.match(/^(\d+)([smhd])$/);
+    if (!match)
+        return 3600;
+    const [, num, unit] = match;
+    const n = parseInt(num, 10);
+    switch (unit) {
+        case 's': return n;
+        case 'm': return n * 60;
+        case 'h': return n * 3600;
+        case 'd': return n * 86400;
+        default: return 3600;
+    }
+}
+// ── Middleware ────────────────────────────────────────────────────────
+/**
+ * Bearer token authentication middleware.
+ *
+ * Validates the Authorization: Bearer <token> header and attaches
+ * the decoded user to ctx.set(AUTH_USER, user).
+ *
+ * @example
+ * ```ts
+ * import { bearerAuth, AUTH_USER } from '@carlos-tzin/tzin/auth'
+ *
+ * const app = createApp(routes, {
+ *   middleware: [bearerAuth({ secret: process.env.JWT_SECRET! })],
+ * })
+ *
+ * // In handler:
+ * const user = ctx.require(AUTH_USER)
+ * ```
+ */
+export function bearerAuth(config) {
+    const extract = config.extractToken ?? defaultExtractToken;
+    const onUnauthorized = config.onUnauthorized ?? defaultUnauthorized;
+    return async ({ req, ctx, next }) => {
+        const token = extract(req);
+        if (!token) {
+            return onUnauthorized(req, 'Missing token');
+        }
+        try {
+            const payload = verifyJwt(token, config.secret, {
+                issuer: config.issuer,
+                audience: config.audience,
+            });
+            const user = {
+                id: payload.sub,
+                ...payload,
+            };
+            ctx.set(AUTH_USER, user);
+            return next();
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : 'Invalid token';
+            return onUnauthorized(req, reason);
+        }
+    };
+}
+/**
+ * Optional auth middleware - doesn't fail if no token,
+ * but validates if present.
+ */
+export function optionalAuth(config) {
+    const extract = config.extractToken ?? defaultExtractToken;
+    return async ({ req, ctx, next }) => {
+        const token = extract(req);
+        if (!token) {
+            return next();
+        }
+        try {
+            const payload = verifyJwt(token, config.secret, {
+                issuer: config.issuer,
+                audience: config.audience,
+            });
+            const user = {
+                id: payload.sub,
+                ...payload,
+            };
+            ctx.set(AUTH_USER, user);
+        }
+        catch {
+            // Ignore invalid tokens in optional mode
+        }
+        return next();
+    };
+}
+/**
+ * API key authentication middleware.
+ * Checks for a header like X-API-Key.
+ */
+export function apiKeyAuth(config) {
+    const headerName = config.header ?? 'x-api-key';
+    return async ({ req, next }) => {
+        const apiKey = req.headers.get(headerName);
+        if (!apiKey || apiKey !== config.key) {
+            return new Response(JSON.stringify({ error: 'Invalid API key' }), {
+                status: 401,
+                headers: { 'content-type': 'application/json' },
+            });
+        }
+        return next();
+    };
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+function defaultExtractToken(req) {
+    const auth = req.headers.get('authorization');
+    if (!auth)
+        return null;
+    const parts = auth.split(' ');
+    if (parts.length !== 2 || parts[0] !== 'Bearer')
+        return null;
+    return parts[1];
+}
+function defaultUnauthorized(_req, reason) {
+    return new Response(JSON.stringify({ error: reason }), {
+        status: 401,
+        headers: { 'content-type': 'application/json' },
+    });
+}

package/dist/db.d.ts

@@ -0,0 +1,96 @@
+import type { TSchema } from '@sinclair/typebox';
+export type SchemaToType<S> = S extends TSchema ? ReturnType<S['Decode']> : never;
+export interface ModelConfig {
+    /** Primary key field (default: 'id') */
+    primaryKey?: string;
+}
+export interface QueryBuilder<T> {
+    /** Filter by field equality */
+    where(field: keyof T, value: T[keyof T]): QueryBuilder<T>;
+    /** Filter by field inequality */
+    whereNot(field: keyof T, value: T[keyof T]): QueryBuilder<T>;
+    /** Filter with greater than */
+    whereGt(field: keyof T, value: number): QueryBuilder<T>;
+    /** Filter with less than */
+    whereLt(field: keyof T, value: number): QueryBuilder<T>;
+    /** Limit results */
+    limit(n: number): QueryBuilder<T>;
+    /** Offset results */
+    offset(n: number): QueryBuilder<T>;
+    /** Order by field */
+    orderBy(field: keyof T, direction?: 'asc' | 'desc'): QueryBuilder<T>;
+    /** Select specific fields */
+    select<K extends keyof T>(...fields: K[]): QueryBuilder<Pick<T, K>>;
+    /** Execute query and return results */
+    exec(): Promise<T[]>;
+    /** Execute query and return first result */
+    first(): Promise<T | null>;
+    /** Count results */
+    count(): Promise<number>;
+}
+export interface Model<T, S extends TSchema> {
+    /** Find by primary key */
+    findById(id: string): Promise<T | null>;
+    /** Find first matching record */
+    findFirst(where: Partial<T>): Promise<T | null>;
+    /** Find many matching records */
+    findMany(where?: Partial<T>): QueryBuilder<T>;
+    /** Create a new record */
+    create(data: T): Promise<T>;
+    /** Create many records */
+    createMany(data: T[]): Promise<T[]>;
+    /** Update by primary key */
+    update(id: string, data: Partial<T>): Promise<T | null>;
+    /** Delete by primary key */
+    delete(id: string): Promise<boolean>;
+    /** Delete many matching records */
+    deleteMany(where: Partial<T>): Promise<number>;
+    /** Count records */
+    count(where?: Partial<T>): Promise<number>;
+    /** Execute raw query */
+    raw(sql: string, ...args: unknown[]): Promise<T[]>;
+    /** Schema validation */
+    readonly schema: S;
+    /** Table name */
+    readonly tableName: string;
+}
+export interface Store {
+    findAll(table: string): Record<string, unknown>[];
+    findById(table: string, id: string, pk: string): Record<string, unknown> | null;
+    insert(table: string, data: Record<string, unknown>): Record<string, unknown>;
+    update(table: string, id: string, data: Record<string, unknown>, pk: string): Record<string, unknown> | null;
+    delete(table: string, id: string, pk: string): boolean;
+    deleteWhere(table: string, where: Record<string, unknown>, pk: string): number;
+    count(table: string, where?: Record<string, unknown>): number;
+    query(table: string, filters: Filter[]): Record<string, unknown>[];
+}
+interface Filter {
+    field: string;
+    op: '=' | '!=' | '>' | '<';
+    value: unknown;
+}
+/** Set a custom store adapter (e.g., for SQL databases) */
+export declare function setStore(store: Store): void;
+/** Get the current store (useful for testing) */
+export declare function getStore(): Store;
+/** Reset the store (useful for testing) */
+export declare function resetStore(): void;
+/**
+ * Define a typed database model.
+ *
+ * @example
+ * ```ts
+ * import { defineModel } from '@carlos-tzin/tzin/db'
+ * import { t } from '@carlos-tzin/tzin'
+ *
+ * const User = defineModel('users', t.Object({
+ *   id: t.String(),
+ *   name: t.String(),
+ *   email: t.String(),
+ * }))
+ *
+ * const user = await User.findById('1')
+ * ```
+ */
+export declare function defineModel<S extends TSchema>(tableName: string, schema: S, config?: ModelConfig): Model<SchemaToType<S>, S>;
+export {};

package/dist/db.js

@@ -0,0 +1,212 @@
+// ── Memory store (default) ──────────────────────────────────────────
+class MemoryStore {
+    data = new Map();
+    table(table) {
+        if (!this.data.has(table))
+            this.data.set(table, []);
+        return this.data.get(table);
+    }
+    findAll(table) {
+        return [...this.table(table)];
+    }
+    findById(table, id, pk) {
+        return this.table(table).find((r) => r[pk] === id) ?? null;
+    }
+    insert(table, data) {
+        this.table(table).push({ ...data });
+        return data;
+    }
+    update(table, id, data, pk) {
+        const row = this.table(table).find((r) => r[pk] === id);
+        if (!row)
+            return null;
+        Object.assign(row, data);
+        return { ...row };
+    }
+    delete(table, id, pk) {
+        const rows = this.table(table);
+        const idx = rows.findIndex((r) => r[pk] === id);
+        if (idx === -1)
+            return false;
+        rows.splice(idx, 1);
+        return true;
+    }
+    deleteWhere(table, where, pk) {
+        const rows = this.table(table);
+        const before = rows.length;
+        this.data.set(table, rows.filter((r) => !Object.entries(where).every(([k, v]) => r[k] === v)));
+        return before - this.data.get(table).length;
+    }
+    count(table, where) {
+        if (!where)
+            return this.table(table).length;
+        return this.table(table).filter((r) => Object.entries(where).every(([k, v]) => r[k] === v)).length;
+    }
+    query(table, filters) {
+        return this.table(table).filter((row) => filters.every((f) => {
+            const val = row[f.field];
+            if (f.op === '=')
+                return val === f.value;
+            if (f.op === '!=')
+                return val !== f.value;
+            if (f.op === '>')
+                return val > f.value;
+            if (f.op === '<')
+                return val < f.value;
+            return true;
+        }));
+    }
+}
+// ── Global store ─────────────────────────────────────────────────────
+let globalStore = new MemoryStore();
+/** Set a custom store adapter (e.g., for SQL databases) */
+export function setStore(store) {
+    globalStore = store;
+}
+/** Get the current store (useful for testing) */
+export function getStore() {
+    return globalStore;
+}
+/** Reset the store (useful for testing) */
+export function resetStore() {
+    globalStore = new MemoryStore();
+}
+// ── defineModel ──────────────────────────────────────────────────────
+/**
+ * Define a typed database model.
+ *
+ * @example
+ * ```ts
+ * import { defineModel } from '@carlos-tzin/tzin/db'
+ * import { t } from '@carlos-tzin/tzin'
+ *
+ * const User = defineModel('users', t.Object({
+ *   id: t.String(),
+ *   name: t.String(),
+ *   email: t.String(),
+ * }))
+ *
+ * const user = await User.findById('1')
+ * ```
+ */
+export function defineModel(tableName, schema, config) {
+    const pk = config?.primaryKey ?? 'id';
+    function applyFilters(rows, filters) {
+        return globalStore.query(tableName, filters);
+    }
+    return {
+        schema,
+        tableName,
+        async findById(id) {
+            const row = globalStore.findById(tableName, id, pk);
+            return row ? schema.Decode(row) : null;
+        },
+        async findFirst(where) {
+            const rows = globalStore.findAll(tableName).filter((r) => Object.entries(where).every(([k, v]) => r[k] === v));
+            return rows[0] ? schema.Decode(rows[0]) : null;
+        },
+        findMany(where) {
+            const filters = where
+                ? Object.entries(where).map(([field, value]) => ({ field, op: '=', value }))
+                : [];
+            const builder = {
+                where(field, value) {
+                    filters.push({ field: field, op: '=', value });
+                    return builder;
+                },
+                whereNot(field, value) {
+                    filters.push({ field: field, op: '!=', value });
+                    return builder;
+                },
+                whereGt(field, value) {
+                    filters.push({ field: field, op: '>', value });
+                    return builder;
+                },
+                whereLt(field, value) {
+                    filters.push({ field: field, op: '<', value });
+                    return builder;
+                },
+                limit: (n) => {
+                    // Store limit for later
+                    const origExec = builder.exec;
+                    builder.exec = async () => {
+                        const rows = await origExec();
+                        return rows.slice(0, n);
+                    };
+                    return builder;
+                },
+                offset: (n) => {
+                    const origExec = builder.exec;
+                    builder.exec = async () => {
+                        const rows = await origExec();
+                        return rows.slice(n);
+                    };
+                    return builder;
+                },
+                orderBy: (field, direction = 'asc') => {
+                    const origExec = builder.exec;
+                    builder.exec = async () => {
+                        const rows = await origExec();
+                        return rows.sort((a, b) => {
+                            const av = a[field];
+                            const bv = b[field];
+                            return direction === 'asc' ? (av > bv ? 1 : -1) : (av < bv ? 1 : -1);
+                        });
+                    };
+                    return builder;
+                },
+                select: (...fields) => {
+                    const origExec = builder.exec;
+                    builder.exec = async () => {
+                        const rows = await origExec();
+                        return rows.map((r) => {
+                            const obj = {};
+                            for (const f of fields)
+                                obj[f] = r[f];
+                            return obj;
+                        });
+                    };
+                    return builder;
+                },
+                exec: async () => {
+                    const rows = applyFilters([], filters);
+                    return rows.map((r) => schema.Decode(r));
+                },
+                first: async () => {
+                    const rows = await builder.exec();
+                    return rows[0] ?? null;
+                },
+                count: async () => {
+                    return globalStore.count(tableName, where);
+                },
+            };
+            return builder;
+        },
+        async create(data) {
+            const row = globalStore.insert(tableName, data);
+            return schema.Decode(row);
+        },
+        async createMany(data) {
+            return Promise.all(data.map((d) => this.create(d)));
+        },
+        async update(id, data) {
+            const row = globalStore.update(tableName, id, data, pk);
+            return row ? schema.Decode(row) : null;
+        },
+        async delete(id) {
+            return globalStore.delete(tableName, id, pk);
+        },
+        async deleteMany(where) {
+            return globalStore.deleteWhere(tableName, where, pk);
+        },
+        async count(where) {
+            return globalStore.count(tableName, where);
+        },
+        async raw(sql, ...args) {
+            // For in-memory store, this is a no-op
+            // Real DB adapters would implement this
+            console.warn('raw() not supported with in-memory store');
+            return [];
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carlos-tzin/tzin",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Contract-first TypeScript framework. Types that scale, realtime channels with presence, and an MCP server for every API.",
   "license": "MIT",
   "author": "The tzin authors",
@@ -46,6 +46,14 @@
     "./test": {
       "types": "./dist/test.d.ts",
       "default": "./dist/test.js"
+    },
+    "./db": {
+      "types": "./dist/db.d.ts",
+      "default": "./dist/db.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
     }
   },
   "files": [