@devmoods/express-extras 0.50.0 → 0.52.0

package/dist/auth/passwordless.d.ts

@@ -1,6 +1,6 @@
 import { type AnyUser, type AuthProvider } from './types.js';
 export interface PasswordlessAuthProviderOptions<UserModel = AnyUser> {
-    getUserByEmail(email: string): Promise<UserModel>;
+    getUserByEmail(email: string): Promise<UserModel | null>;
     onLoginRequest(user: UserModel, temporaryToken: string): Promise<void>;
 }
 export declare function PasswordlessAuthProvider<UserModel extends AnyUser>(options: PasswordlessAuthProviderOptions<UserModel>): AuthProvider<UserModel>;

package/dist/auth/passwordless.js

@@ -3,9 +3,21 @@ import {} from './types.js';
 import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { route } from '../middleware.js';
+import { DoesNotExistError } from '../postgres.js';
 import { validateBody } from '../validate.js';
 const logger = getLogger('auth');
 export function PasswordlessAuthProvider(options) {
+    const getUserOrNull = async (email) => {
+        try {
+            return await options.getUserByEmail(email);
+        }
+        catch (error) {
+            if (error instanceof DoesNotExistError) {
+                return null;
+            }
+            throw error;
+        }
+    };
     return {
         setupRoutes(router, context) {
             router.post('/passwordless/login/:token', route(async (req, res) => {
@@ -16,10 +28,11 @@ export function PasswordlessAuthProvider(options) {
                     await context.verifyTemporaryToken(temporaryToken, user);
                 }
                 catch {
+                    logger.warn('passwordless: invalid temp token', { uid: user.id });
                     throw Unauthorized('Invalid token');
                 }
                 const accessToken = await context.login(req, res, user);
-                logger.info('passwordless login');
+                logger.info('passwordless login', { uid: user.id });
                 if (req.accepts('html')) {
                     return res.redirect('/');
                 }
@@ -36,7 +49,11 @@ export function PasswordlessAuthProvider(options) {
                 required: ['email'],
             }), route(async (req) => {
                 const { email } = req.body;
-                const user = await options.getUserByEmail(email);
+                const user = await getUserOrNull(email);
+                if (!user) {
+                    logger.warn('passwordless: user not found', { email });
+                    return 202;
+                }
                 const token = await context.createTemporaryToken(user);
                 await options.onLoginRequest(user, token);
                 logger.info('passwordless login requested', { email });

package/dist/auth/types.d.ts

@@ -38,7 +38,7 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
-    login: (req: Request, res: Response, user: UserModel) => Promise<AccessToken>;
+    login: (req: Request, res: Response, user: UserModel, isRefresh?: boolean) => Promise<AccessToken>;
     getUserById(id: string): Promise<UserModel>;
     jitter(duration?: number): Promise<void>;
 }

package/dist/auth.d.ts

@@ -9,6 +9,8 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createRouter: () => Router;
     useCurrentUser: () => UserModel | undefined;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
+    before: () => RequestHandler;
+    isAuthorized: (fn?: (user: UserModel) => boolean) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;

package/dist/auth.js

@@ -16,7 +16,7 @@ export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
 export * from './auth/token.js';
 export class RedisTokenStorage extends TokenStorage {
-    constructor(redis, keyPrefix = 'auth:') {
+    constructor(redis, keyPrefix = `${config.value.REDIS_KEY_PREFIX}auth:`) {
         super();
         this.redis = redis;
         this.keyPrefix = keyPrefix;
@@ -37,17 +37,19 @@ const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex'
 export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion = '1', }) {
     const useCurrentUser = () => useContext('currentUser');
     const setCurrentUser = (user) => setContext('currentUser', user);
-    const login = async (req, res, user) => {
+    const login = async (req, res, user, isRefresh = false) => {
         const accessToken = createAccessToken({ uid: user.id }, sessionTokenVersion);
         const sessionId = sha256(accessToken.token);
         await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
         setAccessTokenCookie(res, accessToken.token);
         setCurrentUser(user);
-        await onUserLoggedIn?.(user, {
-            ip: req.ip ?? '',
-            userAgent: req.headers['user-agent'] ?? '',
-            sessionId,
-        });
+        if (!isRefresh) {
+            await onUserLoggedIn?.(user, {
+                ip: req.ip ?? '',
+                userAgent: req.headers['user-agent'] ?? '',
+                sessionId,
+            });
+        }
         return accessToken;
     };
     const logout = async (res, sessionId) => {
@@ -106,7 +108,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                 setAccessTokenCookie(res, null);
                 throw Unauthorized();
             }
-            const { token } = await providerContext.login(req, res, user);
+            const { token } = await providerContext.login(req, res, user, true);
             logger.info('refreshed token');
             return { token, user: filterUser(user) };
         }));
@@ -153,9 +155,15 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     await logout(res, token);
                     throw new InvalidToken('User not found');
                 }
+                const tokenLifetimeMs = decoded.exp * 1000 - decoded.iat * 1000;
+                const remainingMs = decoded.exp * 1000 - Date.now();
+                const shouldRefresh = remainingMs < tokenLifetimeMs * 0.25;
                 if (options.isAuthorized && !(await options.isAuthorized(user))) {
                     throw new PermissionDenied('Permission denied');
                 }
+                if (shouldRefresh) {
+                    await providerContext.login(req, res, user, true);
+                }
                 setCurrentUser(user);
                 next();
             }
@@ -225,6 +233,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         await tokenStorage.invalidate(token);
     }
     return {
+        before: () => middleware(false),
+        isAuthorized: (fn) => middleware({ isAuthorized: fn || (() => true) }),
         createRouter,
         useCurrentUser,
         middleware,

package/dist/cache.js

@@ -1,21 +1,24 @@
+import { config } from './config.js';
 import {} from './redis.js';
 export function createRedisCacheAdapter(redis, options = {}) {
-    const { keyPrefix = 'cache:' } = options;
-    const createKey = (key) => `${keyPrefix}${key}`;
+    const { keyPrefix = `${config.value.REDIS_KEY_PREFIX}cache:` } = options;
+    const withKeyPrefix = (key) => `${keyPrefix}${key}`;
     return {
         async get(key) {
-            const value = await redis.get(createKey(key));
+            const value = await redis.get(withKeyPrefix(key));
             if (value == null) {
                 return null;
             }
             return JSON.parse(value);
         },
         async set(key, value, expires) {
-            await redis.set(createKey(key), JSON.stringify(value), { PX: expires });
+            await redis.set(withKeyPrefix(key), JSON.stringify(value), {
+                PX: expires,
+            });
         },
         async clear(key) {
             if (key) {
-                await redis.del(createKey(key));
+                await redis.del(withKeyPrefix(key));
             }
             const keys = await redis.keys(`${keyPrefix}*`);
             for (const existingKey of keys) {

package/dist/channels.d.ts

@@ -0,0 +1,8 @@
+import { type Request } from 'express';
+import { type RedisClient } from './redis.js';
+export declare function createEventStream<Channels extends string>(redis: RedisClient): {
+    sse: ({ channels, }: {
+        channels: (req: Request) => string[] | Promise<string[]>;
+    }) => import("express").RequestHandler<Record<string, string>, Record<string, any>, unknown, Record<string, any>, Record<string, any>>;
+    publish: (channel: Channels, message: unknown) => Promise<number>;
+};

package/dist/channels.js

@@ -0,0 +1,66 @@
+import {} from 'express';
+import { config } from './config.js';
+import { requestContext } from './context.js';
+import { getLogger } from './logger.js';
+import { route } from './middleware.js';
+import {} from './redis.js';
+const logger = getLogger();
+export function createEventStream(redis) {
+    const keyPrefix = `${config.value.REDIS_KEY_PREFIX}events:`;
+    const withKeyPrefix = (key) => `${keyPrefix}${key}`;
+    const sse = ({ channels, }) => {
+        return route(async (req, res) => {
+            const headers = {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                Connection: 'keep-alive',
+            };
+            res.writeHead(200, headers);
+            res.write('retry: 15000\n');
+            const heartbeat = setInterval(() => {
+                try {
+                    if (!res.writableEnded) {
+                        res.write('event: heartbeat\n');
+                        res.write('data: ping\n\n');
+                    }
+                }
+                catch (error) {
+                    logger.error(error);
+                }
+            }, 15000);
+            const store = requestContext.getStore();
+            const listener = (value) => {
+                try {
+                    requestContext.run(store, () => {
+                        if (!res.writableEnded) {
+                            res.write('event: data\n');
+                            res.write(`data: ${JSON.stringify(value)}\n\n`);
+                        }
+                    });
+                }
+                catch (error) {
+                    logger.error(error);
+                }
+            };
+            const subscriber = redis.duplicate();
+            await subscriber.connect();
+            const _channels = await channels(req);
+            await subscriber.subscribe(_channels.map(withKeyPrefix), (message) => {
+                listener(JSON.parse(message));
+            });
+            logger.info('event stream subscribe', { channels: _channels });
+            res.on('close', () => {
+                requestContext.run(store, () => {
+                    logger.info('event stream close');
+                    clearInterval(heartbeat);
+                    subscriber.quit();
+                    res.end();
+                });
+            });
+        });
+    };
+    const publish = (channel, message) => {
+        return redis.publish(withKeyPrefix(channel), JSON.stringify(message));
+    };
+    return { sse, publish };
+}

package/dist/config.d.ts

@@ -7,6 +7,7 @@ export declare const config: {
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
         AUTH_SECRET: string;
         REDIS_URL: string;
+        REDIS_KEY_PREFIX: string;
         POSTGRES_URL: string;
         SENTRY_DSN: string;
         LOG_LEVEL: string;
@@ -37,6 +38,7 @@ export declare function extendConfig<T extends Record<string, unknown>>(appConfi
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
         AUTH_SECRET: string;
         REDIS_URL: string;
+        REDIS_KEY_PREFIX: string;
         POSTGRES_URL: string;
         SENTRY_DSN: string;
         LOG_LEVEL: string;

package/dist/config.js

@@ -10,6 +10,7 @@ const baseConfig = {
     AUTH_TEMP_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TEMP_TOKEN_EXPIRES', 3600),
     AUTH_SECRET: readEnv('AUTH_JWT_SECRET', ''),
     REDIS_URL: readEnv('REDIS_URL', ''),
+    REDIS_KEY_PREFIX: readEnv('REDIS_KEY_PREFIX', ''),
     POSTGRES_URL: readEnv('POSTGRES_URL', ''),
     SENTRY_DSN: readEnv('SENTRY_DSN', ''),
     LOG_LEVEL: readEnv('LOG_LEVEL', 'INFO'),

package/dist/context.d.ts

@@ -1,4 +1,6 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { type Request, type RequestHandler } from 'express';
+export declare const requestContext: AsyncLocalStorage<Map<string, any>>;
 export interface RequestContextOptions {
     getRequestId?: (req: Request) => string | undefined;
 }

package/dist/context.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import {} from 'express';
 import { v4 as uuid } from 'uuid';
-const requestContext = new AsyncLocalStorage();
+export const requestContext = new AsyncLocalStorage();
 const REQUEST_ID = 'requestId';
 /**
  * Middleware for setting a `requestId` on the request context.

package/dist/cookie-consent.d.ts

@@ -0,0 +1,3 @@
+export declare function cookieConsent({ onConsent, }: {
+    onConsent: (consents: string[]) => Promise<void> | void;
+}): import("express-serve-static-core").Router;

package/dist/cookie-consent.js

@@ -0,0 +1,33 @@
+import { Router } from 'express';
+import { getLogger } from './logger.js';
+import { route } from './middleware.js';
+import { validateBody } from './validate.js';
+const logger = getLogger();
+export function cookieConsent({ onConsent, }) {
+    const router = Router();
+    router.get('/', route(() => {
+        return {
+            consents: [],
+        };
+    }));
+    router.post('/', validateBody({
+        type: 'object',
+        properties: {
+            consents: {
+                type: 'array',
+                items: { type: 'string' },
+            },
+        },
+    }), route(async (req, res) => {
+        const { consents } = req.body;
+        res.cookie('cookie_consent', consents.join(',') || '1', {
+            expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
+            sameSite: 'strict',
+            secure: process.env.NODE_ENV === 'production',
+        });
+        await onConsent?.(consents);
+        logger.info('cookie consent');
+        return { consents };
+    }));
+    return router;
+}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export * from './auth.js';
 export * from './cache.js';
+export * from './cookie-consent.js';
+export * from './channels.js';
 export * from './cli.js';
 export * from './config.js';
 export * from './context.js';

package/dist/index.js

@@ -1,6 +1,8 @@
 /* c8 ignore next 100 */
 export * from './auth.js';
 export * from './cache.js';
+export * from './cookie-consent.js';
+export * from './channels.js';
 export * from './cli.js';
 export * from './config.js';
 export * from './context.js';

package/dist/vite/defineViteConfig.js

@@ -4,7 +4,7 @@ import react from '@vitejs/plugin-react';
 import Sonda from 'sonda/vite';
 import { defineConfig } from 'vite';
 import { readEnv } from '../utils.js';
-export function defineViteConfig({ base = '', reactCompiler = false, ssr = false, analyze = true, }) {
+export function defineViteConfig({ base = '', reactCompiler = false, ssr = false, analyze = readEnv.boolean('VITE_ANALYZE', false), }) {
     const port = readEnv.number('VITE_PORT', 5173);
     return defineConfig({
         plugins: [
@@ -28,7 +28,7 @@ export function defineViteConfig({ base = '', reactCompiler = false, ssr = false
         build: {
             chunkSizeWarningLimit: 750,
             manifest: true,
-            sourcemap: true,
+            sourcemap: analyze,
             // Set via cli arg --outDir for ssr
             outDir: ssr ? undefined : 'dist/client',
             rollupOptions: ssr

package/dist/vite/ssr.d.ts

@@ -1,6 +1,6 @@
-export interface SsrMiddleWareOptions {
+export interface SsrMiddlewareOptions<InitialData = unknown> {
     root?: string;
-    getInitialData?: (req: string) => Promise<unknown>;
+    getInitialData?: (req: Request) => Promise<InitialData>;
     useDevServer?: boolean;
 }
-export declare function createSsrMiddleware({ root, getInitialData, useDevServer, }?: SsrMiddleWareOptions): Promise<import("compose-middleware").RequestHandler<unknown, unknown, void>>;
+export declare function createSsrMiddleware<InitialData = unknown>({ root, getInitialData, useDevServer, }?: SsrMiddlewareOptions<InitialData>): Promise<import("compose-middleware").RequestHandler<unknown, unknown, void>>;

package/dist/vite/ssr.js

@@ -4,8 +4,10 @@ import express, {} from 'express';
 import { createServer as createViteServer } from 'vite';
 import {} from './types.js';
 import { config } from '../config.js';
+import { generateCsrfToken } from '../csrf.js';
 import { composeMiddleware, route, useCspNonce } from '../middleware.js';
-export async function createSsrMiddleware({ root = process.cwd(), getInitialData = async () => ({}), useDevServer = config.value.VITE_USE_DEV_SERVER, } = {}) {
+import { createFetchRequest } from '../webapi.js';
+export async function createSsrMiddleware({ root = process.cwd(), getInitialData, useDevServer = config.value.VITE_USE_DEV_SERVER, } = {}) {
     const resolve = (p) => path.resolve(root, p);
     let vite;
     const middlewares = [];
@@ -31,12 +33,13 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 render = result.render;
             }
             const nonce = useCspNonce();
-            const rendered = await render(req, res, {
+            const rendered = await render(createFetchRequest(req), {
                 useDevServer,
-                getInitialData,
+                getInitialData: getInitialData || (async () => ({})),
                 placeholders: `
             {{ ssr-title }}
             {{ ssr-meta }}
+            {{ ssr-fouc }}
             {{ ssr-preload }}
             {{ ssr-js }}
             {{ ssr-css }}
@@ -49,7 +52,8 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
             window.$RefreshSig$ = () => (type) => type
             window.__vite_plugin_react_preamble_installed__ = true
           `,
-                publicUrl: config.value.PUBLIC_URL,
+                publicUrl: new URL(config.value.PUBLIC_URL),
+                csrfToken: generateCsrfToken(req, res),
             });
             const readManifest = async () => {
                 if (useDevServer) {
@@ -59,7 +63,14 @@ export async function createSsrMiddleware({ root = process.cwd(), getInitialData
                 return getAssetLinks(manifestPath, 'src/entry-client.tsx');
             };
             let html = rendered.html;
-            const context = Object.assign({}, rendered.context, await readManifest());
+            const context = Object.assign({
+                fouc: `
+              <style id="fouc">body { visibility: hidden; opacity: 0.0 }</style>
+              <script nonce="${nonce}">
+                setTimeout(() => { document.getElementById('fouc').remove(); }, 2000);
+              </script>
+            `,
+            }, rendered.context, await readManifest());
             const ssrPlaceholders = Object.fromEntries(Object.entries(context).map(([k, v]) => [`ssr-${k}`, v.toString()]));
             // Add nonce to all bare script tags
             html = html.replace(/<script>/g, `<script nonce="${nonce}">`);

package/dist/vite/types.d.ts

@@ -1,13 +1,13 @@
-import { type Request, type Response } from 'express';
-export interface SsrRenderOptions {
+export interface SsrRenderOptions<InitialData = unknown> {
     useDevServer: boolean;
     placeholders: string;
     nonce: string;
+    csrfToken: string;
     preamble: string;
-    getInitialData: (req: string) => Promise<unknown>;
-    publicUrl: string;
+    getInitialData: (req: Request) => Promise<InitialData>;
+    publicUrl: URL;
 }
-export type EntryRenderFn = (req: Request, res: Response, options: SsrRenderOptions) => Promise<{
+export type EntryRenderFn = (req: Request, options: SsrRenderOptions) => Promise<{
     html: string;
     context: any;
 }>;

package/dist/vite/types.js

@@ -1 +1 @@
-import {} from 'express';
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -46,51 +46,51 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^2.6.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.10.7",
+    "@types/node": "22.13.0",
     "@types/supertest": "^6.0.2",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^3.0.2",
+    "@vitest/coverage-v8": "^3.0.4",
+    "arktype": "^2.0.4",
     "cookiejar": "^2.1.4",
-    "eslint": "^9.18.0",
+    "eslint": "^9.19.0",
     "faktory-worker": "^4.6.0",
     "prettier": "3.4.2",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
     "tsx": "^4.19.2",
     "typescript": "5.7.3",
-    "vite": "^6.0.7",
-    "vitest": "^3.0.2",
+    "vite": "^6.0.11",
+    "vitest": "^3.0.4",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.50.0",
-    "@sentry/profiling-node": "^8.50.0",
+    "@sentry/node": "^8.53.0",
+    "@sentry/profiling-node": "^8.53.0",
     "@types/bcrypt": "^5.0.2",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
-    "@types/jsonwebtoken": "^9.0.7",
+    "@types/jsonwebtoken": "^9.0.8",
     "@types/nodemailer": "^6.4.17",
-    "@types/pg": "^8.11.10",
+    "@types/pg": "^8.11.11",
     "@types/superagent": "^8.1.9",
     "@types/uuid": "^10.0.0",
     "ajv": "^8.17.1",
     "argon2": "^0.41.1",
-    "arktype": "^2.0.0",
     "bcrypt": "^5.1.1",
     "chalk": "^5.4.1",
-    "commander": "^13.0.0",
+    "commander": "^13.1.0",
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
-    "nodemailer": "^6.9.16",
+    "nodemailer": "^6.10.0",
     "pg": "^8.13.1",
     "redis": "^4.7.0",
     "sonda": "^0.7.1",
-    "sql-formatter": "^15.4.9",
+    "sql-formatter": "^15.4.10",
     "uuid": "^11.0.5"
   },
   "prettier": {
@@ -98,6 +98,7 @@
   },
   "peerDependencies": {
     "@vitejs/plugin-react": ">=4.3.4",
+    "arktype": ">=2.0.0",
     "faktory-worker": ">=4.5.1",
     "vite": ">=6.0.5"
   },