@codixus/server 0.1.0

package/dist/index.js

@@ -0,0 +1,1068 @@
+// src/db/connection.ts
+import { MongoClient } from "mongodb";
+var ConnectionManager = class {
+  constructor(uri, dbName) {
+    this.uri = uri;
+    this.dbName = dbName;
+  }
+  client = null;
+  db = null;
+  async connect() {
+    if (this.db) return this.db;
+    this.client = new MongoClient(this.uri, {
+      serverSelectionTimeoutMS: 5e3,
+      maxPoolSize: 10,
+      retryWrites: true,
+      retryReads: true
+    });
+    await this.client.connect();
+    this.db = this.client.db(this.dbName);
+    return this.db;
+  }
+  getDb() {
+    if (!this.db) {
+      throw new Error(
+        "Database not connected. Call codixus.connect() first."
+      );
+    }
+    return this.db;
+  }
+  getClient() {
+    if (!this.client) {
+      throw new Error(
+        "Database not connected. Call codixus.connect() first."
+      );
+    }
+    return this.client;
+  }
+  async disconnect() {
+    if (this.client) {
+      await this.client.close();
+      this.client = null;
+      this.db = null;
+    }
+  }
+};
+
+// src/auth/jwt.ts
+import { SignJWT, jwtVerify } from "jose";
+import { CodixusError } from "@codixus/shared";
+import crypto from "crypto";
+var JwtService = class {
+  secretKey;
+  refreshSecretKey;
+  accessTtl;
+  refreshTtl;
+  constructor(config) {
+    this.secretKey = new TextEncoder().encode(config.secret);
+    const refreshSecret = config.refreshSecret ?? crypto.createHmac("sha256", config.secret).update("codixus:refresh").digest("hex");
+    this.refreshSecretKey = new TextEncoder().encode(refreshSecret);
+    this.accessTtl = config.accessTokenTtl;
+    this.refreshTtl = config.refreshTokenTtl;
+  }
+  async sign(subject, claims = {}) {
+    const jti = crypto.randomUUID();
+    const accessToken = await new SignJWT({
+      ...claims,
+      type: "access",
+      deviceId: subject
+    }).setProtectedHeader({ alg: "HS256" }).setSubject(subject).setIssuedAt().setExpirationTime(this.accessTtl).sign(this.secretKey);
+    const refreshToken = await new SignJWT({
+      type: "refresh",
+      deviceId: subject
+    }).setProtectedHeader({ alg: "HS256" }).setSubject(subject).setJti(jti).setIssuedAt().setExpirationTime(this.refreshTtl).sign(this.refreshSecretKey);
+    return { accessToken, refreshToken };
+  }
+  async verify(token) {
+    try {
+      const { payload } = await jwtVerify(token, this.secretKey);
+      return payload;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Token verification failed";
+      if (message.includes("exp")) {
+        throw new CodixusError("TOKEN_EXPIRED", "Access token expired", 401);
+      }
+      throw new CodixusError("TOKEN_INVALID", "Invalid access token", 401);
+    }
+  }
+  async verifyRefresh(token) {
+    try {
+      const { payload } = await jwtVerify(token, this.refreshSecretKey);
+      return payload;
+    } catch {
+      throw new CodixusError(
+        "REFRESH_TOKEN_INVALID",
+        "Invalid refresh token",
+        401
+      );
+    }
+  }
+  static hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+  }
+};
+
+// src/auth/ban.ts
+var BanService = class {
+  collection;
+  refreshTokensCol;
+  constructor(db) {
+    this.collection = db.collection("banned_devices");
+    this.refreshTokensCol = db.collection("refresh_tokens");
+  }
+  async ban(deviceId, reason) {
+    await this.refreshTokensCol.updateMany(
+      { deviceId, revokedAt: { $exists: false } },
+      { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+    );
+    await this.collection.updateOne(
+      { _id: deviceId },
+      {
+        $set: { reason, bannedAt: /* @__PURE__ */ new Date() },
+        $setOnInsert: { _id: deviceId }
+      },
+      { upsert: true }
+    );
+  }
+  async unban(deviceId) {
+    await this.collection.deleteOne({ _id: deviceId });
+  }
+  async isBanned(deviceId) {
+    const doc = await this.collection.findOne({ _id: deviceId });
+    return doc !== null;
+  }
+  async list(options = {}) {
+    return this.collection.find().sort({ bannedAt: -1 }).skip(options.offset ?? 0).limit(options.limit ?? 50).toArray();
+  }
+};
+
+// src/auth/guard.ts
+function createGuard(jwt) {
+  return function guard(options = {}) {
+    return async (req, res, next) => {
+      const authHeader = req.headers.authorization;
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        if (options.optional) {
+          next();
+          return;
+        }
+        res.status(401).json({ success: false, error: "Missing authorization header" });
+        return;
+      }
+      const token = authHeader.substring(7);
+      try {
+        const payload = await jwt.verify(token);
+        req.user = {
+          uid: payload.sub,
+          deviceId: payload.deviceId
+        };
+        next();
+      } catch (error) {
+        if (options.optional) {
+          next();
+          return;
+        }
+        res.status(401).json({ success: false, error: "Invalid or expired token" });
+      }
+    };
+  };
+}
+
+// src/auth/router.ts
+import { Router } from "express";
+import { authTokenRequestSchema, refreshTokenRequestSchema } from "@codixus/shared";
+import { CodixusError as CodixusError2 } from "@codixus/shared";
+function createAuthRouter(jwt, banService, db, config) {
+  const router = Router();
+  const usersCol = db.collection(config.usersCollection);
+  const refreshTokensCol = db.collection("refresh_tokens");
+  router.post("/token", async (req, res) => {
+    try {
+      const parsed = authTokenRequestSchema.safeParse(req.body);
+      if (!parsed.success) {
+        res.status(400).json({ success: false, error: "Invalid request body" });
+        return;
+      }
+      const { deviceId, deviceInfo, metadata } = parsed.data;
+      const banned = await banService.isBanned(deviceId);
+      if (banned) {
+        res.status(403).json({
+          success: false,
+          error: "DEVICE_BANNED",
+          message: "Your device has been banned from using this application"
+        });
+        return;
+      }
+      const existingUser = await usersCol.findOne({ _id: deviceId });
+      let isNewUser = false;
+      let userData;
+      if (!existingUser) {
+        userData = {
+          _id: deviceId,
+          ...config.onRegister(deviceId, { deviceInfo, metadata })
+        };
+        await usersCol.insertOne(userData);
+        isNewUser = true;
+      } else {
+        userData = existingUser;
+        if (config.deviceBinding !== false) {
+          const binding = existingUser.deviceBinding;
+          if (binding) {
+            if (binding.brand !== deviceInfo.brand || binding.model !== deviceInfo.model) {
+              res.status(403).json({
+                success: false,
+                error: "DEVICE_BINDING_MISMATCH",
+                message: "This account is bound to a different device"
+              });
+              return;
+            }
+          } else {
+            await usersCol.updateOne(
+              { _id: deviceId },
+              { $set: { deviceBinding: deviceInfo } }
+            );
+          }
+        }
+        if (metadata) {
+          await usersCol.updateOne(
+            { _id: deviceId },
+            {
+              $set: {
+                metadata: { ...metadata, lastUpdated: Date.now() }
+              }
+            }
+          );
+        }
+      }
+      const tokens = await jwt.sign(deviceId);
+      const tokenHash = JwtService.hashToken(tokens.refreshToken);
+      await refreshTokensCol.insertOne({
+        deviceId,
+        tokenHash,
+        expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3),
+        // 30 days
+        createdAt: /* @__PURE__ */ new Date()
+      });
+      const { _id, ...userResponse } = userData;
+      res.json({
+        success: true,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        user: { ...userResponse, deviceId },
+        isNewUser
+      });
+    } catch (error) {
+      console.error("Auth token error:", error);
+      res.status(500).json({
+        success: false,
+        error: "Failed to create authentication token"
+      });
+    }
+  });
+  router.post(
+    "/refresh",
+    async (req, res) => {
+      try {
+        const parsed = refreshTokenRequestSchema.safeParse(req.body);
+        if (!parsed.success) {
+          res.status(400).json({ success: false, error: "refreshToken is required" });
+          return;
+        }
+        const { refreshToken } = parsed.data;
+        const payload = await jwt.verifyRefresh(refreshToken);
+        const deviceId = payload.sub;
+        const banned = await banService.isBanned(deviceId);
+        if (banned) {
+          res.status(403).json({
+            success: false,
+            error: "DEVICE_BANNED"
+          });
+          return;
+        }
+        const tokenHash = JwtService.hashToken(refreshToken);
+        const storedToken = await refreshTokensCol.findOneAndUpdate(
+          { tokenHash, revokedAt: { $exists: false } },
+          { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+        );
+        if (!storedToken) {
+          res.status(401).json({
+            success: false,
+            error: "REFRESH_TOKEN_REVOKED"
+          });
+          return;
+        }
+        const tokens = await jwt.sign(deviceId);
+        const newTokenHash = JwtService.hashToken(tokens.refreshToken);
+        await refreshTokensCol.insertOne({
+          deviceId,
+          tokenHash: newTokenHash,
+          expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3),
+          createdAt: /* @__PURE__ */ new Date()
+        });
+        res.json({
+          success: true,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken
+        });
+      } catch (error) {
+        if (error instanceof CodixusError2) {
+          res.status(error.statusCode).json({ success: false, error: error.code });
+          return;
+        }
+        console.error("Auth refresh error:", error);
+        res.status(500).json({ success: false, error: "Failed to refresh token" });
+      }
+    }
+  );
+  router.post(
+    "/logout",
+    async (req, res) => {
+      try {
+        const { refreshToken } = req.body ?? {};
+        if (refreshToken) {
+          const tokenHash = JwtService.hashToken(refreshToken);
+          await refreshTokensCol.updateOne(
+            { tokenHash },
+            { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+          );
+        }
+        res.json({ success: true });
+      } catch {
+        res.json({ success: true });
+      }
+    }
+  );
+  return router;
+}
+
+// src/db/query.ts
+var Query = class {
+  _filter;
+  _sort;
+  _limit;
+  _skip;
+  _projection;
+  _startAfterFilter;
+  collection;
+  constructor(collection, filter = {}) {
+    this.collection = collection;
+    this._filter = filter;
+  }
+  sort(sort) {
+    this._sort = sort;
+    return this;
+  }
+  limit(n) {
+    this._limit = n;
+    return this;
+  }
+  skip(n) {
+    this._skip = n;
+    return this;
+  }
+  select(projection) {
+    this._projection = projection;
+    return this;
+  }
+  /**
+   * Cursor-based pagination.
+   * Pass the last document from the previous page.
+   * Requires sort() to be called first.
+   *
+   * Example:
+   *   const page1 = await Post.find({}).sort({ createdAt: -1 }).limit(20);
+   *   const page2 = await Post.find({}).sort({ createdAt: -1 }).startAfter(page1.at(-1)!).limit(20);
+   */
+  startAfter(doc) {
+    if (!this._sort) {
+      throw new Error("startAfter() requires sort() to be called first");
+    }
+    const sortEntries = Object.entries(this._sort);
+    if (sortEntries.length === 0) {
+      throw new Error("startAfter() requires at least one sort field");
+    }
+    const conditions = [];
+    for (const [field, direction] of sortEntries) {
+      const value = doc[field];
+      if (value === void 0) continue;
+      const op = direction === -1 ? "$lt" : "$gt";
+      conditions.push({ [field]: { [op]: value } });
+    }
+    if (conditions.length === 1) {
+      this._startAfterFilter = conditions[0];
+    } else if (conditions.length > 1) {
+      this._startAfterFilter = { $or: conditions };
+    }
+    return this;
+  }
+  async exec() {
+    let filter = this._filter;
+    if (this._startAfterFilter) {
+      filter = { $and: [filter, this._startAfterFilter] };
+    }
+    const options = {};
+    if (this._sort) options.sort = this._sort;
+    if (this._limit) options.limit = this._limit;
+    if (this._skip) options.skip = this._skip;
+    if (this._projection) options.projection = this._projection;
+    return this.collection.find(filter, options).toArray();
+  }
+  // Allow awaiting the query directly
+  then(onfulfilled, onrejected) {
+    return this.exec().then(onfulfilled, onrejected);
+  }
+};
+
+// src/db/model.ts
+import crypto2 from "crypto";
+var Model = class {
+  collection;
+  definition;
+  _db = null;
+  _boundTo = null;
+  collectionName;
+  constructor(collectionName, definition) {
+    this.collectionName = collectionName;
+    this.definition = definition;
+  }
+  /** @internal - bind to a specific server instance */
+  _bind(db, instanceId) {
+    if (this._boundTo === instanceId) return;
+    this._db = db;
+    this.collection = db.collection(this.collectionName);
+    this._boundTo = instanceId;
+  }
+  /** @internal */
+  async _ensureIndexes() {
+    if (!this.definition.indexes?.length) return;
+    const indexSpecs = this.definition.indexes.map(
+      (fields) => ({ key: fields })
+    );
+    await this.collection.createIndexes(indexSpecs);
+  }
+  getCol() {
+    if (!this.collection) {
+      throw new Error(
+        `Model "${this.collectionName}" not bound to a database. Call codixus.connect() first.`
+      );
+    }
+    return this.collection;
+  }
+  validate(data) {
+    return this.definition.schema.parse(data);
+  }
+  async create(data, options) {
+    const validated = this.validate(data);
+    const id = data._id ?? crypto2.randomUUID();
+    const doc = { ...validated, _id: id };
+    if (this.definition.timestamps) {
+      doc.createdAt = /* @__PURE__ */ new Date();
+      doc.updatedAt = /* @__PURE__ */ new Date();
+    }
+    await this.getCol().insertOne(doc, { session: options?.session });
+    return doc;
+  }
+  async findById(id, options) {
+    const doc = await this.getCol().findOne(
+      { _id: id },
+      { session: options?.session }
+    );
+    return doc ?? null;
+  }
+  async findOne(filter, options) {
+    const doc = await this.getCol().findOne(filter, {
+      session: options?.session
+    });
+    return doc ?? null;
+  }
+  find(filter = {}) {
+    return new Query(this.getCol(), filter);
+  }
+  async updateById(id, update, options) {
+    const timestampUpdate = this.definition.timestamps ? { $set: { updatedAt: /* @__PURE__ */ new Date() }, ...update } : update;
+    const result = await this.getCol().updateOne(
+      { _id: id },
+      timestampUpdate,
+      { session: options?.session }
+    );
+    return result.matchedCount > 0;
+  }
+  async findByIdAndUpdate(id, update, options) {
+    const timestampUpdate = this.definition.timestamps ? { $set: { updatedAt: /* @__PURE__ */ new Date() }, ...update } : update;
+    const result = await this.getCol().findOneAndUpdate(
+      { _id: id },
+      timestampUpdate,
+      {
+        returnDocument: options?.returnNew ? "after" : "before",
+        session: options?.session
+      }
+    );
+    return result ?? null;
+  }
+  async updateMany(filter, update, options) {
+    const result = await this.getCol().updateMany(filter, update, {
+      session: options?.session
+    });
+    return result.modifiedCount;
+  }
+  async deleteById(id, options) {
+    const result = await this.getCol().deleteOne(
+      { _id: id },
+      { session: options?.session }
+    );
+    return result.deletedCount > 0;
+  }
+  async deleteMany(filter, options) {
+    const result = await this.getCol().deleteMany(filter, {
+      session: options?.session
+    });
+    return result.deletedCount;
+  }
+  async count(filter = {}, options) {
+    return this.getCol().countDocuments(filter, {
+      session: options?.session
+    });
+  }
+  async exists(filter, options) {
+    const doc = await this.getCol().findOne(filter, {
+      projection: { _id: 1 },
+      session: options?.session
+    });
+    return doc !== null;
+  }
+  async bulk(operations, options) {
+    return this.getCol().bulkWrite(operations, options);
+  }
+  async aggregate(pipeline) {
+    return this.getCol().aggregate(pipeline).toArray();
+  }
+  /**
+   * Create a subcollection accessor.
+   * Maps Firestore subcollections to separate MongoDB collections.
+   * e.g. User.sub("user-123", "decisions") → "users__decisions" collection
+   * with { _parentId: "user-123", ... } on each document
+   */
+  sub(parentId, subName, definition) {
+    const subColName = `${this.collectionName}__${subName}`;
+    return new SubCollection(
+      this.getCol().dbName ? this._db : this._db,
+      subColName,
+      parentId,
+      definition
+    );
+  }
+};
+var SubCollection = class {
+  collection;
+  parentId;
+  definition;
+  constructor(db, collectionName, parentId, definition) {
+    this.collection = db.collection(collectionName);
+    this.parentId = parentId;
+    this.definition = definition;
+  }
+  async create(data, options) {
+    let validated;
+    if (this.definition) {
+      validated = this.definition.schema.parse(data);
+    } else {
+      validated = data;
+    }
+    const id = data._id ?? crypto2.randomUUID();
+    const doc = { ...validated, _id: id, _parentId: this.parentId };
+    await this.collection.insertOne(doc, { session: options?.session });
+    return doc;
+  }
+  async findById(id, options) {
+    return this.collection.findOne(
+      { _id: id, _parentId: this.parentId },
+      { session: options?.session }
+    );
+  }
+  async findOne(filter = {}, options) {
+    return this.collection.findOne(
+      { ...filter, _parentId: this.parentId },
+      { session: options?.session }
+    );
+  }
+  find(filter = {}) {
+    return new Query(this.collection, {
+      ...filter,
+      _parentId: this.parentId
+    });
+  }
+  async updateById(id, update, options) {
+    const result = await this.collection.updateOne(
+      { _id: id, _parentId: this.parentId },
+      update,
+      { session: options?.session }
+    );
+    return result.matchedCount > 0;
+  }
+  async deleteById(id, options) {
+    const result = await this.collection.deleteOne(
+      { _id: id, _parentId: this.parentId },
+      { session: options?.session }
+    );
+    return result.deletedCount > 0;
+  }
+  async count(filter = {}, options) {
+    return this.collection.countDocuments(
+      { ...filter, _parentId: this.parentId },
+      { session: options?.session }
+    );
+  }
+};
+var modelRegistry = [];
+function model(collectionName, definition) {
+  const m = new Model(collectionName, definition);
+  modelRegistry.push(m);
+  return m;
+}
+function getModelRegistry() {
+  return modelRegistry;
+}
+
+// src/db/transaction.ts
+async function runTransaction(client, fn) {
+  const session = client.startSession();
+  try {
+    let result;
+    await session.withTransaction(async () => {
+      result = await fn(session);
+    });
+    return result;
+  } finally {
+    await session.endSession();
+  }
+}
+
+// src/middleware/signing.ts
+import crypto3 from "crypto";
+var DEFAULT_WINDOW_MS = 5 * 60 * 1e3;
+var NONCE_CLEANUP_INTERVAL = 60 * 1e3;
+var usedNonces = /* @__PURE__ */ new Map();
+setInterval(() => {
+  const cutoff = Date.now() - DEFAULT_WINDOW_MS * 2;
+  for (const [nonce, timestamp] of usedNonces) {
+    if (timestamp < cutoff) {
+      usedNonces.delete(nonce);
+    }
+  }
+}, NONCE_CLEANUP_INTERVAL).unref();
+function computeSignature(secret, method, path, timestamp, nonce, body) {
+  const bodyHash = body ? crypto3.createHash("sha256").update(body).digest("hex") : "";
+  const payload = [method.toUpperCase(), path, timestamp, nonce, bodyHash].join(
+    "\n"
+  );
+  return crypto3.createHmac("sha256", secret).update(payload).digest("hex");
+}
+function createSigningMiddleware(config) {
+  const { appSecret, timestampWindowMs = DEFAULT_WINDOW_MS } = config;
+  return (req, res, next) => {
+    const timestamp = req.headers["x-codixus-timestamp"];
+    const nonce = req.headers["x-codixus-nonce"];
+    const signature = req.headers["x-codixus-signature"];
+    if (!timestamp || !nonce || !signature) {
+      res.status(401).json({
+        success: false,
+        error: "Missing signing headers"
+      });
+      return;
+    }
+    const ts = Number(timestamp);
+    if (Number.isNaN(ts)) {
+      res.status(401).json({
+        success: false,
+        error: "Invalid timestamp"
+      });
+      return;
+    }
+    const now = Date.now();
+    if (Math.abs(now - ts) > timestampWindowMs) {
+      res.status(401).json({
+        success: false,
+        error: "Request timestamp expired"
+      });
+      return;
+    }
+    if (usedNonces.has(nonce)) {
+      res.status(401).json({
+        success: false,
+        error: "Nonce already used"
+      });
+      return;
+    }
+    const rawBody = req.body && Object.keys(req.body).length > 0 ? JSON.stringify(req.body) : "";
+    const expectedSignature = computeSignature(
+      appSecret,
+      req.method,
+      req.originalUrl || req.url,
+      timestamp,
+      nonce,
+      rawBody
+    );
+    if (!crypto3.timingSafeEqual(
+      Buffer.from(signature, "hex"),
+      Buffer.from(expectedSignature, "hex")
+    )) {
+      res.status(401).json({
+        success: false,
+        error: "Invalid signature"
+      });
+      return;
+    }
+    usedNonces.set(nonce, ts);
+    next();
+  };
+}
+
+// src/middleware/rate-limit.ts
+var CLEANUP_INTERVAL = 60 * 1e3;
+function createRateLimit(config = {}) {
+  const {
+    windowMs = 6e4,
+    maxRequests = 60,
+    keyGenerator = defaultKeyGenerator,
+    message = "Too many requests, please try again later"
+  } = config;
+  const store = /* @__PURE__ */ new Map();
+  const cleanup = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of store) {
+      if (entry.resetAt <= now) {
+        store.delete(key);
+      }
+    }
+  }, CLEANUP_INTERVAL);
+  cleanup.unref();
+  return (req, res, next) => {
+    const key = keyGenerator(req);
+    const now = Date.now();
+    let entry = store.get(key);
+    if (!entry || entry.resetAt <= now) {
+      entry = { count: 0, resetAt: now + windowMs };
+      store.set(key, entry);
+    }
+    entry.count++;
+    const remaining = Math.max(0, maxRequests - entry.count);
+    res.setHeader("X-RateLimit-Limit", maxRequests);
+    res.setHeader("X-RateLimit-Remaining", remaining);
+    res.setHeader("X-RateLimit-Reset", Math.ceil(entry.resetAt / 1e3));
+    if (entry.count > maxRequests) {
+      const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+      res.setHeader("Retry-After", retryAfter);
+      res.status(429).json({
+        success: false,
+        error: message,
+        retryAfter
+      });
+      return;
+    }
+    next();
+  };
+}
+function defaultKeyGenerator(req) {
+  const ip = req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.socket?.remoteAddress || "unknown";
+  const deviceId = req.user?.deviceId || "anonymous";
+  return `${ip}:${deviceId}`;
+}
+
+// src/db/rest.ts
+import { Router as Router2 } from "express";
+import crypto4 from "crypto";
+var SAFE_UPDATE_OPS = /* @__PURE__ */ new Set([
+  "$set",
+  "$unset",
+  "$inc",
+  "$push",
+  "$pull",
+  "$addToSet",
+  "$pop",
+  "$min",
+  "$max",
+  "$mul",
+  "$currentDate",
+  "$setOnInsert"
+]);
+var BLOCKED_OPS = /* @__PURE__ */ new Set([
+  "$where",
+  "$function",
+  "$accumulator",
+  "$expr",
+  "$jsonSchema",
+  "$comment"
+]);
+function sanitizeObject(obj, depth = 0) {
+  if (depth > 10) throw new Error("Object too deeply nested");
+  if (obj === null || obj === void 0) return {};
+  if (typeof obj !== "object" || Array.isArray(obj)) throw new Error("Expected object");
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (BLOCKED_OPS.has(key)) throw new Error(`Operator "${key}" is not allowed`);
+    if (value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)) {
+      result[key] = sanitizeObject(value, depth + 1);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function sanitizeUpdate(obj) {
+  if (!obj || typeof obj !== "object") throw new Error("Update must be an object");
+  for (const key of Object.keys(obj)) {
+    if (key.startsWith("$") && !SAFE_UPDATE_OPS.has(key)) {
+      throw new Error(`Update operator "${key}" is not allowed`);
+    }
+  }
+  return sanitizeObject(obj);
+}
+function param(req, name) {
+  const val = req.params[name];
+  return Array.isArray(val) ? val[0] : val ?? "";
+}
+function createRestRouter(model2, options = {}) {
+  const {
+    allowCreate = true,
+    allowUpdate = true,
+    allowDelete = true,
+    maxLimit = 100,
+    defaultLimit = 20,
+    defaultSort
+  } = options;
+  const router = Router2();
+  router.get("/", async (req, res) => {
+    try {
+      const filterStr = req.query.filter;
+      const sortStr = req.query.sort;
+      const limitStr = req.query.limit;
+      const skipStr = req.query.skip;
+      const cursor = req.query.cursor;
+      let filter = {};
+      if (filterStr) {
+        filter = sanitizeObject(JSON.parse(filterStr));
+      }
+      const sort = sortStr ? JSON.parse(sortStr) : defaultSort;
+      const limit = Math.min(Number(limitStr) || defaultLimit, maxLimit);
+      const skip = Number(skipStr) || 0;
+      let query = model2.find(filter);
+      if (sort) query = query.sort(sort);
+      if (cursor && sort) {
+        const sortField = Object.keys(sort)[0];
+        const cursorValue = Number.isNaN(Number(cursor)) ? cursor : Number(cursor);
+        query = query.startAfter({ [sortField]: cursorValue });
+      }
+      if (skip) query = query.skip(skip);
+      query = query.limit(limit);
+      const docs = await query.exec();
+      let nextCursor = null;
+      if (docs.length === limit && sort) {
+        const sortField = Object.keys(sort)[0];
+        nextCursor = docs[docs.length - 1]?.[sortField] ?? null;
+      }
+      res.json({ success: true, data: docs, nextCursor });
+    } catch (error) {
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+  router.get("/:id", async (req, res) => {
+    const id = param(req, "id");
+    const doc = await model2.findById(id);
+    if (!doc) {
+      res.status(404).json({ success: false, error: "Not found" });
+      return;
+    }
+    res.json({ success: true, data: doc });
+  });
+  router.post("/", async (req, res) => {
+    if (!allowCreate) {
+      res.status(403).json({ success: false, error: "Create not allowed" });
+      return;
+    }
+    try {
+      const data = req.body;
+      if (!data._id) data._id = crypto4.randomUUID();
+      const doc = await model2.create(data);
+      res.status(201).json({ success: true, data: doc });
+    } catch (error) {
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+  router.post("/count", async (req, res) => {
+    try {
+      const filter = req.body.filter ? sanitizeObject(req.body.filter) : {};
+      const count = await model2.count(filter);
+      res.json({ success: true, count });
+    } catch (error) {
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+  router.patch("/:id", async (req, res) => {
+    if (!allowUpdate) {
+      res.status(403).json({ success: false, error: "Update not allowed" });
+      return;
+    }
+    const id = param(req, "id");
+    try {
+      const update = sanitizeUpdate(req.body.update ?? req.body);
+      const success = await model2.updateById(id, update);
+      if (!success) {
+        res.status(404).json({ success: false, error: "Not found" });
+        return;
+      }
+      const doc = await model2.findById(id);
+      res.json({ success: true, data: doc });
+    } catch (error) {
+      res.status(400).json({ success: false, error: error.message });
+    }
+  });
+  router.delete("/:id", async (req, res) => {
+    const id = param(req, "id");
+    if (typeof allowDelete === "function") {
+      const doc = await model2.findById(id);
+      if (!doc) {
+        res.status(404).json({ success: false, error: "Not found" });
+        return;
+      }
+      if (!allowDelete(req, doc)) {
+        res.status(403).json({ success: false, error: "Delete not allowed" });
+        return;
+      }
+    } else if (!allowDelete) {
+      res.status(403).json({ success: false, error: "Delete not allowed" });
+      return;
+    }
+    const success = await model2.deleteById(id);
+    if (!success) {
+      res.status(404).json({ success: false, error: "Not found" });
+      return;
+    }
+    res.json({ success: true });
+  });
+  return router;
+}
+
+// src/codixus-server.ts
+var CodixusServer = class {
+  constructor(config) {
+    this.config = config;
+    this.connection = new ConnectionManager(config.mongoUri, config.dbName);
+    this._appSecret = config.appSecret;
+    this.jwt = new JwtService({
+      secret: config.jwtSecret,
+      refreshSecret: config.jwtRefreshSecret,
+      accessTokenTtl: config.accessTokenTtl ?? "15m",
+      refreshTokenTtl: config.refreshTokenTtl ?? "30d"
+    });
+  }
+  connection;
+  jwt;
+  banService;
+  guardFn;
+  _db;
+  instanceId = /* @__PURE__ */ Symbol("codixus-server");
+  _appSecret;
+  auth;
+  db;
+  async connect() {
+    this._db = await this.connection.connect();
+    this.banService = new BanService(this._db);
+    this.guardFn = createGuard(this.jwt);
+    for (const m of getModelRegistry()) {
+      m._bind(this._db, this.instanceId);
+      await m._ensureIndexes();
+    }
+    const refreshTokensCol = this._db.collection("refresh_tokens");
+    await refreshTokensCol.createIndex({ tokenHash: 1 }, { unique: true });
+    await refreshTokensCol.createIndex({ deviceId: 1 });
+    await refreshTokensCol.createIndex(
+      { expiresAt: 1 },
+      { expireAfterSeconds: 0 }
+    );
+    this.auth = {
+      sign: (subject, claims) => this.jwt.sign(subject, claims),
+      verify: (token) => this.jwt.verify(token),
+      refresh: async (refreshToken) => {
+        const payload = await this.jwt.verifyRefresh(refreshToken);
+        const deviceId = payload.sub;
+        const tokens = await this.jwt.sign(deviceId);
+        return tokens;
+      },
+      guard: (options) => this.guardFn(options),
+      router: (config) => createAuthRouter(this.jwt, this.banService, this._db, config),
+      ban: (deviceId, reason) => this.banService.ban(deviceId, reason),
+      unban: (deviceId) => this.banService.unban(deviceId),
+      isBanned: (deviceId) => this.banService.isBanned(deviceId)
+    };
+    this.db = {
+      transaction: (fn) => runTransaction(this.connection.getClient(), fn),
+      getDb: () => this._db
+    };
+  }
+  /**
+   * HMAC request signing middleware.
+   * Verifies that requests come from a client with the correct appSecret.
+   */
+  signing(overrides) {
+    const secret = overrides?.appSecret ?? this._appSecret;
+    if (!secret) {
+      throw new Error(
+        "appSecret is required for signing. Set it in CodixusServer config or pass it to signing()."
+      );
+    }
+    return createSigningMiddleware({
+      appSecret: secret,
+      timestampWindowMs: overrides?.timestampWindowMs
+    });
+  }
+  /**
+   * Rate limiting middleware.
+   */
+  rateLimit(config) {
+    return createRateLimit(config);
+  }
+  /**
+   * Auto REST router for a model.
+   * Generates CRUD endpoints: GET /, GET /:id, POST /, PATCH /:id, DELETE /:id, POST /count
+   */
+  rest(m, options) {
+    return createRestRouter(m, options);
+  }
+  async disconnect() {
+    await this.connection.disconnect();
+  }
+};
+
+// src/middleware/validate.ts
+function validate(schema) {
+  return (req, res, next) => {
+    const result = schema.safeParse(req.body);
+    if (!result.success) {
+      res.status(400).json({
+        success: false,
+        error: "VALIDATION_ERROR",
+        details: result.error.issues
+      });
+      return;
+    }
+    req.body = result.data;
+    next();
+  };
+}
+
+// src/index.ts
+import {
+  CodixusError as CodixusError3,
+  ErrorCodes
+} from "@codixus/shared";
+export {
+  CodixusError3 as CodixusError,
+  CodixusServer,
+  ErrorCodes,
+  Model,
+  Query,
+  SubCollection,
+  model,
+  validate
+};
+//# sourceMappingURL=index.js.map