@codixus/server 0.1.3 → 0.1.5

package/dist/index.js

@@ -137,7 +137,7 @@ var BanService = class {
 };
 
 // src/auth/guard.ts
-function createGuard(jwt) {
+function createGuard(jwt, banService) {
   return function guard(options = {}) {
     return async (req, res, next) => {
       const authHeader = req.headers.authorization;
@@ -152,9 +152,14 @@ function createGuard(jwt) {
       const token = authHeader.substring(7);
       try {
         const payload = await jwt.verify(token);
+        const deviceId = payload.deviceId;
+        if (banService && await banService.isBanned(deviceId)) {
+          res.status(403).json({ success: false, error: "DEVICE_BANNED" });
+          return;
+        }
         req.user = {
           uid: payload.sub,
-          deviceId: payload.deviceId
+          deviceId
         };
         next();
       } catch (error) {
@@ -755,12 +760,12 @@ function createRateLimit(config = {}) {
     }
     entry.count++;
     const remaining = Math.max(0, maxRequests - entry.count);
-    res.setHeader("X-RateLimit-Limit", maxRequests);
-    res.setHeader("X-RateLimit-Remaining", remaining);
-    res.setHeader("X-RateLimit-Reset", Math.ceil(entry.resetAt / 1e3));
+    res.setHeader("X-RateLimit-Limit", String(maxRequests));
+    res.setHeader("X-RateLimit-Remaining", String(remaining));
+    res.setHeader("X-RateLimit-Reset", String(Math.ceil(entry.resetAt / 1e3)));
     if (entry.count > maxRequests) {
       const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
-      res.setHeader("Retry-After", retryAfter);
+      res.setHeader("Retry-After", String(retryAfter));
       res.status(429).json({
         success: false,
         error: message,
@@ -780,6 +785,31 @@ function defaultKeyGenerator(req) {
 // src/db/rest.ts
 import { Router as Router2 } from "express";
 import crypto4 from "crypto";
+var RestErrorCode = {
+  CreateDisabled: "CREATE_DISABLED",
+  UpdateDisabled: "UPDATE_DISABLED",
+  DeleteDisabled: "DELETE_DISABLED",
+  ReadForbidden: "READ_FORBIDDEN",
+  WriteForbidden: "WRITE_FORBIDDEN",
+  DeleteForbidden: "DELETE_FORBIDDEN",
+  NotFound: "NOT_FOUND",
+  InvalidFilter: "INVALID_FILTER",
+  InvalidSort: "INVALID_SORT",
+  InvalidCursor: "INVALID_CURSOR",
+  InvalidUpdate: "INVALID_UPDATE",
+  InvalidBody: "INVALID_BODY",
+  AuthRequired: "AUTH_REQUIRED"
+};
+var DEFAULT_ALLOWED_OPS = /* @__PURE__ */ new Set([
+  "$eq",
+  "$ne",
+  "$in",
+  "$nin",
+  "$gt",
+  "$gte",
+  "$lt",
+  "$lte"
+]);
 var SAFE_UPDATE_OPS = /* @__PURE__ */ new Set([
   "$set",
   "$unset",
@@ -794,41 +824,199 @@ var SAFE_UPDATE_OPS = /* @__PURE__ */ new Set([
   "$currentDate",
   "$setOnInsert"
 ]);
-var BLOCKED_OPS = /* @__PURE__ */ new Set([
-  "$where",
-  "$function",
-  "$accumulator",
-  "$expr",
-  "$jsonSchema",
-  "$comment"
-]);
-function sanitizeObject(obj, depth = 0) {
-  if (depth > 10) throw new Error("Object too deeply nested");
-  if (obj === null || obj === void 0) return {};
-  if (typeof obj !== "object" || Array.isArray(obj)) throw new Error("Expected object");
+var RestError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+function param(req, name) {
+  const val = req.params[name];
+  return Array.isArray(val) ? val[0] : val ?? "";
+}
+function fail(res, status, code, error) {
+  res.status(status).json({ success: false, error, code });
+}
+function handleCaught(res, err) {
+  if (err instanceof RestError) {
+    const status = err.code === RestErrorCode.AuthRequired ? 401 : 400;
+    fail(res, status, err.code, err.message);
+    return;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  fail(res, 400, RestErrorCode.InvalidBody, message);
+}
+function buildFilterValidator(queryableFields, allowedOps) {
+  return function sanitizeFilter(obj, depth = 0) {
+    if (depth > 10)
+      throw new RestError(RestErrorCode.InvalidFilter, "Filter too deeply nested");
+    if (obj === null || obj === void 0) return {};
+    if (typeof obj !== "object" || Array.isArray(obj))
+      throw new RestError(RestErrorCode.InvalidFilter, "Filter must be an object");
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+      if (key.startsWith("$")) {
+        if (!allowedOps.has(key)) {
+          throw new RestError(
+            RestErrorCode.InvalidFilter,
+            `Operator "${key}" is not allowed`
+          );
+        }
+        result[key] = sanitizeFilterValue(value, allowedOps, depth + 1);
+      } else {
+        if (queryableFields && !queryableFields.has(key)) {
+          throw new RestError(
+            RestErrorCode.InvalidFilter,
+            `Field "${key}" is not queryable`
+          );
+        }
+        result[key] = sanitizeFilterValue(value, allowedOps, depth + 1);
+      }
+    }
+    return result;
+  };
+}
+function sanitizeFilterValue(value, allowedOps, depth) {
+  if (depth > 10)
+    throw new RestError(RestErrorCode.InvalidFilter, "Filter too deeply nested");
+  if (value === null) return null;
+  if (Array.isArray(value)) {
+    return value.map((v) => sanitizeFilterValue(v, allowedOps, depth + 1));
+  }
+  if (value instanceof Date) return value;
+  if (typeof value !== "object") return value;
   const result = {};
-  for (const [key, value] of Object.entries(obj)) {
-    if (BLOCKED_OPS.has(key)) throw new Error(`Operator "${key}" is not allowed`);
-    if (value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date)) {
-      result[key] = sanitizeObject(value, depth + 1);
-    } else {
-      result[key] = value;
+  for (const [k, v] of Object.entries(value)) {
+    if (k.startsWith("$") && !allowedOps.has(k)) {
+      throw new RestError(
+        RestErrorCode.InvalidFilter,
+        `Operator "${k}" is not allowed`
+      );
     }
+    result[k] = sanitizeFilterValue(v, allowedOps, depth + 1);
   }
   return result;
 }
-function sanitizeUpdate(obj) {
-  if (!obj || typeof obj !== "object") throw new Error("Update must be an object");
-  for (const key of Object.keys(obj)) {
-    if (key.startsWith("$") && !SAFE_UPDATE_OPS.has(key)) {
-      throw new Error(`Update operator "${key}" is not allowed`);
+function assertNoNestedOperators(value, path, depth = 0) {
+  if (depth > 10) return;
+  if (value === null || typeof value !== "object") return;
+  if (value instanceof Date) return;
+  if (Array.isArray(value)) {
+    for (const v of value) assertNoNestedOperators(v, path, depth + 1);
+    return;
+  }
+  for (const [k, v] of Object.entries(value)) {
+    if (k.startsWith("$")) {
+      throw new RestError(
+        RestErrorCode.InvalidUpdate,
+        `Nested operator "${k}" is not allowed inside update value for "${path}"`
+      );
     }
+    assertNoNestedOperators(v, path, depth + 1);
   }
-  return sanitizeObject(obj);
 }
-function param(req, name) {
-  const val = req.params[name];
-  return Array.isArray(val) ? val[0] : val ?? "";
+function sanitizeUpdate(obj, writableFields) {
+  if (!obj || typeof obj !== "object" || Array.isArray(obj))
+    throw new RestError(RestErrorCode.InvalidUpdate, "Update must be an object");
+  const input = obj;
+  const hasOperators = Object.keys(input).some((k) => k.startsWith("$"));
+  const wrapped = hasOperators ? input : { $set: input };
+  const result = {};
+  for (const [op, fields] of Object.entries(wrapped)) {
+    if (!op.startsWith("$")) {
+      throw new RestError(
+        RestErrorCode.InvalidUpdate,
+        "Update must use $-prefixed operators"
+      );
+    }
+    if (!SAFE_UPDATE_OPS.has(op)) {
+      throw new RestError(
+        RestErrorCode.InvalidUpdate,
+        `Update operator "${op}" is not allowed`
+      );
+    }
+    if (!fields || typeof fields !== "object" || Array.isArray(fields)) {
+      throw new RestError(
+        RestErrorCode.InvalidUpdate,
+        `Operator "${op}" requires an object`
+      );
+    }
+    const validatedFields = {};
+    for (const [field, value] of Object.entries(
+      fields
+    )) {
+      if (field.startsWith("$")) {
+        throw new RestError(
+          RestErrorCode.InvalidUpdate,
+          `Nested operator "${field}" is not allowed`
+        );
+      }
+      if (writableFields) {
+        if (!writableFields.has(field)) {
+          throw new RestError(
+            RestErrorCode.InvalidUpdate,
+            `Field "${field}" is not writable`
+          );
+        }
+      }
+      if (!writableFields && field.includes(".")) {
+        throw new RestError(
+          RestErrorCode.InvalidUpdate,
+          `Dotted-path writes require explicit writableFields`
+        );
+      }
+      assertNoNestedOperators(value, field);
+      validatedFields[field] = value;
+    }
+    result[op] = validatedFields;
+  }
+  return result;
+}
+function projectDoc(doc, publicFields) {
+  if (!doc || !publicFields) return doc;
+  const out = {};
+  for (const f of publicFields) {
+    if (f in doc) out[f] = doc[f];
+  }
+  if ("_id" in doc) out._id = doc._id;
+  return out;
+}
+function encodeCursor(key, payload) {
+  const iv = crypto4.randomBytes(12);
+  const cipher = crypto4.createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = Buffer.from(JSON.stringify(payload), "utf8");
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return [
+    iv.toString("base64url"),
+    tag.toString("base64url"),
+    ciphertext.toString("base64url")
+  ].join(".");
+}
+function decodeCursor(key, token) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    throw new RestError(RestErrorCode.InvalidCursor, "Invalid cursor");
+  const [ivB64, tagB64, ctB64] = parts;
+  let iv, tag, ct;
+  try {
+    iv = Buffer.from(ivB64, "base64url");
+    tag = Buffer.from(tagB64, "base64url");
+    ct = Buffer.from(ctB64, "base64url");
+  } catch {
+    throw new RestError(RestErrorCode.InvalidCursor, "Invalid cursor encoding");
+  }
+  if (iv.length !== 12 || tag.length !== 16) {
+    throw new RestError(RestErrorCode.InvalidCursor, "Invalid cursor");
+  }
+  try {
+    const decipher = crypto4.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return JSON.parse(plaintext.toString("utf8"));
+  } catch {
+    throw new RestError(RestErrorCode.InvalidCursor, "Invalid cursor signature");
+  }
 }
 function createRestRouter(model2, options = {}) {
   const {
@@ -837,8 +1025,64 @@ function createRestRouter(model2, options = {}) {
     allowDelete = true,
     maxLimit = 100,
     defaultLimit = 20,
-    defaultSort
+    defaultSort,
+    ownershipField,
+    queryableFields,
+    sortableFields,
+    writableFields,
+    publicFields,
+    allowedOperators,
+    allowRead,
+    allowWrite
   } = options;
+  const queryableSet = queryableFields ? new Set(queryableFields) : null;
+  const sortableSet = sortableFields ? new Set(sortableFields) : null;
+  const writableSet = writableFields ? new Set(writableFields) : null;
+  const publicSet = publicFields ? new Set(publicFields) : null;
+  const opsSet = allowedOperators ? new Set(allowedOperators) : DEFAULT_ALLOWED_OPS;
+  const sanitizeFilter = buildFilterValidator(queryableSet, opsSet);
+  const cursorKey = crypto4.randomBytes(32);
+  function scopedFilter(req, filter) {
+    if (!ownershipField) return filter;
+    const owner = req.user?.deviceId;
+    if (!owner)
+      throw new RestError(
+        RestErrorCode.AuthRequired,
+        "Authentication required"
+      );
+    if (ownershipField in filter) {
+      throw new RestError(
+        RestErrorCode.InvalidFilter,
+        `Field "${ownershipField}" cannot be used in filter (auto-scoped to caller)`
+      );
+    }
+    return { ...filter, [ownershipField]: owner };
+  }
+  function validateSort(sort) {
+    if (!sort) return void 0;
+    if (typeof sort !== "object" || Array.isArray(sort))
+      throw new RestError(RestErrorCode.InvalidSort, "Sort must be an object");
+    const out = {};
+    for (const [field, direction] of Object.entries(sort)) {
+      if (field.startsWith("$"))
+        throw new RestError(
+          RestErrorCode.InvalidSort,
+          `Invalid sort field "${field}"`
+        );
+      if (sortableSet && !sortableSet.has(field))
+        throw new RestError(
+          RestErrorCode.InvalidSort,
+          `Field "${field}" is not sortable`
+        );
+      if (direction !== 1 && direction !== -1)
+        throw new RestError(
+          RestErrorCode.InvalidSort,
+          `Sort direction for "${field}" must be 1 or -1`
+        );
+      out[field] = direction;
+    }
+    return out;
+  }
   const router = Router2();
   router.get("/", async (req, res) => {
     try {
@@ -846,107 +1090,172 @@ function createRestRouter(model2, options = {}) {
       const sortStr = req.query.sort;
       const limitStr = req.query.limit;
       const skipStr = req.query.skip;
-      const cursor = req.query.cursor;
-      let filter = {};
-      if (filterStr) {
-        filter = sanitizeObject(JSON.parse(filterStr));
-      }
-      const sort = sortStr ? JSON.parse(sortStr) : defaultSort;
+      const cursorToken = req.query.cursor;
+      const rawFilter = filterStr ? JSON.parse(filterStr) : {};
+      let filter = sanitizeFilter(rawFilter);
+      filter = scopedFilter(req, filter);
+      const rawSort = sortStr ? JSON.parse(sortStr) : defaultSort;
+      const sort = validateSort(rawSort);
       const limit = Math.min(Number(limitStr) || defaultLimit, maxLimit);
       const skip = Number(skipStr) || 0;
       let query = model2.find(filter);
       if (sort) query = query.sort(sort);
-      if (cursor && sort) {
-        const sortField = Object.keys(sort)[0];
-        const cursorValue = Number.isNaN(Number(cursor)) ? cursor : Number(cursor);
-        query = query.startAfter({ [sortField]: cursorValue });
+      if (cursorToken && sort) {
+        const decoded = decodeCursor(cursorKey, cursorToken);
+        query = query.startAfter(decoded);
       }
       if (skip) query = query.skip(skip);
       query = query.limit(limit);
       const docs = await query.exec();
       let nextCursor = null;
       if (docs.length === limit && sort) {
-        const sortField = Object.keys(sort)[0];
-        nextCursor = docs[docs.length - 1]?.[sortField] ?? null;
+        const last = docs[docs.length - 1];
+        const cursorPayload = {};
+        for (const field of Object.keys(sort)) {
+          cursorPayload[field] = last[field];
+        }
+        nextCursor = encodeCursor(cursorKey, cursorPayload);
       }
-      res.json({ success: true, data: docs, nextCursor });
+      const projected = publicSet ? docs.map((d) => projectDoc(d, publicSet)) : docs;
+      res.json({ success: true, data: projected, nextCursor });
     } catch (error) {
-      res.status(400).json({ success: false, error: error.message });
+      handleCaught(res, error);
     }
   });
   router.get("/:id", async (req, res) => {
-    const id = param(req, "id");
-    const doc = await model2.findById(id);
-    if (!doc) {
-      res.status(404).json({ success: false, error: "Not found" });
-      return;
+    try {
+      const id = param(req, "id");
+      const doc = await model2.findById(id);
+      if (!doc) {
+        fail(res, 404, RestErrorCode.NotFound, "Not found");
+        return;
+      }
+      if (ownershipField) {
+        const owner = req.user?.deviceId;
+        if (!owner || doc[ownershipField] !== owner) {
+          fail(res, 404, RestErrorCode.NotFound, "Not found");
+          return;
+        }
+      }
+      if (allowRead && !await allowRead(req, doc)) {
+        fail(res, 403, RestErrorCode.ReadForbidden, "Read not allowed");
+        return;
+      }
+      res.json({ success: true, data: projectDoc(doc, publicSet) });
+    } catch (error) {
+      handleCaught(res, error);
     }
-    res.json({ success: true, data: doc });
   });
   router.post("/", async (req, res) => {
     if (!allowCreate) {
-      res.status(403).json({ success: false, error: "Create not allowed" });
+      fail(res, 403, RestErrorCode.CreateDisabled, "Create not allowed");
       return;
     }
     try {
-      const data = req.body;
+      const data = { ...req.body };
+      if (ownershipField) {
+        const owner = req.user?.deviceId;
+        if (!owner) {
+          fail(res, 401, RestErrorCode.AuthRequired, "Authentication required");
+          return;
+        }
+        data[ownershipField] = owner;
+      }
       if (!data._id) data._id = crypto4.randomUUID();
       const doc = await model2.create(data);
-      res.status(201).json({ success: true, data: doc });
+      res.status(201).json({ success: true, data: projectDoc(doc, publicSet) });
     } catch (error) {
-      res.status(400).json({ success: false, error: error.message });
+      handleCaught(res, error);
     }
   });
   router.post("/count", async (req, res) => {
     try {
-      const filter = req.body.filter ? sanitizeObject(req.body.filter) : {};
+      const rawFilter = req.body.filter ?? {};
+      let filter = sanitizeFilter(rawFilter);
+      filter = scopedFilter(req, filter);
       const count = await model2.count(filter);
       res.json({ success: true, count });
     } catch (error) {
-      res.status(400).json({ success: false, error: error.message });
+      handleCaught(res, error);
     }
   });
   router.patch("/:id", async (req, res) => {
     if (!allowUpdate) {
-      res.status(403).json({ success: false, error: "Update not allowed" });
+      fail(res, 403, RestErrorCode.UpdateDisabled, "Update not allowed");
       return;
     }
     const id = param(req, "id");
     try {
-      const update = sanitizeUpdate(req.body.update ?? req.body);
+      const update = sanitizeUpdate(req.body.update ?? req.body, writableSet);
+      if (ownershipField || allowWrite) {
+        const existing = await model2.findById(id);
+        if (!existing) {
+          fail(res, 404, RestErrorCode.NotFound, "Not found");
+          return;
+        }
+        if (ownershipField) {
+          const owner = req.user?.deviceId;
+          if (!owner || existing[ownershipField] !== owner) {
+            fail(res, 404, RestErrorCode.NotFound, "Not found");
+            return;
+          }
+        }
+        if (allowWrite && !await allowWrite(req, existing, update)) {
+          fail(res, 403, RestErrorCode.WriteForbidden, "Write not allowed");
+          return;
+        }
+      }
       const success = await model2.updateById(id, update);
       if (!success) {
-        res.status(404).json({ success: false, error: "Not found" });
+        fail(res, 404, RestErrorCode.NotFound, "Not found");
         return;
       }
       const doc = await model2.findById(id);
-      res.json({ success: true, data: doc });
+      res.json({ success: true, data: projectDoc(doc, publicSet) });
     } catch (error) {
-      res.status(400).json({ success: false, error: error.message });
+      handleCaught(res, error);
     }
   });
   router.delete("/:id", async (req, res) => {
+    if (allowDelete === false) {
+      fail(res, 403, RestErrorCode.DeleteDisabled, "Delete not allowed");
+      return;
+    }
     const id = param(req, "id");
-    if (typeof allowDelete === "function") {
-      const doc = await model2.findById(id);
-      if (!doc) {
-        res.status(404).json({ success: false, error: "Not found" });
-        return;
+    try {
+      const needsDoc = !!ownershipField || typeof allowDelete === "function";
+      if (needsDoc) {
+        const doc = await model2.findById(id);
+        if (!doc) {
+          fail(res, 404, RestErrorCode.NotFound, "Not found");
+          return;
+        }
+        if (ownershipField) {
+          const owner = req.user?.deviceId;
+          if (!owner || doc[ownershipField] !== owner) {
+            fail(res, 404, RestErrorCode.NotFound, "Not found");
+            return;
+          }
+        }
+        if (typeof allowDelete === "function" && !await allowDelete(req, doc)) {
+          fail(
+            res,
+            403,
+            RestErrorCode.DeleteForbidden,
+            "Delete not allowed"
+          );
+          return;
+        }
       }
-      if (!allowDelete(req, doc)) {
-        res.status(403).json({ success: false, error: "Delete not allowed" });
+      const success = await model2.deleteById(id);
+      if (!success) {
+        fail(res, 404, RestErrorCode.NotFound, "Not found");
         return;
       }
-    } else if (!allowDelete) {
-      res.status(403).json({ success: false, error: "Delete not allowed" });
-      return;
-    }
-    const success = await model2.deleteById(id);
-    if (!success) {
-      res.status(404).json({ success: false, error: "Not found" });
-      return;
+      res.json({ success: true });
+    } catch (error) {
+      handleCaught(res, error);
     }
-    res.json({ success: true });
   });
   return router;
 }
@@ -976,7 +1285,7 @@ var CodixusServer = class {
   async connect() {
     this._db = await this.connection.connect();
     this.banService = new BanService(this._db);
-    this.guardFn = createGuard(this.jwt);
+    this.guardFn = createGuard(this.jwt, this.banService);
     for (const m of getModelRegistry()) {
       m._bind(this._db, this.instanceId);
       await m._ensureIndexes();
@@ -1070,6 +1379,7 @@ export {
   ErrorCodes,
   Model,
   Query,
+  RestErrorCode,
   SubCollection,
   model,
   validate