@devmoods/express-extras 0.49.4 → 0.51.0

package/dist/auth/emailAndPassword.d.ts

@@ -1,8 +1,12 @@
 import { type AnyUser, type AuthProvider } from './types.js';
+export interface AuthPasswordChangedMetadata {
+    ip: string;
+    userAgent: string;
+}
 export interface EmailAndPasswordOptions<UserModel = AnyUser> {
     login: (email: string, verifyPassword: (realPassword: string) => Promise<string>) => Promise<UserModel>;
     onPasswordResetRequest?(user: UserModel, temporaryToken: string): void | Promise<void>;
-    onPasswordChanged?(user: UserModel, newPassword: string): Promise<void>;
+    onPasswordChanged?(user: UserModel, newPassword: string, metadata: AuthPasswordChangedMetadata): Promise<void>;
     onEmailVerificationRequest?(user: UserModel, temporaryToken: string): Promise<void>;
     onEmailVerified?(user: UserModel): Promise<void>;
 }

package/dist/auth/emailAndPassword.js

@@ -52,7 +52,10 @@ export function EmailAndPasswordAuthProvider(options) {
                     throw Unauthorized('Invalid token');
                 }
                 context.setCurrentUser(user);
-                await options.onPasswordChanged?.(user, await hashPassword(password));
+                await options.onPasswordChanged?.(user, await hashPassword(password), {
+                    ip: req.ip ?? '',
+                    userAgent: req.headers['user-agent'] ?? '',
+                });
                 logger.info('user changed password');
                 return 200;
             }));

package/dist/auth/types.d.ts

@@ -38,7 +38,7 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
-    login: (req: Request, res: Response, user: UserModel) => Promise<AccessToken>;
+    login: (req: Request, res: Response, user: UserModel, isRefresh?: boolean) => Promise<AccessToken>;
     getUserById(id: string): Promise<UserModel>;
     jitter(duration?: number): Promise<void>;
 }

package/dist/auth.d.ts

@@ -9,6 +9,8 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createRouter: () => Router;
     useCurrentUser: () => UserModel | undefined;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
+    before: () => RequestHandler;
+    isAuthorized: (fn?: (user: UserModel) => boolean) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;

package/dist/auth.js

@@ -16,7 +16,7 @@ export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
 export * from './auth/token.js';
 export class RedisTokenStorage extends TokenStorage {
-    constructor(redis, keyPrefix = 'auth:') {
+    constructor(redis, keyPrefix = `${config.value.REDIS_KEY_PREFIX}auth:`) {
         super();
         this.redis = redis;
         this.keyPrefix = keyPrefix;
@@ -37,17 +37,19 @@ const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex'
 export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion = '1', }) {
     const useCurrentUser = () => useContext('currentUser');
     const setCurrentUser = (user) => setContext('currentUser', user);
-    const login = async (req, res, user) => {
+    const login = async (req, res, user, isRefresh = false) => {
         const accessToken = createAccessToken({ uid: user.id }, sessionTokenVersion);
         const sessionId = sha256(accessToken.token);
         await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
         setAccessTokenCookie(res, accessToken.token);
         setCurrentUser(user);
-        await onUserLoggedIn?.(user, {
-            ip: req.ip ?? '',
-            userAgent: req.headers['user-agent'] ?? '',
-            sessionId,
-        });
+        if (!isRefresh) {
+            await onUserLoggedIn?.(user, {
+                ip: req.ip ?? '',
+                userAgent: req.headers['user-agent'] ?? '',
+                sessionId,
+            });
+        }
         return accessToken;
     };
     const logout = async (res, sessionId) => {
@@ -106,7 +108,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                 setAccessTokenCookie(res, null);
                 throw Unauthorized();
             }
-            const { token } = await providerContext.login(req, res, user);
+            const { token } = await providerContext.login(req, res, user, true);
             logger.info('refreshed token');
             return { token, user: filterUser(user) };
         }));
@@ -153,9 +155,15 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     await logout(res, token);
                     throw new InvalidToken('User not found');
                 }
+                const tokenLifetimeMs = decoded.exp * 1000 - decoded.iat * 1000;
+                const remainingMs = decoded.exp * 1000 - Date.now();
+                const shouldRefresh = remainingMs < tokenLifetimeMs * 0.25;
                 if (options.isAuthorized && !(await options.isAuthorized(user))) {
                     throw new PermissionDenied('Permission denied');
                 }
+                if (shouldRefresh) {
+                    await providerContext.login(req, res, user, true);
+                }
                 setCurrentUser(user);
                 next();
             }
@@ -225,6 +233,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         await tokenStorage.invalidate(token);
     }
     return {
+        before: () => middleware(false),
+        isAuthorized: (fn) => middleware({ isAuthorized: fn || (() => true) }),
         createRouter,
         useCurrentUser,
         middleware,

package/dist/cache.js

@@ -1,21 +1,24 @@
+import { config } from './config.js';
 import {} from './redis.js';
 export function createRedisCacheAdapter(redis, options = {}) {
-    const { keyPrefix = 'cache:' } = options;
-    const createKey = (key) => `${keyPrefix}${key}`;
+    const { keyPrefix = `${config.value.REDIS_KEY_PREFIX}cache:` } = options;
+    const withKeyPrefix = (key) => `${keyPrefix}${key}`;
     return {
         async get(key) {
-            const value = await redis.get(createKey(key));
+            const value = await redis.get(withKeyPrefix(key));
             if (value == null) {
                 return null;
             }
             return JSON.parse(value);
         },
         async set(key, value, expires) {
-            await redis.set(createKey(key), JSON.stringify(value), { PX: expires });
+            await redis.set(withKeyPrefix(key), JSON.stringify(value), {
+                PX: expires,
+            });
         },
         async clear(key) {
             if (key) {
-                await redis.del(createKey(key));
+                await redis.del(withKeyPrefix(key));
             }
             const keys = await redis.keys(`${keyPrefix}*`);
             for (const existingKey of keys) {

package/dist/channels.d.ts

@@ -0,0 +1,8 @@
+import { type Request } from 'express';
+import { type RedisClient } from './redis.js';
+export declare function createEventStream<Channels extends string>(redis: RedisClient): {
+    sse: ({ channels, }: {
+        channels: (req: Request) => string[] | Promise<string[]>;
+    }) => import("express").RequestHandler<Record<string, string>, Record<string, any>, unknown, Record<string, any>, Record<string, any>>;
+    publish: (channel: Channels, message: unknown) => Promise<number>;
+};

package/dist/channels.js

@@ -0,0 +1,66 @@
+import {} from 'express';
+import { config } from './config.js';
+import { requestContext } from './context.js';
+import { getLogger } from './logger.js';
+import { route } from './middleware.js';
+import {} from './redis.js';
+const logger = getLogger();
+export function createEventStream(redis) {
+    const keyPrefix = `${config.value.REDIS_KEY_PREFIX}events:`;
+    const withKeyPrefix = (key) => `${keyPrefix}${key}`;
+    const sse = ({ channels, }) => {
+        return route(async (req, res) => {
+            const headers = {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                Connection: 'keep-alive',
+            };
+            res.writeHead(200, headers);
+            res.write('retry: 15000\n');
+            const heartbeat = setInterval(() => {
+                try {
+                    if (!res.writableEnded) {
+                        res.write('event: heartbeat\n');
+                        res.write('data: ping\n\n');
+                    }
+                }
+                catch (error) {
+                    logger.error(error);
+                }
+            }, 15000);
+            const store = requestContext.getStore();
+            const listener = (value) => {
+                try {
+                    requestContext.run(store, () => {
+                        if (!res.writableEnded) {
+                            res.write('event: data\n');
+                            res.write(`data: ${JSON.stringify(value)}\n\n`);
+                        }
+                    });
+                }
+                catch (error) {
+                    logger.error(error);
+                }
+            };
+            const subscriber = redis.duplicate();
+            await subscriber.connect();
+            const _channels = await channels(req);
+            await subscriber.subscribe(_channels.map(withKeyPrefix), (message) => {
+                listener(JSON.parse(message));
+            });
+            logger.info('event stream subscribe', { channels: _channels });
+            res.on('close', () => {
+                requestContext.run(store, () => {
+                    logger.info('event stream close');
+                    clearInterval(heartbeat);
+                    subscriber.quit();
+                    res.end();
+                });
+            });
+        });
+    };
+    const publish = (channel, message) => {
+        return redis.publish(withKeyPrefix(channel), JSON.stringify(message));
+    };
+    return { sse, publish };
+}

package/dist/config.d.ts

@@ -7,6 +7,7 @@ export declare const config: {
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
         AUTH_SECRET: string;
         REDIS_URL: string;
+        REDIS_KEY_PREFIX: string;
         POSTGRES_URL: string;
         SENTRY_DSN: string;
         LOG_LEVEL: string;
@@ -37,6 +38,7 @@ export declare function extendConfig<T extends Record<string, unknown>>(appConfi
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
         AUTH_SECRET: string;
         REDIS_URL: string;
+        REDIS_KEY_PREFIX: string;
         POSTGRES_URL: string;
         SENTRY_DSN: string;
         LOG_LEVEL: string;

package/dist/config.js

@@ -10,6 +10,7 @@ const baseConfig = {
     AUTH_TEMP_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TEMP_TOKEN_EXPIRES', 3600),
     AUTH_SECRET: readEnv('AUTH_JWT_SECRET', ''),
     REDIS_URL: readEnv('REDIS_URL', ''),
+    REDIS_KEY_PREFIX: readEnv('REDIS_KEY_PREFIX', ''),
     POSTGRES_URL: readEnv('POSTGRES_URL', ''),
     SENTRY_DSN: readEnv('SENTRY_DSN', ''),
     LOG_LEVEL: readEnv('LOG_LEVEL', 'INFO'),

package/dist/context.d.ts

@@ -1,4 +1,6 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { type Request, type RequestHandler } from 'express';
+export declare const requestContext: AsyncLocalStorage<Map<string, any>>;
 export interface RequestContextOptions {
     getRequestId?: (req: Request) => string | undefined;
 }

package/dist/context.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import {} from 'express';
 import { v4 as uuid } from 'uuid';
-const requestContext = new AsyncLocalStorage();
+export const requestContext = new AsyncLocalStorage();
 const REQUEST_ID = 'requestId';
 /**
  * Middleware for setting a `requestId` on the request context.

package/dist/faktory.d.ts

@@ -14,7 +14,6 @@ export declare function createJobs<GlobalContext extends AnyJobContext>({ queueN
         $job: boolean;
         jobName: string;
         options: JobOptions;
-        readonly executionCount: number;
         delay(args?: Parameters<Fn>[0]): Promise<`${string}-${string}-${string}-${string}-${string}`>;
         execute(args: Parameters<Fn>[0], context: GlobalContext): Promise<any>;
     };

package/dist/faktory.js

@@ -14,7 +14,6 @@ export function createJobs({ queueName, faktory: createFactory = create, }) {
             throw new Error('job() must get a function as the first or second argument');
         }
         const jobName = fn.name;
-        let executionCount = 0;
         if (!jobName) {
             throw new Error('Can not create job without a name');
         }
@@ -22,9 +21,6 @@ export function createJobs({ queueName, faktory: createFactory = create, }) {
             $job: true,
             jobName,
             options,
-            get executionCount() {
-                return executionCount;
-            },
             async delay(args) {
                 const jid = randomUUID();
                 try {
@@ -49,7 +45,6 @@ export function createJobs({ queueName, faktory: createFactory = create, }) {
             async execute(args, context) {
                 try {
                     const result = await fn(args, context);
-                    executionCount += 1;
                     return result;
                 }
                 catch (error) {

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './auth.js';
 export * from './cache.js';
+export * from './channels.js';
 export * from './cli.js';
 export * from './config.js';
 export * from './context.js';

package/dist/index.js

@@ -1,6 +1,7 @@
 /* c8 ignore next 100 */
 export * from './auth.js';
 export * from './cache.js';
+export * from './channels.js';
 export * from './cli.js';
 export * from './config.js';
 export * from './context.js';

package/dist/listen.js

@@ -6,7 +6,7 @@ import {} from 'express';
 import { config } from './config.js';
 import { BadRequest } from './errors.js';
 import { getLogger } from './logger.js';
-import { before, route } from './middleware.js';
+import { route } from './middleware.js';
 import { envPort, startTimer } from './utils.js';
 import { validateQuery } from './validate.js';
 const logger = getLogger('http');
@@ -103,7 +103,7 @@ export function createExpressServer(app, options = {}) {
     }
     const healthTypes = ['live', 'ready'];
     if (!app.get('__healthAttached')) {
-        app.get('/health/:type?', before(), validateQuery({
+        app.get('/health/:type?', validateQuery({
             type: 'object',
             properties: {
                 type: { type: 'string', enum: ['live', 'ready'] },

package/dist/manage.js

@@ -46,8 +46,16 @@ export function registerDefaultCommands(app) {
         }));
     });
     registerManagementCommand((command, cli) => {
-        command('show-config').action(cli.wrap(async () => {
-            console.log(config.value);
+        command('show-config')
+            .option('--json', 'Output JSON')
+            .action(cli.wrap(async (options) => {
+            if (options.json) {
+                console.log(JSON.stringify(config.value, null, 2));
+                return;
+            }
+            for (const [key, value] of Object.entries(config.value)) {
+                cli.writeLine(`${key}=${value}\n`);
+            }
         }));
     });
 }

package/dist/middleware.d.ts

@@ -13,18 +13,42 @@ export interface BeforeMiddlewareCSPDirectives {
     [key: string]: ContentSecurityPolicyDirectiveValue[];
 }
 export interface BeforeMiddlewareOptions {
+    /**
+     * Enable cookie parsing
+     */
     cookies?: boolean;
+    /**
+     * Enable helmet security headers
+     *
+     * https://github.com/helmetjs/helmet
+     */
     helmet?: boolean;
+    /**
+     * Enable JSON body parsing
+     */
     json?: boolean;
+    /**
+     * Enable URL encoded body parsing
+     */
+    urlencoded?: boolean;
+    /**
+     * Enable CSRF protection
+     */
     csrf?: boolean | CsrfMiddlewareOptions;
+    /**
+     * Allow unsafe inline scripts
+     */
     allowUnsafeInlineScripts?: boolean;
+    /**
+     * Custom CSP directives
+     */
     cspDirectives?: (defaults: BeforeMiddlewareCSPDirectives) => BeforeMiddlewareCSPDirectives;
 }
 export declare function useCspNonce(): string;
 /**
  * Register middleware that must come before the app routes.
  */
-export declare function before({ cookies, helmet: useHelmet, json: useJson, csrf: useCsrf, allowUnsafeInlineScripts, cspDirectives, }?: BeforeMiddlewareOptions): import("compose-middleware").RequestHandler<unknown, unknown, void>;
+export declare function before({ cookies, helmet: useHelmet, json: useJson, csrf: useCsrf, urlencoded: useUrlencoded, allowUnsafeInlineScripts, cspDirectives, }?: BeforeMiddlewareOptions): import("compose-middleware").RequestHandler<unknown, unknown, void>;
 /**
  * Middleware that sends a 404
  *
@@ -43,4 +67,4 @@ type ResponseWrapper<TResponseBody extends AnyResponseBody> = TResponseBody | TR
 /**
  * Alias of `route()`
  */
-export declare function asyncMiddleware<RequestBody, RequestQuery extends Record<string, any> = Record<string, any>, ResponseBody extends AnyResponseBody = Record<string, any>>(fn: (req: Request<Record<string, string>, ResponseBody, RequestBody, RequestQuery, Record<string, any>>, res: Response<ResponseBody, object>, next: NextFunction) => ResponseWrapper<ResponseBody> | Promise<ResponseWrapper<ResponseBody>>): RequestHandler<Record<string, string>, ResponseBody, RequestBody, RequestQuery>;
+export declare function asyncMiddleware<RequestBody, RequestQuery extends Record<string, any> = Record<string, any>, ResponseBody extends AnyResponseBody = Record<string, any>, ParamKeys extends string = string>(fn: (req: Request<Record<ParamKeys, string>, ResponseBody, RequestBody, RequestQuery, Record<string, any>>, res: Response<ResponseBody, object>, next: NextFunction) => ResponseWrapper<ResponseBody> | Promise<ResponseWrapper<ResponseBody>>): RequestHandler<Record<string, string>, ResponseBody, RequestBody, RequestQuery>;

package/dist/middleware.js

@@ -20,7 +20,7 @@ export function useCspNonce() {
 /**
  * Register middleware that must come before the app routes.
  */
-export function before({ cookies = false, helmet: useHelmet = true, json: useJson = true, csrf: useCsrf = false, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, } = {}) {
+export function before({ cookies = false, helmet: useHelmet = true, json: useJson = true, csrf: useCsrf = false, urlencoded: useUrlencoded = false, allowUnsafeInlineScripts = false, cspDirectives = (x) => x, } = {}) {
     return compose([
         withRequestContext(),
         typeof useCsrf === 'object' && useCsrf != null
@@ -29,10 +29,7 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
                 ? csrf()
                 : undefined,
         logRequestDuration(),
-        ((req, res, next) => {
-            setContext(CSP_NONCE_KEY, crypto.randomBytes(16).toString('base64'));
-            next();
-        }),
+        setCspNonce(),
         useHelmet &&
             helmet({
                 contentSecurityPolicy: {
@@ -65,7 +62,7 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
                 },
             }),
         useJson && jsonParser(),
-        urlencodedParser({ extended: true }),
+        useUrlencoded && urlencodedParser({ extended: true }),
         (cookies || useCsrf) && cookieParser(),
         analyticsProxy(),
     ].filter(Boolean));
@@ -106,6 +103,15 @@ export function notFound() {
         next(NotFound(`Could not ${req.method} ${req.path}`));
     };
 }
+/**
+ * Set a CSP nonce for the request
+ */
+function setCspNonce() {
+    return (req, res, next) => {
+        setContext(CSP_NONCE_KEY, crypto.randomBytes(16).toString('base64'));
+        next();
+    };
+}
 /**
  * In production, we could directly proxy the url
  * to an analytics service from nginx, but in dev

package/dist/validate.d.ts

@@ -1,4 +1,5 @@
 import { type Options } from 'ajv';
+import { Type } from 'arktype';
 import { type RequestHandler } from 'express';
 export type ValidationSchema = {
     type?: 'string' | 'number' | 'integer' | 'boolean' | 'array' | 'object' | 'null';
@@ -27,9 +28,10 @@ export type ValidationSchema = {
     title?: string;
     description?: string;
 } | boolean;
-export declare function validateBody(schema: ValidationSchema): RequestHandler;
-export declare function validateQuery(schema: ValidationSchema): RequestHandler;
-export declare function validateParams(schema: ValidationSchema): RequestHandler;
+type AnySchema = Type | ValidationSchema;
+export declare function validateBody(schema: AnySchema): RequestHandler;
+export declare function validateQuery(schema: AnySchema): RequestHandler;
+export declare function validateParams(schema: AnySchema): RequestHandler;
 export type ValidationResult = {
     isValid: true;
     errors: null;
@@ -48,4 +50,5 @@ export declare function compileValidateSchema(schema: ValidationSchema, options?
         [key: string]: any[];
     };
 };
-export declare function validateSchema(data: any, schema: ValidationSchema, options?: Options): ValidationResult;
+export declare function validateSchema(data: any, schema: AnySchema, options?: Options): ValidationResult;
+export {};

package/dist/validate.js

@@ -1,8 +1,16 @@
 import _Ajv, {} from 'ajv';
+import { Type } from 'arktype';
 import {} from 'express';
 import { BadRequest } from './errors.js';
 const Ajv = _Ajv;
+const toValidationSchema = (schema) => {
+    if (schema instanceof Type) {
+        return schema.toJsonSchema();
+    }
+    return schema;
+};
 export function validateBody(schema) {
+    schema = toValidationSchema(schema);
     const validate = compileValidateSchema(schema);
     const middleware = (req, res, next) => {
         const result = validate(req.body);
@@ -15,6 +23,7 @@ export function validateBody(schema) {
     return middleware;
 }
 export function validateQuery(schema) {
+    schema = toValidationSchema(schema);
     const validate = compileValidateSchema(schema, { coerceTypes: true });
     const middleware = (req, res, next) => {
         const result = validate(req.query);
@@ -27,6 +36,7 @@ export function validateQuery(schema) {
     return middleware;
 }
 export function validateParams(schema) {
+    schema = toValidationSchema(schema);
     const validate = compileValidateSchema(schema, { coerceTypes: true });
     const middleware = (req, res, next) => {
         const result = validate(req.params);
@@ -68,6 +78,7 @@ export function compileValidateSchema(schema, options = {}) {
     };
 }
 export function validateSchema(data, schema, options = {}) {
+    schema = toValidationSchema(schema);
     const ajv = createAjv(options);
     const valid = ajv.validate(schema, data);
     if (valid) {

package/dist/vite/defineViteConfig.js

@@ -4,7 +4,7 @@ import react from '@vitejs/plugin-react';
 import Sonda from 'sonda/vite';
 import { defineConfig } from 'vite';
 import { readEnv } from '../utils.js';
-export function defineViteConfig({ base = '', reactCompiler = false, ssr = false, analyze = true, }) {
+export function defineViteConfig({ base = '', reactCompiler = false, ssr = false, analyze = readEnv.boolean('VITE_ANALYZE', false), }) {
     const port = readEnv.number('VITE_PORT', 5173);
     return defineConfig({
         plugins: [
@@ -28,7 +28,7 @@ export function defineViteConfig({ base = '', reactCompiler = false, ssr = false
         build: {
             chunkSizeWarningLimit: 750,
             manifest: true,
-            sourcemap: true,
+            sourcemap: analyze,
             // Set via cli arg --outDir for ssr
             outDir: ssr ? undefined : 'dist/client',
             rollupOptions: ssr
@@ -39,7 +39,7 @@ export function defineViteConfig({ base = '', reactCompiler = false, ssr = false
                 }
                 : {
                     input: {
-                        index: path.resolve(process.cwd(), '_index.html'),
+                        index: path.resolve(process.cwd(), 'index.html'),
                     },
                 },
         },

package/dist/vite/ssr.d.ts

@@ -1,6 +1,6 @@
-export interface SsrMiddleWareOptions {
+export interface SsrMiddlewareOptions<InitialData = unknown> {
     root?: string;
-    getInitialData?: (req: string) => Promise<unknown>;
+    getInitialData?: (req: Request) => Promise<InitialData>;
     useDevServer?: boolean;
 }
-export declare function createSsrMiddleware({ root, getInitialData, useDevServer, }?: SsrMiddleWareOptions): Promise<import("compose-middleware").RequestHandler<unknown, unknown, void>>;
+export declare function createSsrMiddleware<InitialData = unknown>({ root, getInitialData, useDevServer, }?: SsrMiddlewareOptions<InitialData>): Promise<import("compose-middleware").RequestHandler<unknown, unknown, void>>;

package/dist/vite/ssr.js

@@ -4,8 +4,10 @@ import express, {} from 'express';
 import { createServer as createViteServer } from 'vite';
 import {} from './types.js';
 import { config } from '../config.js';
+import { generateCsrfToken } from '../csrf.js';
 import { composeMiddleware, route, useCspNonce } from '../middleware.js';
-export async function createSsrMiddleware({ root = process.cwd(), getInitialData = async () => ({}), useDevServer = config.value.VITE_USE_DEV_SERVER, } = {}) {
+import { createFetchRequest } from '../webapi.js';
+export async function createSsrMiddleware({ root = process.cwd(), getInitialData, useDevServer = config.value.VITE_USE_DEV_SERVER, } = {}) {
     const resolve = (p) => path.resolve(root, p);
     let vite;
     const middlewares = [];
@@ -31,12 +33,13 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 render = result.render;
             }
             const nonce = useCspNonce();
-            const rendered = await render(req, res, {
+            const rendered = await render(createFetchRequest(req), {
                 useDevServer,
-                getInitialData,
+                getInitialData: getInitialData || (async () => ({})),
                 placeholders: `
             {{ ssr-title }}
             {{ ssr-meta }}
+            {{ ssr-fouc }}
             {{ ssr-preload }}
             {{ ssr-js }}
             {{ ssr-css }}
@@ -49,6 +52,8 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
             window.$RefreshSig$ = () => (type) => type
             window.__vite_plugin_react_preamble_installed__ = true
           `,
+                publicUrl: new URL(config.value.PUBLIC_URL),
+                csrfToken: generateCsrfToken(req, res),
             });
             const readManifest = async () => {
                 if (useDevServer) {
@@ -58,7 +63,14 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 return getAssetLinks(manifestPath, 'src/entry-client.tsx');
             };
             let html = rendered.html;
-            const context = Object.assign({}, rendered.context, await readManifest());
+            const context = Object.assign({
+                fouc: `
+              <style id="fouc">body { visibility: hidden; opacity: 0.0 }</style>
+              <script nonce="${nonce}">
+                setTimeout(() => { document.getElementById('fouc').remove(); }, 2000);
+              </script>
+            `,
+            }, rendered.context, await readManifest());
             const ssrPlaceholders = Object.fromEntries(Object.entries(context).map(([k, v]) => [`ssr-${k}`, v.toString()]));
             // Add nonce to all bare script tags
             html = html.replace(/<script>/g, `<script nonce="${nonce}">`);

package/dist/vite/types.d.ts

@@ -1,12 +1,13 @@
-import { type Request, type Response } from 'express';
-export interface SsrRenderOptions {
+export interface SsrRenderOptions<InitialData = unknown> {
     useDevServer: boolean;
     placeholders: string;
     nonce: string;
+    csrfToken: string;
     preamble: string;
-    getInitialData: (req: string) => Promise<unknown>;
+    getInitialData: (req: Request) => Promise<InitialData>;
+    publicUrl: URL;
 }
-export type EntryRenderFn = (req: Request, res: Response, options: SsrRenderOptions) => Promise<{
+export type EntryRenderFn = (req: Request, options: SsrRenderOptions) => Promise<{
     html: string;
     context: any;
 }>;

package/dist/vite/types.js

@@ -1 +1 @@
-import {} from 'express';
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.49.4",
+  "version": "0.51.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -44,12 +44,13 @@
   ],
   "license": "ISC",
   "devDependencies": {
-    "@devmoods/eslint-config": "^2.5.0",
+    "arktype": "^2.0.2",
+    "@devmoods/eslint-config": "^2.6.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.10.5",
+    "@types/node": "22.10.10",
     "@types/supertest": "^6.0.2",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^2.1.8",
+    "@vitest/coverage-v8": "^3.0.4",
     "cookiejar": "^2.1.4",
     "eslint": "^9.18.0",
     "faktory-worker": "^4.6.0",
@@ -58,34 +59,34 @@
     "ts-node": "10.9.2",
     "tsx": "^4.19.2",
     "typescript": "5.7.3",
-    "vite": "^6.0.7",
-    "vitest": "^2.1.8",
+    "vite": "^6.0.11",
+    "vitest": "^3.0.4",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.48.0",
-    "@sentry/profiling-node": "^8.48.0",
+    "@sentry/node": "^8.51.0",
+    "@sentry/profiling-node": "^8.51.0",
     "@types/bcrypt": "^5.0.2",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
-    "@types/jsonwebtoken": "^9.0.7",
+    "@types/jsonwebtoken": "^9.0.8",
     "@types/nodemailer": "^6.4.17",
-    "@types/pg": "^8.11.10",
+    "@types/pg": "^8.11.11",
     "@types/superagent": "^8.1.9",
     "@types/uuid": "^10.0.0",
     "ajv": "^8.17.1",
     "argon2": "^0.41.1",
     "bcrypt": "^5.1.1",
     "chalk": "^5.4.1",
-    "commander": "^13.0.0",
+    "commander": "^13.1.0",
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
-    "nodemailer": "^6.9.16",
+    "nodemailer": "^6.10.0",
     "pg": "^8.13.1",
     "redis": "^4.7.0",
     "sonda": "^0.7.1",
@@ -98,7 +99,8 @@
   "peerDependencies": {
     "@vitejs/plugin-react": ">=4.3.4",
     "faktory-worker": ">=4.5.1",
-    "vite": ">=6.0.5"
+    "vite": ">=6.0.5",
+    "arktype": ">=2.0.2"
   },
   "engines": {
     "node": ">=20 <24"