@devmoods/express-extras 0.48.1 → 0.49.0

package/dist/auth/emailAndPassword.d.ts

@@ -1,7 +1,6 @@
 import { type AnyUser, type AuthProvider } from './types.js';
 export interface EmailAndPasswordOptions<UserModel = AnyUser> {
-    getUserById: (id: string) => Promise<UserModel>;
-    login: (email: string, verifyPassword: (realPassword: string) => Promise<boolean>) => Promise<UserModel>;
+    login: (email: string, verifyPassword: (realPassword: string) => Promise<string>) => Promise<UserModel>;
     onPasswordResetRequest?(user: UserModel, temporaryToken: string): void | Promise<void>;
     onPasswordChanged?(user: UserModel, newPassword: string): Promise<void>;
     onEmailVerificationRequest?(user: UserModel, temporaryToken: string): Promise<void>;
@@ -9,10 +8,16 @@ export interface EmailAndPasswordOptions<UserModel = AnyUser> {
 }
 export declare function EmailAndPasswordAuthProvider<UserModel extends AnyUser>(options: EmailAndPasswordOptions<UserModel>): AuthProvider<UserModel>;
 /**
- * Compare two password hashes using bcrypt.
+ * Compare password against a stored hash.
+ *
+ * Supports both bcrypt and argon2id. A new argon2id hash will be returned
+ * when using bcrypt to allow gradually migrating. If the returned hash
+ * does not equal the currently stored hash in your db, you should update it.
+ *
+ * Returns a password hash.
  */
-export declare function checkIfPasswordsMatch(realPassword: string, attemptedPassword: string): Promise<boolean>;
+export declare function checkIfPasswordsMatch(hashedUserPassword: string, attemptedPassword: string): Promise<string>;
 /**
  * Returns a hash of a password suitable for storage.
  */
-export declare function hashPassword(password: string): Promise<string>;
+export declare function hashPassword(password: string, useArgon2Id?: boolean): Promise<string>;

package/dist/auth/emailAndPassword.js

@@ -1,15 +1,17 @@
+import argon2 from 'argon2';
 import bcrypt from 'bcrypt';
-import { tokenSchema } from './token.js';
+import { createTokenResponse, tokenSchema } from './token.js';
 import {} from './types.js';
 import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { route } from '../middleware.js';
+import { startTimer } from '../utils.js';
 import { validateBody } from '../validate.js';
 const passwordSchema = { type: 'string', minLength: 4 };
 const emailSchema = { type: 'string', minLength: 4 };
 const logger = getLogger('auth');
 export function EmailAndPasswordAuthProvider(options) {
-    const skipPasswordCheck = async () => true;
+    const skipPasswordCheck = async () => '';
     return {
         setupRoutes(router, context) {
             router.post('/login', validateBody({
@@ -19,15 +21,19 @@ export function EmailAndPasswordAuthProvider(options) {
                     password: passwordSchema,
                 },
                 required: ['email', 'password'],
-            }), route(async ({ body: { email, password } }, res) => {
+            }), route(async (req, res) => {
+                const { email, password } = req.body;
+                const timer = startTimer();
                 try {
                     const user = await options.login(email, (realPassword) => checkIfPasswordsMatch(realPassword, password));
-                    const { token } = await context.login(res, user);
+                    const accessToken = await context.login(req, res, user);
+                    await context.jitter(timer.getDuration());
                     logger.info('access token created');
-                    return [201, { token }];
+                    return createTokenResponse(accessToken);
                 }
                 catch (error) {
                     logger.error(error);
+                    await context.jitter(timer.getDuration());
                     throw Unauthorized(error.message);
                 }
             }));
@@ -38,7 +44,7 @@ export function EmailAndPasswordAuthProvider(options) {
             }), route(async (req) => {
                 const { password, token } = req.body;
                 const decoded = context.decodeTemporaryToken(token);
-                const user = await options.getUserById(decoded.payload.uid);
+                const user = await context.getUserById(decoded.payload.uid);
                 try {
                     await context.verifyTemporaryToken(token, user);
                 }
@@ -56,9 +62,11 @@ export function EmailAndPasswordAuthProvider(options) {
                 required: ['email'],
             }), route(async (req) => {
                 const { email } = req.body;
+                const timer = startTimer();
                 const user = await options.login(email, skipPasswordCheck);
                 const temporaryToken = await context.createTemporaryToken(user);
                 await options.onEmailVerificationRequest?.(user, temporaryToken);
+                await context.jitter(timer.getDuration());
                 return 202;
             }));
             router.post('/verify-email', validateBody({
@@ -71,7 +79,12 @@ export function EmailAndPasswordAuthProvider(options) {
                 try {
                     await context.verifyTemporaryToken(token, user);
                 }
-                catch {
+                catch (error) {
+                    logger.warn('failed to verify token', {
+                        token,
+                        user: context.filterUser(user),
+                        error: error.message,
+                    });
                     throw Unauthorized('Invalid token');
                 }
                 context.setCurrentUser(user);
@@ -85,9 +98,11 @@ export function EmailAndPasswordAuthProvider(options) {
                 required: ['email'],
             }), route(async (req) => {
                 const { email } = req.body;
+                const timer = startTimer();
                 try {
                     const user = await options.login(email, skipPasswordCheck);
                     const temporaryToken = await context.createTemporaryToken(user);
+                    await context.jitter(timer.getDuration());
                     await options.onPasswordResetRequest?.(user, temporaryToken);
                     logger.info('password reset request', { email });
                 }
@@ -100,21 +115,41 @@ export function EmailAndPasswordAuthProvider(options) {
     };
 }
 /**
- * Compare two password hashes using bcrypt.
+ * Compare password against a stored hash.
+ *
+ * Supports both bcrypt and argon2id. A new argon2id hash will be returned
+ * when using bcrypt to allow gradually migrating. If the returned hash
+ * does not equal the currently stored hash in your db, you should update it.
+ *
+ * Returns a password hash.
  */
-export async function checkIfPasswordsMatch(realPassword, attemptedPassword) {
-    if (!realPassword) {
+export async function checkIfPasswordsMatch(hashedUserPassword, attemptedPassword) {
+    if (!hashedUserPassword) {
         throw new Error('User has no defined password');
     }
-    const validPassword = await bcrypt.compare(attemptedPassword, realPassword);
-    if (!validPassword) {
-        throw new Error(`Passwords do not match`);
+    // Migrate from bcrypt to argon2id
+    if (hashedUserPassword.startsWith('$2')) {
+        const validPassword = await bcrypt.compare(attemptedPassword, hashedUserPassword);
+        if (!validPassword) {
+            throw new Error(`Passwords do not match`);
+        }
+        // Return the new argon2id hash
+        return hashPassword(attemptedPassword);
     }
-    return true;
+    else {
+        const validPassword = await argon2.verify(hashedUserPassword, attemptedPassword);
+        if (!validPassword) {
+            throw new Error(`Passwords do not match`);
+        }
+    }
+    return hashedUserPassword;
 }
 /**
  * Returns a hash of a password suitable for storage.
  */
-export function hashPassword(password) {
+export function hashPassword(password, useArgon2Id = true) {
+    if (useArgon2Id) {
+        return argon2.hash(password);
+    }
     return bcrypt.hash(password, 10);
 }

package/dist/auth/passwordless.js

@@ -1,34 +1,29 @@
+import { createTokenResponse } from './token.js';
 import {} from './types.js';
 import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { route } from '../middleware.js';
-import { validateBody, validateQuery } from '../validate.js';
+import { validateBody } from '../validate.js';
 const logger = getLogger('auth');
 export function PasswordlessAuthProvider(options) {
     return {
         setupRoutes(router, context) {
-            router.use('/passwordless/login/:token', validateQuery({
-                type: 'object',
-                properties: {
-                    email: { type: 'string', minLength: 3 },
-                },
-                required: ['email'],
-            }), route(async (req, res) => {
+            router.post('/passwordless/login/:token', route(async (req, res) => {
                 const { token: temporaryToken } = req.params;
-                const { email } = req.query;
-                const user = await options.getUserByEmail(email);
+                const decoded = context.decodeTemporaryToken(temporaryToken);
+                const user = await context.getUserById(decoded.payload.uid);
                 try {
                     await context.verifyTemporaryToken(temporaryToken, user);
                 }
                 catch {
                     throw Unauthorized('Invalid token');
                 }
-                const { token } = await context.login(res, user);
+                const accessToken = await context.login(req, res, user);
                 logger.info('passwordless login');
                 if (req.accepts('html')) {
                     return res.redirect('/');
                 }
-                return { token };
+                return createTokenResponse(accessToken);
             }));
             /**
              * Request a one-time password for login.

package/dist/auth/token.d.ts

@@ -1,14 +1,24 @@
 import { type Response, type Request } from 'express';
 import { type ValidationSchema } from '../validate.js';
 export declare const tokenSchema: ValidationSchema;
+export declare function createTokenResponse(accessToken: AccessToken): readonly [201, {
+    readonly token: string;
+}, {
+    readonly 'Cache-Control': "no-store";
+}];
+export type AccessToken = ReturnType<typeof createAccessToken>;
 /**
  * Returns a signed JWT token.
  */
-export declare function createAuthToken(payload: any, secret?: string): string;
+export declare function createAccessToken(payload: any, version?: string, secret?: string): {
+    token: string;
+    tokenType: "Bearer";
+    expiresIn: number;
+};
 /**
  * Decode the given JWT token.
  */
-export declare function decodeAuthToken(token: string, secret?: string): {
+export declare function decodeAccessToken(token: string, secret?: string): {
     [x: string]: any;
     iss?: string | undefined;
     sub?: string | undefined;

package/dist/auth/token.js

@@ -4,23 +4,37 @@ import { v4 } from 'uuid';
 import { InvalidToken } from './errors.js';
 import { config } from '../config.js';
 import {} from '../validate.js';
+const ACCESS_TOKEN_COOKIE_NAME = 'access_token';
 export const tokenSchema = {
     type: 'string',
     minLength: 6,
     maxLength: 256,
 };
+export function createTokenResponse(accessToken) {
+    return [
+        201,
+        {
+            token: accessToken.token,
+        },
+        {
+            'Cache-Control': 'no-store',
+        },
+    ];
+}
 /**
  * Returns a signed JWT token.
  */
-export function createAuthToken(payload, secret = config.value.AUTH_SECRET) {
-    return jwt.sign(payload, secret, {
-        expiresIn: config.value.AUTH_TOKEN_EXPIRES_IN,
+export function createAccessToken(payload, version = '1', secret = config.value.AUTH_SECRET) {
+    const expiresIn = config.value.AUTH_TOKEN_EXPIRES_IN;
+    const token = jwt.sign({ v: version, ...payload }, secret, {
+        expiresIn,
     });
+    return { token, tokenType: 'Bearer', expiresIn };
 }
 /**
  * Decode the given JWT token.
  */
-export function decodeAuthToken(token, secret = config.value.AUTH_SECRET) {
+export function decodeAccessToken(token, secret = config.value.AUTH_SECRET) {
     try {
         const decoded = jwt.verify(token.trim(), secret);
         /* c8 ignore next 3 */
@@ -70,8 +84,8 @@ export function extractAccessTokenFromRequest(req) {
     if (authorizationHeader) {
         return authorizationHeader;
     }
-    if (req.cookies && 'access_token' in req.cookies) {
-        return req.cookies['access_token'];
+    if (req.cookies && ACCESS_TOKEN_COOKIE_NAME in req.cookies) {
+        return req.cookies[ACCESS_TOKEN_COOKIE_NAME];
     }
     return null;
 }
@@ -82,14 +96,14 @@ export function extractAccessTokenFromRequest(req) {
  */
 export function setAccessTokenCookie(res, token) {
     if (token == null) {
-        res.cookie('access_token', v4(), {
+        res.cookie(ACCESS_TOKEN_COOKIE_NAME, v4(), {
             expires: new Date(1970, 0, 1),
             sameSite: 'strict',
             secure: process.env.NODE_ENV === 'production',
         });
     }
     else {
-        res.cookie('access_token', token, {
+        res.cookie(ACCESS_TOKEN_COOKIE_NAME, token, {
             httpOnly: true,
             sameSite: 'strict',
             secure: process.env.NODE_ENV === 'production',

package/dist/auth/types.d.ts

@@ -1,32 +1,46 @@
-import { type RequestHandler, type Router, type Response } from 'express';
-import { type RedisClient } from '../redis.js';
+import { type RequestHandler, type Router, type Request, type Response } from 'express';
+import { type AccessToken } from './token.js';
 export interface AnyUser {
     id: string | number;
     [key: string]: any;
 }
+export declare abstract class TokenStorage {
+    abstract set(token: string, userId: string, expiresIn: number): Promise<void>;
+    abstract get(token: string): Promise<string | null>;
+    abstract invalidate(token: string): Promise<void>;
+}
+export interface AuthLoginMetadata {
+    ip: string;
+    userAgent: string;
+    sessionId: string;
+}
 export interface AuthOptions<UserModel extends AnyUser> {
-    getUserByToken(token: Record<string, any>): Promise<UserModel>;
+    getUserById(id: string): Promise<UserModel>;
     providers: AuthProvider<UserModel>[];
-    redis: RedisClient;
+    tokenStorage: TokenStorage;
     filterUser(user: UserModel): Partial<UserModel>;
     loginUrl?: string;
+    onUserLoggedIn?: (user: UserModel, metadata: AuthLoginMetadata) => Promise<void>;
+    sessionTokenVersion?: string;
+}
+export interface DecodedTemporaryToken {
+    payload: {
+        v: '1';
+        uid: string;
+    };
+    signature: string;
 }
 export interface AuthProviderContext<UserModel extends AnyUser> {
     filterUser: AuthOptions<UserModel>['filterUser'];
-    redis: AuthOptions<UserModel>['redis'];
+    tokenStorage: AuthOptions<UserModel>['tokenStorage'];
     setCurrentUser: (user: UserModel) => void;
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
-    decodeTemporaryToken(token: string): {
-        payload: {
-            uid: string;
-        };
-        signature: string;
-    };
+    decodeTemporaryToken(token: string): DecodedTemporaryToken;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
-    login: (res: Response, user: UserModel) => Promise<{
-        token: string;
-    }>;
+    login: (req: Request, res: Response, user: UserModel) => Promise<AccessToken>;
+    getUserById(id: string): Promise<UserModel>;
+    jitter(duration?: number): Promise<void>;
 }
 export interface AuthProvider<UserModel extends AnyUser> {
     setupRoutes(router: Router, context: AuthProviderContext<UserModel>): void;

package/dist/auth/types.js

@@ -1,2 +1,4 @@
 import {} from 'express';
-import {} from '../redis.js';
+import {} from './token.js';
+export class TokenStorage {
+}

package/dist/auth.d.ts

@@ -1,5 +1,6 @@
 import { type RequestHandler, Router } from 'express';
-import { type AnyUser, type AuthMiddlewareOptions, type AuthOptions } from './auth/types.js';
+import { TokenStorage, type AnyUser, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
+import { type RedisClient } from './redis.js';
 export * from './auth/types.js';
 export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
@@ -10,11 +11,14 @@ export interface CreateAuth<UserModel extends AnyUser> {
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
-    decodeTemporaryToken(token: string): {
-        payload: {
-            uid: string;
-        };
-        signature: string;
-    };
+    decodeTemporaryToken(token: string): DecodedTemporaryToken;
 }
-export declare function createAuth<UserModel extends AnyUser>({ getUserByToken, filterUser, redis, providers, loginUrl, }: AuthOptions<UserModel>): CreateAuth<UserModel>;
+export declare class RedisTokenStorage extends TokenStorage {
+    private readonly redis;
+    private readonly keyPrefix;
+    constructor(redis: RedisClient, keyPrefix?: string);
+    set(token: string, userId: string, expiresIn: number): Promise<void>;
+    get(token: string): Promise<string | null>;
+    invalidate(token: string): Promise<void>;
+}
+export declare function createAuth<UserModel extends AnyUser>({ getUserById, filterUser, tokenStorage, providers, loginUrl, onUserLoggedIn, sessionTokenVersion, }: AuthOptions<UserModel>): CreateAuth<UserModel>;

package/dist/auth.js

@@ -1,41 +1,75 @@
 import * as crypto from 'node:crypto';
-import { Router } from 'express';
+import { Router, } from 'express';
 import { InvalidToken, PermissionDenied } from './auth/errors.js';
-import { createAuthToken, decodeAuthToken, extractAccessTokenFromRequest, setAccessTokenCookie, tokenSchema, } from './auth/token.js';
-import {} from './auth/types.js';
+import { createAccessToken, decodeAccessToken, extractAccessTokenFromRequest, setAccessTokenCookie, tokenSchema, } from './auth/token.js';
+import { TokenStorage, } from './auth/types.js';
 import { config } from './config.js';
 import { setContext, useContext } from './context.js';
 import { Forbidden, NotFound, Unauthorized } from './errors.js';
 import { getLogger } from './logger.js';
 import { route } from './middleware.js';
+import {} from './redis.js';
 import { validateParams } from './validate.js';
 const logger = getLogger('auth');
 export * from './auth/types.js';
 export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
 export * from './auth/token.js';
-export function createAuth({ getUserByToken, filterUser, redis, providers, loginUrl = '/', }) {
+export class RedisTokenStorage extends TokenStorage {
+    constructor(redis, keyPrefix = 'auth:') {
+        super();
+        this.redis = redis;
+        this.keyPrefix = keyPrefix;
+    }
+    async set(token, userId, expiresIn) {
+        await this.redis.set(`${this.keyPrefix}${token}`, userId, {
+            EX: expiresIn,
+        });
+    }
+    async get(token) {
+        return this.redis.get(`${this.keyPrefix}${token}`);
+    }
+    async invalidate(token) {
+        await this.redis.del(`${this.keyPrefix}${token}`);
+    }
+}
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion = '1', }) {
     const useCurrentUser = () => useContext('currentUser');
     const setCurrentUser = (user) => setContext('currentUser', user);
-    const login = async (res, user) => {
-        const token = createAuthToken(filterUser(user));
-        await redis.set(token, '1', { EX: config.value.AUTH_TOKEN_EXPIRES_IN });
-        setAccessTokenCookie(res, token);
+    const login = async (req, res, user) => {
+        const accessToken = createAccessToken({ uid: user.id }, sessionTokenVersion);
+        const sessionId = sha256(accessToken.token);
+        await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
+        setAccessTokenCookie(res, accessToken.token);
         setCurrentUser(user);
-        return { token };
+        await onUserLoggedIn?.(user, {
+            ip: req.ip ?? '',
+            userAgent: req.headers['user-agent'] ?? '',
+            sessionId,
+        });
+        return accessToken;
+    };
+    const logout = async (res, sessionId) => {
+        await tokenStorage.invalidate(sessionId);
+        setAccessTokenCookie(res, null);
     };
+    // Make timing attacks harder
+    const jitter = (duration = 0) => new Promise((resolve) => void setTimeout(resolve, Math.max((0.5 - duration) * 1000, 200)));
     /**
      * API for auth providers to use
      */
     const providerContext = {
         filterUser,
-        redis,
+        tokenStorage,
         setCurrentUser,
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
         middleware,
         login,
+        getUserById,
+        jitter,
     };
     const createRouter = () => {
         const router = Router();
@@ -46,9 +80,8 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
         router.get('/logout', route(async (req, res) => {
             const token = extractAccessTokenFromRequest(req);
             if (token) {
-                await redis.del(token);
+                await logout(res, sha256(token));
             }
-            setAccessTokenCookie(res, null);
             res.redirect(loginUrl);
         }));
         /**
@@ -60,8 +93,8 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
             required: ['token'],
         }), route(async (req) => {
             const { token } = req.params;
-            const email = await redis.get(token);
-            if (!email) {
+            const value = await tokenStorage.get(token);
+            if (!value) {
                 logger.info('invalid reset token', { token });
                 throw NotFound();
             }
@@ -73,7 +106,7 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
                 setAccessTokenCookie(res, null);
                 throw Unauthorized();
             }
-            const { token } = await providerContext.login(res, user);
+            const { token } = await providerContext.login(req, res, user);
             logger.info('refreshed token');
             return { token, user: filterUser(user) };
         }));
@@ -97,20 +130,27 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
                     }
                     throw new InvalidToken('token missing');
                 }
-                const valid = await redis.get(token);
-                if (!valid) {
+                const sessionId = sha256(token);
+                const value = await tokenStorage.get(sessionId);
+                if (!value) {
                     if (!authenticate) {
                         logger.warn('request with invalid access token');
                         return next();
                     }
-                    throw new InvalidToken('token expired');
+                    await logout(res, sessionId);
+                    throw new InvalidToken('session token expired');
+                }
+                const decoded = decodeAccessToken(token);
+                if (decoded.v !== sessionTokenVersion) {
+                    await logout(res, token);
+                    throw new InvalidToken('Invalid token version');
                 }
-                const decoded = decodeAuthToken(token);
                 let user;
                 try {
-                    user = await getUserByToken(decoded);
+                    user = await getUserById(decoded.uid);
                 }
                 catch {
+                    await logout(res, token);
                     throw new InvalidToken('User not found');
                 }
                 if (options.isAuthorized && !(await options.isAuthorized(user))) {
@@ -131,7 +171,7 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    return next(Unauthorized('Invalid token'));
+                    return next(Unauthorized(`Invalid token: ${error.message}`));
                 }
                 next(error);
             }
@@ -143,17 +183,18 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
      */
     async function createTemporaryToken(user) {
         try {
-            const randomBytes = crypto.randomBytes(8).toString('hex');
-            const payload = { uid: user.id, r: randomBytes };
+            const randomBytes = crypto.randomBytes(32).toString('hex');
+            const payload = { v: '1', uid: user.id, r: randomBytes };
             const signature = crypto
                 .createHmac('sha256', config.value.AUTH_SECRET)
                 .update(JSON.stringify(payload))
                 .digest('base64')
                 .slice(0, 12);
             const temporaryToken = Buffer.from(JSON.stringify({ payload, signature })).toString('base64url');
-            await redis.set(temporaryToken, user.id, {
-                EX: config.value.AUTH_TEMP_TOKEN_EXPIRES_IN,
-            });
+            if (!user.id) {
+                throw new Error('User ID is required to create a token');
+            }
+            await tokenStorage.set(temporaryToken, String(user.id), config.value.AUTH_TEMP_TOKEN_EXPIRES_IN);
             return temporaryToken;
         }
         catch (error) {
@@ -175,13 +216,13 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
             throw new InvalidToken('Invalid signature');
         }
         if (decoded.payload.uid !== user.id) {
-            throw new InvalidToken('Invalid user');
+            throw new InvalidToken(`Invalid user ${user.id}`);
         }
-        const storedUid = await redis.get(token);
+        const storedUid = await tokenStorage.get(token);
         if (storedUid !== user.id) {
-            throw new InvalidToken('Invalid user');
+            throw new InvalidToken(`Invalid user ${user.id}`);
         }
-        await redis.del(token);
+        await tokenStorage.invalidate(token);
     }
     return {
         createRouter,

package/dist/cache.d.ts

@@ -13,6 +13,7 @@ export interface RedisCacheAdapterOptions {
 }
 export declare function createRedisCacheAdapter(redis: RedisClient, options?: RedisCacheAdapterOptions): CacheAdapter;
 export declare function createMemoryCacheAdapter(): CacheAdapter;
+export type Cache = ReturnType<typeof createCache>;
 export declare function createCache(adapter: CacheAdapter): {
     set: (key: string, value: any, expires?: number | null | undefined) => Promise<void>;
     get: (key: string) => Promise<any>;

package/dist/config.d.ts

@@ -17,6 +17,15 @@ export declare const config: {
         GRACE_PERIOD_MS: number;
         SLACK_WEBHOOK_URL: string;
         VITE_USE_DEV_SERVER: boolean;
+        /**
+         * Email configuration
+         */
+        EMAIL_HOST: string;
+        EMAIL_PORT: string;
+        EMAIL_USER: string;
+        EMAIL_PASS: string;
+        EMAIL_SENDER_NAME: string;
+        EMAIL_SENDER_ADDRESS: string;
     };
 };
 export declare function extendConfig<T extends Record<string, unknown>>(appConfig: T): {
@@ -38,5 +47,14 @@ export declare function extendConfig<T extends Record<string, unknown>>(appConfi
         GRACE_PERIOD_MS: number;
         SLACK_WEBHOOK_URL: string;
         VITE_USE_DEV_SERVER: boolean;
+        /**
+         * Email configuration
+         */
+        EMAIL_HOST: string;
+        EMAIL_PORT: string;
+        EMAIL_USER: string;
+        EMAIL_PASS: string;
+        EMAIL_SENDER_NAME: string;
+        EMAIL_SENDER_ADDRESS: string;
     } & T;
 };

package/dist/config.js

@@ -20,6 +20,15 @@ const baseConfig = {
     GRACE_PERIOD_MS: readEnv.number('GRACE_PERIOD_MS', 20000),
     SLACK_WEBHOOK_URL: readEnv('SLACK_WEBHOOK_URL', ''),
     VITE_USE_DEV_SERVER: readEnv.boolean('VITE_USE_DEV_SERVER', false),
+    /**
+     * Email configuration
+     */
+    EMAIL_HOST: readEnv('EMAIL_HOST', ''),
+    EMAIL_PORT: readEnv('EMAIL_PORT', '587'),
+    EMAIL_USER: readEnv('EMAIL_USER', ''),
+    EMAIL_PASS: readEnv('EMAIL_PASS', ''),
+    EMAIL_SENDER_NAME: readEnv('EMAIL_SENDER_NAME', ''),
+    EMAIL_SENDER_ADDRESS: readEnv('EMAIL_SENDER_ADDRESS', ''),
 };
 export const config = lazy(() => baseConfig);
 export function extendConfig(appConfig) {

package/dist/email.d.ts

@@ -4,14 +4,14 @@ export interface EmailOptions {
     port?: string;
     user?: string;
     pass?: string;
-    senderName: string;
-    senderAddress: string;
+    senderName?: string;
+    senderAddress?: string;
     onEmailSent?: (payload: Record<string, any>) => void | Promise<void>;
 }
 export interface SendEmailOptions extends nodemailer.SendMailOptions {
     message: string;
 }
-export declare function createEmail({ host, port, user, pass, senderName, senderAddress, onEmailSent, }: EmailOptions): {
+export declare function createEmail({ host, port, user, pass, senderName, senderAddress, onEmailSent, }?: EmailOptions): {
     send: ({ to, subject, message, ...rest }: SendEmailOptions) => Promise<void>;
     transporter: nodemailer.Transporter<import("nodemailer/lib/smtp-transport/index.js").SentMessageInfo, import("nodemailer/lib/smtp-transport/index.js").Options>;
 };

package/dist/email.js

@@ -1,13 +1,17 @@
 import * as nodemailer from 'nodemailer';
+import { config } from './config.js';
 import { getLogger } from './logger.js';
 const logger = getLogger('email');
-export function createEmail({ host, port, user, pass, senderName, senderAddress, onEmailSent, }) {
+export function createEmail({ host = config.value.EMAIL_HOST, port = config.value.EMAIL_PORT, user = config.value.EMAIL_USER, pass = config.value.EMAIL_PASS, senderName = config.value.EMAIL_SENDER_NAME, senderAddress = config.value.EMAIL_SENDER_ADDRESS, onEmailSent, } = {}) {
     const transporter = nodemailer.createTransport({
         host,
         port: parseInt(port || '587', 10),
         secure: false,
-        auth: { user, pass },
+        auth: user && pass ? { user, pass } : undefined,
     });
+    if (!senderName || !senderAddress) {
+        throw new Error('Email: missing sender name or address');
+    }
     const send = async ({ to, subject, message, ...rest }) => {
         const payload = {
             from: `${senderName} <${senderAddress}>`,

package/dist/listen.js

@@ -4,6 +4,7 @@ import {} from 'node:net';
 import { delay } from '@devmoods/fetch';
 import {} from 'express';
 import { config } from './config.js';
+import { BadRequest } from './errors.js';
 import { getLogger } from './logger.js';
 import { before, route } from './middleware.js';
 import { envPort, startTimer } from './utils.js';
@@ -100,8 +101,9 @@ export function createExpressServer(app, options = {}) {
     for (const signal of ['SIGTERM', 'SIGINT']) {
         process.on(signal, onSignal);
     }
+    const healthTypes = ['live', 'ready'];
     if (!app.get('__healthAttached')) {
-        app.get('/health', before(), validateQuery({
+        app.get('/health/:type?', before(), validateQuery({
             type: 'object',
             properties: {
                 type: { type: 'string', enum: ['live', 'ready'] },
@@ -112,7 +114,13 @@ export function createExpressServer(app, options = {}) {
                 if (stopping) {
                     throw new Error();
                 }
-                const type = req.query.type;
+                const validateType = (type) => {
+                    return healthTypes.includes(type);
+                };
+                const type = req.params.type || req.query.type || 'ready';
+                if (!validateType(type)) {
+                    throw BadRequest('Invalid health type');
+                }
                 const meta = await options.healthCheck?.(type);
                 return { status: 'ok', type, meta, timestamp };
             }

package/dist/middleware.d.ts

@@ -1,12 +1,8 @@
 import { type ServerResponse, type IncomingMessage } from 'node:http';
-import bodyParser from 'body-parser';
 import { compose } from 'compose-middleware';
-import { type NextFunction, type RequestHandler, type Request, type Response } from 'express';
+import { type NextFunction, type RequestHandler, type Request, type Response, json as jsonParser, urlencoded as urlencodedParser } from 'express';
 import { type CsrfMiddlewareOptions } from './csrf.js';
-type UrlencodedParser = typeof bodyParser.urlencoded;
-type JsonParser = typeof bodyParser.json;
-export declare const urlencodedParser: UrlencodedParser;
-export declare const jsonParser: JsonParser;
+export { urlencodedParser, jsonParser };
 export { asyncMiddleware as route };
 export { compose as composeMiddleware };
 type ContentSecurityPolicyDirectiveValue = string | ((req: IncomingMessage, res: ServerResponse) => string);

package/dist/middleware.js

@@ -1,23 +1,21 @@
 import * as crypto from 'node:crypto';
 import {} from 'node:http';
-import bodyParser from 'body-parser';
 import { compose } from 'compose-middleware';
 import cookieParser from 'cookie-parser';
-import {} from 'express';
+import { json as jsonParser, urlencoded as urlencodedParser, } from 'express';
 import helmet from 'helmet';
 import { setContext, useContext, withRequestContext } from './context.js';
 import { csrf, doubleCsrfProtection, } from './csrf.js';
 import { NotFound } from './errors.js';
 import { getLogger } from './logger.js';
 import { startTimer } from './utils.js';
-export const urlencodedParser = bodyParser.urlencoded;
-export const jsonParser = bodyParser.json;
+export { urlencodedParser, jsonParser };
 const logger = getLogger('http');
 export { asyncMiddleware as route };
 export { compose as composeMiddleware };
 const CSP_NONCE_KEY = 'csp-nonce';
 export function useCspNonce() {
-    return useContext(CSP_NONCE_KEY) ?? 'fuck';
+    return useContext(CSP_NONCE_KEY) ?? '__CSP_NOT_SET__';
 }
 /**
  * Register middleware that must come before the app routes.
@@ -67,12 +65,16 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
                 },
             }),
         useJson && jsonParser(),
+        urlencodedParser({ extended: true }),
         (cookies || useCsrf) && cookieParser(),
         analyticsProxy(),
     ].filter(Boolean));
 }
 function logRequestDuration() {
     return (req, res, next) => {
+        if (req.path.startsWith('/src')) {
+            return next();
+        }
         const timer = startTimer();
         logger.info('http request', {
             method: req.method,

package/dist/utils.d.ts

@@ -1,10 +1,15 @@
 import { type EventEmitter } from 'node:events';
 /**
  * Start a high resolution timer
- *
  */
 export declare function startTimer(): {
+    /**
+     * Reset the timer
+     */
     reset(): void;
+    /**
+     * Get duration in seconds
+     */
     getDuration(): number;
 };
 export declare function readEnv(key: string): string | undefined;

package/dist/utils.js

@@ -1,14 +1,19 @@
 import {} from 'node:events';
 /**
  * Start a high resolution timer
- *
  */
 export function startTimer() {
     let start = process.hrtime();
     return {
+        /**
+         * Reset the timer
+         */
         reset() {
             start = process.hrtime();
         },
+        /**
+         * Get duration in seconds
+         */
         getDuration() {
             const elapsed = process.hrtime(start);
             return (elapsed[0] * 1e9 + elapsed[1]) / 1e9;

package/dist/vite/defineViteConfig.d.ts

@@ -1,6 +1,7 @@
 import { type UserConfig } from 'vite';
-export declare function defineViteConfig({ base, reactCompiler, ssr, }: {
+export declare function defineViteConfig({ base, reactCompiler, ssr, analyze, }: {
     base?: string;
     reactCompiler?: boolean;
     ssr?: boolean;
+    analyze?: boolean;
 }): UserConfig;

package/dist/vite/defineViteConfig.js

@@ -1,9 +1,10 @@
 /// <reference types="vitest" />
 import * as path from 'node:path';
 import react from '@vitejs/plugin-react';
+import Sonda from 'sonda/vite';
 import { defineConfig } from 'vite';
 import { readEnv } from '../utils.js';
-export function defineViteConfig({ base = '', reactCompiler = false, ssr = false, }) {
+export function defineViteConfig({ base = '', reactCompiler = false, ssr = false, analyze = true, }) {
     const port = readEnv.number('VITE_PORT', 5173);
     return defineConfig({
         plugins: [
@@ -16,11 +17,18 @@ export function defineViteConfig({ base = '', reactCompiler = false, ssr = false
                     }
                     : {}),
             }),
+            Sonda({
+                enabled: analyze,
+                open: false,
+                detailed: true,
+                sources: true,
+            }),
         ],
         base,
         build: {
             chunkSizeWarningLimit: 750,
             manifest: true,
+            sourcemap: true,
             rollupOptions: {
                 input: {
                     index: path.resolve(process.cwd(), 'src/entry-client.tsx'),
@@ -41,6 +49,7 @@ export function defineViteConfig({ base = '', reactCompiler = false, ssr = false
         test: {
             setupFiles: ['./src/setupTests'],
             include: ['src/**/*.{test,spec}.?(c|m)[jt]s?(x)'],
+            globals: true,
         },
         css: {
             preprocessorOptions: {

package/dist/vite/ssr.d.ts

@@ -1,7 +1,6 @@
-import express from 'express';
 export interface SsrMiddleWareOptions {
     root?: string;
     getInitialData?: (req: string) => Promise<unknown>;
     useDevServer?: boolean;
 }
-export declare function createSsrMiddleware({ root, getInitialData, useDevServer, }?: SsrMiddleWareOptions): Promise<express.RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>[]>;
+export declare function createSsrMiddleware({ root, getInitialData, useDevServer, }?: SsrMiddleWareOptions): Promise<import("compose-middleware").RequestHandler<unknown, unknown, void>>;

package/dist/vite/ssr.js

@@ -4,7 +4,7 @@ import express, {} from 'express';
 import { createServer as createViteServer } from 'vite';
 import {} from './types.js';
 import { config } from '../config.js';
-import { route, useCspNonce } from '../middleware.js';
+import { composeMiddleware, route, useCspNonce } from '../middleware.js';
 export async function createSsrMiddleware({ root = process.cwd(), getInitialData = async () => ({}), useDevServer = config.value.VITE_USE_DEV_SERVER, } = {}) {
     const resolve = (p) => path.resolve(root, p);
     let vite;
@@ -30,6 +30,7 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 const result = await import(path.join(root, 'dist/server/entry-server.js'));
                 render = result.render;
             }
+            const nonce = useCspNonce();
             const rendered = await render(req, res, {
                 useDevServer,
                 getInitialData,
@@ -40,7 +41,7 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
             {{ ssr-js }}
             {{ ssr-css }}
           `,
-                nonce: useCspNonce(),
+                nonce,
                 preamble: `
             import RefreshRuntime from "/@react-refresh"
             RefreshRuntime.injectIntoGlobalHook(window)
@@ -59,6 +60,8 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
             let html = rendered.html;
             const context = Object.assign({}, rendered.context, await readManifest());
             const ssrPlaceholders = Object.fromEntries(Object.entries(context).map(([k, v]) => [`ssr-${k}`, v.toString()]));
+            // Add nonce to all bare script tags
+            html = html.replace(/<script>/g, `<script nonce="${nonce}">`);
             html = replaceSsrPlaceholders(html, ssrPlaceholders);
             html = `<!DOCTYPE html>\n${html}`;
             return [200, html, { 'Content-type': 'text/html' }];
@@ -75,7 +78,7 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
             throw error;
         }
     }));
-    return middlewares;
+    return composeMiddleware(middlewares);
 }
 function replaceSsrPlaceholders(template, values) {
     return template.replace(/\{\{\s*([\w-]+)\s*\}\}/g, (match, variableName) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.48.1",
+  "version": "0.49.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -8,26 +8,26 @@
   "exports": {
     ".": {
       "import": {
-        "default": "./dist/index.js",
-        "types": "./dist/index.d.ts"
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
       }
     },
     "./vite": {
       "import": {
-        "default": "./dist/vite.js",
-        "types": "./dist/vite/types.js"
+        "types": "./dist/vite/types.js",
+        "default": "./dist/vite.js"
       }
     },
     "./vite/ssr": {
       "import": {
-        "default": "./dist/vite/ssr.js",
-        "types": "./dist/vite/ssr.d.ts"
+        "types": "./dist/vite/ssr.d.ts",
+        "default": "./dist/vite/ssr.js"
       }
     },
     "./vite/types": {
       "import": {
-        "default": "./dist/vite/types.js",
-        "types": "./dist/vite/types.d.ts"
+        "types": "./dist/vite/types.d.ts",
+        "default": "./dist/vite/types.js"
       }
     }
   },
@@ -46,7 +46,7 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^2.5.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.10.2",
+    "@types/node": "22.10.5",
     "@types/supertest": "^6.0.2",
     "@vitejs/plugin-react": "^4.3.4",
     "@vitest/coverage-v8": "^2.1.8",
@@ -54,20 +54,20 @@
     "eslint": "^9.17.0",
     "faktory-worker": "^4.6.0",
     "prettier": "3.4.2",
+    "sonda": "^0.7.1",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
     "tsx": "^4.19.2",
-    "typescript": "5.7.2",
-    "vite": "^6.0.5",
+    "typescript": "5.7.3",
+    "vite": "^6.0.7",
     "vitest": "^2.1.8",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.47.0",
-    "@sentry/profiling-node": "^8.47.0",
+    "@sentry/node": "^8.48.0",
+    "@sentry/profiling-node": "^8.48.0",
     "@types/bcrypt": "^5.0.2",
-    "@types/body-parser": "^1.19.5",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
     "@types/jsonwebtoken": "^9.0.7",
@@ -76,10 +76,10 @@
     "@types/superagent": "^8.1.9",
     "@types/uuid": "^10.0.0",
     "ajv": "^8.17.1",
+    "argon2": "^0.41.1",
     "bcrypt": "^5.1.1",
-    "body-parser": "^1.20.3",
     "chalk": "^5.4.1",
-    "commander": "^12.1.0",
+    "commander": "^13.0.0",
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
@@ -89,8 +89,8 @@
     "nodemailer": "^6.9.16",
     "pg": "^8.13.1",
     "redis": "^4.7.0",
-    "sql-formatter": "^15.4.8",
-    "uuid": "^11.0.3"
+    "sql-formatter": "^15.4.9",
+    "uuid": "^11.0.4"
   },
   "prettier": {
     "singleQuote": true
@@ -101,7 +101,7 @@
     "vite": ">=6.0.5"
   },
   "engines": {
-    "node": ">=20.3.0 <23"
+    "node": ">=20 <24"
   },
   "scripts": {
     "start": "pushd example; pnpm run start --watch; popd example;",