@devmoods/express-extras 0.40.1 → 0.42.0

package/dist/auth.d.ts

@@ -30,7 +30,10 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     redis: AuthOptions<UserModel>['redis'];
     setCurrentUser: (user: UserModel) => void;
     createTemporaryToken(user: UserModel): Promise<string>;
-    middleware: (authorize?: boolean) => RequestHandler;
+    middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
+    login: (res: Response, user: UserModel) => Promise<{
+        token: string;
+    }>;
 }
 export type AnyUser = Record<string, any>;
 export interface AuthProvider<UserModel extends AnyUser> {
@@ -45,9 +48,12 @@ export interface AuthOptions<UserModel extends AnyUser> {
 export interface CreateAuth<UserModel extends AnyUser> {
     createRouter: () => Router;
     useCurrentUser: () => UserModel | undefined;
-    middleware: (authorize?: boolean) => RequestHandler;
+    middleware: (options: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
 }
+export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {
+    isAuthorized?: (user: UserModel) => Promise<boolean> | boolean;
+};
 export declare function createAuth<UserModel extends AnyUser>({ getUserByToken, filterUser, redis, providers, }: AuthOptions<UserModel>): CreateAuth<UserModel>;
 /**
  * Extract a Bearer token from the HTTP Authorization header

package/dist/auth.js

@@ -4,7 +4,7 @@ import { Router, } from 'express';
 import jwt from 'jsonwebtoken';
 import { v4 } from 'uuid';
 import { setContext, useContext } from './context.js';
-import { BadRequest, NotFound, Unauthorized } from './errors.js';
+import { ApiError, BadRequest, Forbidden, NotFound, Unauthorized, } from './errors.js';
 import { getLogger } from './logger.js';
 import { route } from './middleware.js';
 import {} from './redis.js';
@@ -57,10 +57,7 @@ export function EmailAndPasswordAuthProvider(options) {
             }), route(async ({ body: { email, password } }, res) => {
                 try {
                     const user = await options.login(email, (realPassword) => checkIfPasswordsMatch(realPassword, password));
-                    const token = createAuthToken(context.filterUser(user));
-                    await context.redis.set(token, '1', { EX: TOKEN_EXPIRES_IN });
-                    setAccessTokenCookie(res, token);
-                    context.setCurrentUser(user);
+                    const { token } = await context.login(res, user);
                     logger.info('access token created');
                     return [201, { token }];
                 }
@@ -146,12 +143,20 @@ export function EmailAndPasswordAuthProvider(options) {
 export function createAuth({ getUserByToken, filterUser, redis, providers, }) {
     const useCurrentUser = () => useContext('currentUser');
     const setCurrentUser = (user) => setContext('currentUser', user);
+    const login = async (res, user) => {
+        const token = createAuthToken(filterUser(user));
+        await redis.set(token, '1', { EX: TOKEN_EXPIRES_IN });
+        setAccessTokenCookie(res, token);
+        setCurrentUser(user);
+        return { token };
+    };
     const providerContext = {
         filterUser,
         redis,
         setCurrentUser,
         createTemporaryToken,
         middleware,
+        login,
     };
     const createRouter = () => {
         const router = Router();
@@ -201,19 +206,24 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, }) {
         }
         return router;
     };
-    function middleware(authorize = true) {
+    function middleware(options = {}) {
+        let authenticate = true;
+        if (typeof options === 'boolean') {
+            authenticate = options;
+            options = {};
+        }
         return async (req, res, next) => {
             try {
                 const token = extractAccessTokenFromRequest(req);
                 if (!token) {
-                    if (!authorize) {
+                    if (!authenticate) {
                         return next();
                     }
                     throw new InvalidToken('token missing');
                 }
                 const valid = await redis.get(token);
                 if (!valid) {
-                    if (!authorize) {
+                    if (!authenticate) {
                         logger.warn('request with invalid access token');
                         return next();
                     }
@@ -221,13 +231,20 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, }) {
                 }
                 const decoded = decodeAuthToken(token);
                 const user = await getUserByToken(decoded);
+                if (options.isAuthorized && !(await options.isAuthorized(user))) {
+                    throw Forbidden('Permission denied');
+                }
                 setCurrentUser(user);
                 next();
             }
             catch (error) {
                 logger.error(error);
-                next(Unauthorized('Invalid token'));
-                return;
+                if (error instanceof ApiError) {
+                    next(error);
+                }
+                else {
+                    next(Unauthorized('Invalid token'));
+                }
             }
         };
     }

package/dist/csrf.d.ts

@@ -1,4 +1,5 @@
 import { type RequestHandler, type Request, type Response } from 'express';
+export declare const getCsrfSecret: () => string;
 export interface CsrfMiddlewareOptions {
     excempt?: boolean;
     cookieName?: string;

package/dist/csrf.js

@@ -9,6 +9,13 @@ const defaultCookieName = () => {
         ? '__Host-devmoods.x-csrf-token'
         : 'devmoods.x-csrf-token';
 };
+export const getCsrfSecret = () => {
+    const secret = readEnv('CSRF_SECRET', '');
+    if (!secret) {
+        throw new Error('CSRF_SECRET is not set');
+    }
+    return secret;
+};
 export function csrf({ excempt = false, sessionIdentifier, cookieName, } = {}) {
     return (req, res, next) => {
         const existingOptions = useCsrfOptions();
@@ -34,7 +41,7 @@ function useCsrfOptions() {
     });
 }
 const generateTokenAndHash = (req, { overwrite = false } = {}) => {
-    const secret = readEnv('CSRF_SECRET', '');
+    const secret = getCsrfSecret();
     const { sessionIdentifier, cookieName } = useCsrfOptions();
     const csrfCookie = req.cookies[cookieName];
     if (typeof csrfCookie === 'string' && !overwrite) {
@@ -84,7 +91,7 @@ const validateRequest = (req) => {
     }
     const [csrfToken, csrfTokenHash] = csrfCookie.split('|');
     const csrfTokenFromRequest = req.headers['x-csrf-token'];
-    const secret = readEnv('CSRF_SECRET', '');
+    const secret = getCsrfSecret();
     if (!csrfTokenFromRequest) {
         throw Forbidden('Missing CSRF token');
     }

package/dist/middleware.d.ts

@@ -38,7 +38,7 @@ export declare function after(): RequestHandler;
 type ResponseHeaders = Record<string, string>;
 type AnyResponseBody = Record<string, any> | string;
 type HttpResponseCode = number;
-type ResponseWrapper<TResponseBody extends AnyResponseBody> = TResponseBody | HttpResponseCode | [HttpResponseCode, TResponseBody] | [HttpResponseCode, TResponseBody, ResponseHeaders];
+type ResponseWrapper<TResponseBody extends AnyResponseBody> = TResponseBody | TResponseBody[] | HttpResponseCode | [HttpResponseCode, TResponseBody] | [HttpResponseCode, TResponseBody, ResponseHeaders];
 /**
  * Alias of `route()`
  */

package/dist/postgres.d.ts

@@ -1,7 +1,8 @@
 import pg, { type PoolClient, type PoolConfig, type QueryResult, type QueryResultRow } from 'pg';
 export declare const escapePostgresIdentifier: typeof pg.escapeIdentifier;
 export declare const escapePostgresLiteral: typeof pg.escapeLiteral;
-export interface PostgresOptions extends PoolConfig {
+export declare const formatSql: (statement: SqlStatement | string) => string;
+export interface PostgresOptions extends PoolConfig, ConnectionOptions {
     onError?: (error: Error, client: any) => void;
     url?: PoolConfig['connectionString'];
 }
@@ -15,14 +16,19 @@ export declare class IntegrityError extends Error {
     constructor(message: string);
 }
 type Value = null | string | number | Date;
+export interface ConnectionOptions {
+    onLogStatement?: (statement: SqlStatement | string, values: unknown[] | undefined, duration: number) => void;
+}
 export declare class Connection {
+    private options;
     client: PoolClient;
-    constructor(client: PoolClient);
-    query<T extends QueryResultRow>(text: string | SQLStatement, values?: Value[]): Promise<QueryResult<T>>;
-    all<T>(text: string | SQLStatement, values?: Value[]): Promise<T[]>;
-    insert<T extends QueryResultRow>(text: string | SQLStatement, values?: Value[]): Promise<QueryResult<T>>;
-    first<T>(text: string | SQLStatement, values?: Value[]): Promise<T | null>;
-    get<T>(text: string | SQLStatement, values?: Value[]): Promise<T>;
+    constructor(client: PoolClient, options: ConnectionOptions);
+    private onLogStatement;
+    query<T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]): Promise<QueryResult<T>>;
+    all<T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]): Promise<T[]>;
+    insert<T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]): Promise<QueryResult<T>>;
+    first<T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]): Promise<T | null>;
+    get<T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]): Promise<T>;
 }
 export declare class Transaction extends Connection {
 }
@@ -34,27 +40,27 @@ export declare class Transaction extends Connection {
  * @param config
  */
 export declare function createPostgres({ onError, url, ...config }?: PostgresOptions): {
-    insert: <T extends QueryResultRow>(text: string | SQLStatement, values?: Value[]) => Promise<QueryResult<T>>;
-    query: <T extends QueryResultRow>(text: string | SQLStatement, values?: Value[]) => Promise<QueryResult<T>>;
-    first: <T>(text: string | SQLStatement, values?: Value[]) => Promise<T | null>;
-    all: <T>(text: string | SQLStatement, values?: Value[]) => Promise<T[]>;
-    get: <T>(text: string | SQLStatement, values?: Value[]) => Promise<T>;
+    insert: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<QueryResult<T>>;
+    query: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<QueryResult<T>>;
+    first: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<T | null>;
+    all: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<T[]>;
+    get: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<T>;
     withConnection: <T>(callback: (connection: Connection) => Promise<T>) => Promise<T>;
     transaction: <T>(callback: (connection: Transaction) => Promise<T> | T) => Promise<T>;
     instance: pg.Pool;
     clear: (force?: boolean) => Promise<void>;
     end(): Promise<void>;
 };
-declare class SQLStatement {
+export declare class SqlStatement {
     stringsAndValues: [string, unknown | undefined][];
     constructor(strings: string[], values: unknown[]);
     _extract(strings: string[], values: unknown[]): void;
-    append(statement: SQLStatement | string): this;
+    append(statement: SqlStatement | string): this;
     get values(): ({} | null)[];
     get text(): string;
 }
 export declare const sql: {
-    (strings: TemplateStringsArray, ...values: unknown[]): SQLStatement;
+    (strings: TemplateStringsArray, ...values: unknown[]): SqlStatement;
     identifier(name: string): {
         name: string;
         raw: boolean;
@@ -63,14 +69,14 @@ export declare const sql: {
         name: string;
         raw: boolean;
     };
-    literal(name: string): {
+    literal(name: string | null): {
         name: string;
         raw: boolean;
     };
     spreadUpdate: typeof spreadUpdate;
     spreadInsert: typeof spreadInsert;
 };
-declare function spreadUpdate(data: Record<string, any>): SQLStatement;
-declare function spreadInsert<TData extends Record<string, any>>(data: TData | TData[]): SQLStatement;
-export declare function joinStatements(statements: SQLStatement[], separator: string): SQLStatement;
+declare function spreadUpdate(data: Record<string, any>): SqlStatement;
+declare function spreadInsert<TData extends Record<string, any>>(data: TData | TData[]): SqlStatement;
+export declare function joinStatements(statements: SqlStatement[], separator: string): SqlStatement;
 export {};

package/dist/postgres.js

@@ -1,7 +1,17 @@
 import pg, {} from 'pg';
-import { readEnv } from './utils.js';
+import { format } from 'sql-formatter';
+import { readEnv, startTimer } from './utils.js';
 export const escapePostgresIdentifier = pg.escapeIdentifier;
 export const escapePostgresLiteral = pg.escapeLiteral;
+export const formatSql = (statement) => {
+    const value = statement instanceof SqlStatement ? statement.text : statement;
+    return format(value, {
+        language: 'postgresql',
+        keywordCase: 'upper',
+        tabWidth: 2,
+        useTabs: false,
+    });
+};
 export class DoesNotExistError extends Error {
     constructor(message) {
         super(message);
@@ -21,10 +31,20 @@ export class IntegrityError extends Error {
     }
 }
 export class Connection {
-    constructor(client) {
+    constructor(client, options) {
+        this.options = options;
         this.client = client;
     }
+    onLogStatement(text, values, duration) {
+        if (this.options.onLogStatement) {
+            return this.options.onLogStatement(text, values, duration);
+        }
+        if (readEnv.boolean('LOG_SQL', false)) {
+            console.log(`\n${formatSql(text)}\n\nValues: ${JSON.stringify(values)}\nDuration: ${duration}ms\n`);
+        }
+    }
     async query(text, values) {
+        const timer = startTimer();
         try {
             return await this.client.query(text, values);
         }
@@ -34,9 +54,12 @@ export class Connection {
             }
             throw error;
         }
+        finally {
+            this.onLogStatement?.(text, values, timer.getDuration());
+        }
     }
     async all(text, values) {
-        const result = await this.client.query(text, values);
+        const result = await this.query(text, values);
         if (result.rows) {
             return result.rows;
             /* c8 ignore next 2*/
@@ -47,11 +70,11 @@ export class Connection {
         return await this.query(text, values);
     }
     async first(text, values) {
-        const result = await this.client.query(text, values);
+        const result = await this.query(text, values);
         return result.rows && result.rows.length ? result.rows[0] : null;
     }
     async get(text, values) {
-        const result = await this.client.query(text, values);
+        const result = await this.query(text, values);
         if (result.rowCount === 0) {
             throw new DoesNotExistError('Row matching query not found');
         }
@@ -78,7 +101,7 @@ export function createPostgres({ onError, url = readEnv('POSTGRES_URL'), ...conf
     async function withConnection(callback) {
         const client = await pool.connect();
         try {
-            const result = await callback(new Connection(client));
+            const result = await callback(new Connection(client, { onLogStatement: config.onLogStatement }));
             return result;
         }
         finally {
@@ -104,7 +127,7 @@ export function createPostgres({ onError, url = readEnv('POSTGRES_URL'), ...conf
         const client = await pool.connect();
         try {
             await client.query('BEGIN');
-            const result = await callback(new Transaction(client));
+            const result = await callback(new Transaction(client, { onLogStatement: config.onLogStatement }));
             await client.query('COMMIT');
             return result;
         }
@@ -160,7 +183,7 @@ export function createPostgres({ onError, url = readEnv('POSTGRES_URL'), ...conf
 const isRaw = (value) => {
     return (typeof value === 'object' && value !== null && 'raw' in value && !!value.raw);
 };
-class SQLStatement {
+export class SqlStatement {
     constructor(strings, values) {
         this.stringsAndValues = [];
         this._extract(strings, values);
@@ -172,7 +195,7 @@ class SQLStatement {
             if (isRaw(value)) {
                 this.stringsAndValues.push([string + value.name, undefined]);
             }
-            else if (value instanceof SQLStatement) {
+            else if (value instanceof SqlStatement) {
                 this.stringsAndValues.push([string, undefined]);
                 this.stringsAndValues.push(...value.stringsAndValues);
             }
@@ -182,7 +205,7 @@ class SQLStatement {
         }
     }
     append(statement) {
-        if (statement instanceof SQLStatement) {
+        if (statement instanceof SqlStatement) {
             this.stringsAndValues.push(...statement.stringsAndValues);
         }
         else {
@@ -211,14 +234,16 @@ class SQLStatement {
     }
 }
 export const sql = (strings, ...values) => {
-    return new SQLStatement(Array.from(strings), values);
+    return new SqlStatement(Array.from(strings), values);
 };
 function spreadUpdate(data) {
     const entries = Object.entries(data);
     if (entries.length === 0) {
         return sql ``;
     }
-    return joinStatements(entries.map(([key, value]) => sql `${sql.identifier(key)} = ${value}`), ', ');
+    return joinStatements(entries
+        .filter(([, value]) => typeof value !== 'undefined')
+        .map(([key, value]) => sql `${sql.identifier(key)} = ${value == null ? sql.raw('NULL') : value}`), ', ');
 }
 function spreadInsert(data) {
     const rows = Array.isArray(data) ? data : [data];
@@ -257,6 +282,9 @@ sql.raw = (name) => {
  * Inject a literal value into the template string
  */
 sql.literal = (name) => {
+    if (name === null) {
+        return { name: 'NULL', raw: true };
+    }
     return { name: escapePostgresLiteral(name), raw: true };
 };
 sql.spreadUpdate = spreadUpdate;

package/dist/utils.d.ts

@@ -4,6 +4,7 @@ import { type EventEmitter } from 'node:events';
  *
  */
 export declare function startTimer(): {
+    reset(): void;
     getDuration(): number;
 };
 export declare function readEnv(key: string): string | undefined;

package/dist/utils.js

@@ -4,8 +4,11 @@ import {} from 'node:events';
  *
  */
 export function startTimer() {
-    const start = process.hrtime();
+    let start = process.hrtime();
     return {
+        reset() {
+            start = process.hrtime();
+        },
         getDuration() {
             const elapsed = process.hrtime(start);
             return (elapsed[0] * 1e9 + elapsed[1]) / 1e9;

package/dist/validate.d.ts

@@ -39,12 +39,12 @@ export type ValidationResult = {
         [key: string]: any;
     };
 };
-export declare function compileValidateSchema(schema: ValidationSchema, options?: Options): (data: any) => {
-    isValid: boolean;
-    errors: null;
+export declare function compileValidateSchema(schema: ValidationSchema, options?: Options): (data: unknown) => {
+    readonly isValid: true;
+    readonly errors: null;
 } | {
-    isValid: boolean;
-    errors: {
+    readonly isValid: false;
+    readonly errors: {
         [key: string]: any[];
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.40.1",
+  "version": "0.42.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -20,31 +20,31 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^1.15.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.9.3",
+    "@types/node": "22.10.1",
     "@types/supertest": "^6.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.15.0",
-    "@typescript-eslint/parser": "^8.15.0",
-    "@vitest/coverage-v8": "^2.1.5",
+    "@typescript-eslint/eslint-plugin": "^8.17.0",
+    "@typescript-eslint/parser": "^8.17.0",
+    "@vitest/coverage-v8": "^2.1.8",
     "cookiejar": "^2.1.4",
     "eslint": "^8.57.0",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-prettier": "^5.2.1",
     "faktory-worker": "^4.6.0",
-    "prettier": "3.3.3",
+    "prettier": "3.4.1",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
     "tsx": "^4.19.2",
     "typescript": "5.7.2",
-    "vitest": "^2.1.5",
+    "vitest": "^2.1.8",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.40.0",
-    "@sentry/profiling-node": "^8.40.0",
+    "@sentry/node": "^8.42.0",
+    "@sentry/profiling-node": "^8.42.0",
     "@types/bcrypt": "^5.0.2",
     "@types/body-parser": "^1.19.5",
-    "@types/cookie-parser": "^1.4.7",
+    "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
     "@types/jsonwebtoken": "^9.0.7",
     "@types/nodemailer": "^6.4.17",
@@ -58,13 +58,14 @@
     "commander": "^12.1.0",
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",
-    "dotenv": "^16.4.5",
+    "dotenv": "^16.4.6",
     "express": "^4.21.1",
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
     "nodemailer": "^6.9.16",
     "pg": "^8.13.1",
     "redis": "^4.7.0",
+    "sql-formatter": "^15.4.6",
     "uuid": "^11.0.3"
   },
   "prettier": {