@devmoods/express-extras 0.52.3 → 0.54.0

package/dist/auth/passwordless.d.ts

@@ -1,6 +1,6 @@
 import { type AnyUser, type AuthProvider } from './types.js';
 export interface PasswordlessAuthProviderOptions<UserModel = AnyUser> {
     getUserByEmail(email: string): Promise<UserModel | null>;
-    onLoginRequest(user: UserModel, temporaryToken: string): Promise<void>;
+    onLoginRequest(user: UserModel, temporaryToken: string, otp: string): Promise<void>;
 }
 export declare function PasswordlessAuthProvider<UserModel extends AnyUser>(options: PasswordlessAuthProviderOptions<UserModel>): AuthProvider<UserModel>;

package/dist/auth/passwordless.js

@@ -1,6 +1,5 @@
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
-import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { route } from '../middleware.js';
 import { DoesNotExistError } from '../postgres.js';
@@ -20,19 +19,25 @@ export function PasswordlessAuthProvider(options) {
     };
     return {
         setupRoutes(router, context) {
-            router.post('/passwordless/login/:token', route(async (req, res) => {
-                const { token: temporaryToken } = req.params;
-                const decoded = context.decodeTemporaryToken(temporaryToken);
-                const user = await context.getUserById(decoded.payload.uid);
-                try {
-                    await context.verifyTemporaryToken(temporaryToken, user);
-                }
-                catch {
-                    logger.warn('passwordless: invalid temp token', { uid: user.id });
-                    throw Unauthorized('Invalid token');
-                }
+            router.post('/passwordless/login', validateBody({
+                type: 'object',
+                properties: {
+                    type: { type: 'string', enum: ['otp', 'token'] },
+                    otp: { type: 'string' },
+                    token: { type: 'string' },
+                },
+                required: ['type'],
+            }), route(async (req, res) => {
+                const { token: temporaryToken, otp, type: tokenType } = req.body;
+                const verify = tokenType === 'otp'
+                    ? context.verifyOtp
+                    : context.verifyTemporaryToken;
+                const tokenValue = tokenType === 'otp' ? otp : temporaryToken;
+                const uid = await verify(tokenValue, null, false);
+                const user = await context.getUserById(uid);
+                await verify(tokenValue, user);
                 const accessToken = await context.login(req, res, user);
-                logger.info('passwordless login', { uid: user.id });
+                logger.info('passwordless login', { tokenType, uid: user.id });
                 if (req.accepts('html')) {
                     return res.redirect('/');
                 }
@@ -55,7 +60,8 @@ export function PasswordlessAuthProvider(options) {
                     return 202;
                 }
                 const token = await context.createTemporaryToken(user);
-                await options.onLoginRequest(user, token);
+                const otp = await context.createOtp(user);
+                await options.onLoginRequest(user, token, otp);
                 logger.info('passwordless login requested', { email });
                 return 202;
             }));

package/dist/auth/types.d.ts

@@ -35,8 +35,10 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     tokenStorage: AuthOptions<UserModel>['tokenStorage'];
     setCurrentUser: (user: UserModel) => void;
     createTemporaryToken(user: UserModel): Promise<string>;
-    verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
+    verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    createOtp(user: UserModel): Promise<string>;
+    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     login: (req: Request, res: Response, user: UserModel, isRefresh?: boolean) => Promise<AccessToken>;
     getUserById(id: string): Promise<UserModel>;

package/dist/auth.d.ts

@@ -12,8 +12,10 @@ export interface CreateAuth<UserModel extends AnyUser> {
     before: () => RequestHandler;
     isAuthorized: (fn?: (user: UserModel) => boolean) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
-    verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
+    verifyTemporaryToken(token: string, user: UserModel | null): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    createOtp(user: UserModel): Promise<string>;
+    verifyOtp(otp: string, user: UserModel | null): Promise<string>;
     logout: (req: Request, res: Response) => Promise<void>;
 }
 export declare class RedisTokenStorage extends TokenStorage {

package/dist/auth.js

@@ -71,6 +71,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        createOtp,
+        verifyOtp,
         middleware,
         login,
         getUserById,
@@ -185,6 +187,24 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             }
         };
     }
+    async function createOtp(user) {
+        const otp = crypto.randomInt(100000, 999999).toString();
+        await tokenStorage.set(otp, String(user.id), config.value.AUTH_OTP_EXPIRES_IN);
+        return otp;
+    }
+    async function verifyOtp(otp, user, consume = true) {
+        const storedUid = await tokenStorage.get(otp);
+        if (!storedUid) {
+            throw new InvalidToken('Invalid OTP');
+        }
+        if (user && storedUid !== user.id) {
+            throw new InvalidToken('Invalid OTP');
+        }
+        if (consume) {
+            await tokenStorage.invalidate(otp);
+        }
+        return storedUid;
+    }
     /**
      * Create a short-lived token tied to a user that can be
      * used for different kinds of verification.
@@ -213,7 +233,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     function decodeTemporaryToken(token) {
         return JSON.parse(Buffer.from(token, 'base64url').toString('utf-8'));
     }
-    async function verifyTemporaryToken(token, user) {
+    async function verifyTemporaryToken(token, user, consume = true) {
         const decoded = decodeTemporaryToken(token);
         const expectedSignature = crypto
             .createHmac('sha256', config.value.AUTH_SECRET)
@@ -223,14 +243,20 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         if (expectedSignature !== decoded.signature) {
             throw new InvalidToken('Invalid signature');
         }
-        if (decoded.payload.uid !== user.id) {
+        if (user && decoded.payload.uid !== user.id) {
             throw new InvalidToken(`Invalid user ${user.id}`);
         }
         const storedUid = await tokenStorage.get(token);
-        if (storedUid !== user.id) {
+        if (!storedUid) {
+            throw new InvalidToken('Invalid token not found');
+        }
+        if (user && storedUid !== user.id) {
             throw new InvalidToken(`Invalid user ${user.id}`);
         }
-        await tokenStorage.invalidate(token);
+        if (consume) {
+            await tokenStorage.invalidate(token);
+        }
+        return storedUid;
     }
     return {
         before: () => middleware(false),
@@ -241,6 +267,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        createOtp,
+        verifyOtp,
         logout,
     };
 }

package/dist/config.d.ts

@@ -5,6 +5,7 @@ export declare const config: {
         PUBLIC_URL: string;
         AUTH_TOKEN_EXPIRES_IN: number;
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
+        AUTH_OTP_EXPIRES_IN: number;
         AUTH_SECRET: string;
         AUTH_COOKIE_SAME_SITE: string;
         REDIS_URL: string;
@@ -37,6 +38,7 @@ export declare function extendConfig<T extends Record<string, unknown>>(appConfi
         PUBLIC_URL: string;
         AUTH_TOKEN_EXPIRES_IN: number;
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
+        AUTH_OTP_EXPIRES_IN: number;
         AUTH_SECRET: string;
         AUTH_COOKIE_SAME_SITE: string;
         REDIS_URL: string;

package/dist/config.js

@@ -8,6 +8,7 @@ const baseConfig = {
     PUBLIC_URL: readEnv('PUBLIC_URL', ''),
     AUTH_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TOKEN_EXPIRES', 3600 * 24 * 30), // 30 days
     AUTH_TEMP_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TEMP_TOKEN_EXPIRES', 3600),
+    AUTH_OTP_EXPIRES_IN: readEnv.number('AUTH_OTP_EXPIRES', 5 * 60),
     AUTH_SECRET: readEnv('AUTH_JWT_SECRET', ''),
     AUTH_COOKIE_SAME_SITE: readEnv('AUTH_COOKIE_SAME_SITE', 'strict'),
     REDIS_URL: readEnv('REDIS_URL', ''),

package/dist/errors.js

@@ -2,6 +2,7 @@ import { STATUS_CODES } from 'node:http';
 import * as Sentry from '@sentry/node';
 import { errors } from 'compose-middleware';
 import {} from 'express';
+import { InvalidToken } from './auth/errors.js';
 import { getLogger } from './logger.js';
 import { DoesNotExistError, IntegrityError } from './postgres.js';
 export class ApiError extends Error {
@@ -48,6 +49,9 @@ function convertToAPIError(error) {
     if (error instanceof DoesNotExistError) {
         return NotFound(error.message);
     }
+    if (error instanceof InvalidToken) {
+        return Unauthorized(error.message);
+    }
     return error;
 }
 function _errorHandler({ onError }) {

package/dist/index.d.ts

@@ -14,10 +14,12 @@ export * from './logger.js';
 export * from './manage.js';
 export * from './middleware.js';
 export * from './postgres.js';
+export * from './rate-limit.js';
 export * from './redis.js';
 export * from './routes.js';
 export * from './sentry.js';
 export * from './slack.js';
+export * from './sql.js';
 export * from './utils.js';
 export * from './validate.js';
 export * from './webapi.js';

package/dist/index.js

@@ -15,10 +15,12 @@ export * from './logger.js';
 export * from './manage.js';
 export * from './middleware.js';
 export * from './postgres.js';
+export * from './rate-limit.js';
 export * from './redis.js';
 export * from './routes.js';
 export * from './sentry.js';
 export * from './slack.js';
+export * from './sql.js';
 export * from './utils.js';
 export * from './validate.js';
 export * from './webapi.js';

package/dist/middleware.js

@@ -68,8 +68,17 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
     ].filter(Boolean));
 }
 function logRequestDuration() {
+    const FILTERED_PATHS = [
+        '/src',
+        '/node_modules',
+        '/@fs',
+        '/@vite',
+        '/@react-refresh',
+        '/@id',
+        '/analytics.js',
+    ];
     return (req, res, next) => {
-        if (req.path.startsWith('/src')) {
+        if (FILTERED_PATHS.some((p) => req.path.startsWith(p))) {
             return next();
         }
         const timer = startTimer();

package/dist/migrate.d.ts

@@ -1,6 +1,6 @@
 import { type Command } from 'commander';
 import { type CLI } from './cli.js';
-import { type Connection, createPostgres } from './postgres.js';
+import { createPostgres } from './postgres.js';
 interface Migration {
     name: string;
     filename: string;
@@ -33,8 +33,8 @@ export declare class Migrator {
     log(...args: any[]): void;
     executeMigration(migrations: Migration[], currentVersion: number, direction: 'up' | 'down'): Promise<number>;
     readMigrationFile(filename: string): Promise<MigrationFileAPI>;
-    migrate(connection: Connection, migrator: MigrationFileAPI, direction: 'up' | 'down'): Promise<void>;
-    updateCurrentVersion(connection: Connection, version: number): Promise<import("pg").QueryResult<import("pg").QueryResultRow>>;
+    migrate(migrator: MigrationFileAPI, direction: 'up' | 'down'): Promise<void>;
+    updateCurrentVersion(version: number): Promise<import("pg").QueryResult<import("pg").QueryResultRow>>;
     getCurrentVersion(): Promise<number>;
     getMigrations(): Promise<{
         filename: string;

package/dist/migrate.js

@@ -3,7 +3,8 @@ import * as path from 'node:path';
 import chalk from 'chalk';
 import {} from 'commander';
 import {} from './cli.js';
-import { createPostgres, formatSql, sql } from './postgres.js';
+import { createPostgres } from './postgres.js';
+import { formatSql, sql } from './sql.js';
 export const asCli = (command, cli) => {
     command.command('up').action(cli.wrap(async () => {
         const migrator = new Migrator();
@@ -138,15 +139,15 @@ export class Migrator {
                 this.log('Running migration', migration.filename);
                 const migrator = await this.readMigrationFile(migration.filename);
                 if (migrator.useTransaction !== false) {
-                    await this.postgres.transaction(async (tx) => {
-                        await this.migrate(tx, migrator, direction);
-                        await this.updateCurrentVersion(tx, migration.version);
+                    await this.postgres.transaction(async () => {
+                        await this.migrate(migrator, direction);
+                        await this.updateCurrentVersion(migration.version);
                     });
                 }
                 else {
-                    await this.postgres.withConnection(async (tx) => {
-                        await this.migrate(tx, migrator, direction);
-                        await this.updateCurrentVersion(tx, migration.version);
+                    await this.postgres.withConnection(async () => {
+                        await this.migrate(migrator, direction);
+                        await this.updateCurrentVersion(migration.version);
                     });
                 }
             }
@@ -165,15 +166,15 @@ export class Migrator {
             this.log('Rolling back migration', migrationToRollback.filename);
             const migrator = await this.readMigrationFile(migrationToRollback.filename);
             if (migrator.useTransaction !== false) {
-                await this.postgres.transaction(async (tx) => {
-                    await this.migrate(tx, migrator, 'down');
-                    await this.updateCurrentVersion(tx, updatedVersion);
+                await this.postgres.transaction(async () => {
+                    await this.migrate(migrator, 'down');
+                    await this.updateCurrentVersion(updatedVersion);
                 });
             }
             else {
-                await this.postgres.withConnection(async (tx) => {
-                    await this.migrate(tx, migrator, 'down');
-                    await this.updateCurrentVersion(tx, updatedVersion);
+                await this.postgres.withConnection(async () => {
+                    await this.migrate(migrator, 'down');
+                    await this.updateCurrentVersion(updatedVersion);
                 });
             }
             return await this.getCurrentVersion();
@@ -197,13 +198,13 @@ export class Migrator {
             },
         };
     }
-    async migrate(connection, migrator, direction) {
+    async migrate(migrator, direction) {
         try {
             const queryWithLog = (statement) => {
                 this.log(chalk.yellow(formatSql(statement)));
-                return connection.query(statement);
+                return this.postgres.query(statement);
             };
-            const returnValue = await migrator[direction](queryWithLog.bind(connection));
+            const returnValue = await migrator[direction](queryWithLog.bind(this.postgres));
             if (typeof returnValue === 'string') {
                 if (returnValue !== '') {
                     await queryWithLog(returnValue);
@@ -218,8 +219,8 @@ export class Migrator {
             throw new Error(`Migration failed: ${error.message}`);
         }
     }
-    updateCurrentVersion(connection, version) {
-        return connection.query(`INSERT INTO ${this.migrationTableName} (version, run_at) VALUES ($1, $2)`, [version, new Date()]);
+    updateCurrentVersion(version) {
+        return this.postgres.query(`INSERT INTO ${this.migrationTableName} (version, run_at) VALUES ($1, $2)`, [version, new Date()]);
     }
     async getCurrentVersion() {
         const result = await this.postgres.first(`SELECT version FROM ${this.migrationTableName} ORDER BY run_at DESC LIMIT 1`);

package/dist/postgres.d.ts

@@ -1,10 +1,8 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import pg, { type PoolClient, type PoolConfig, type QueryResult, type QueryResultRow } from 'pg';
+import { type SqlStatement } from './sql.js';
 export declare const escapePostgresIdentifier: typeof pg.escapeIdentifier;
 export declare const escapePostgresLiteral: typeof pg.escapeLiteral;
-/**
- * Returns a pretty-printed SQL statement.
- */
-export declare const formatSql: (statement: SqlStatement | string) => string;
 export interface PostgresOptions extends PoolConfig, ConnectionOptions {
     onError?: (error: Error, client: any) => void;
     url?: PoolConfig['connectionString'];
@@ -22,6 +20,13 @@ type Value = null | string | number | Date;
 export interface ConnectionOptions {
     onLogStatement?: (statement: SqlStatement | string, values: unknown[] | undefined, duration: number) => void;
 }
+export interface TransactionContext {
+    connection: Connection;
+    savepoints: string[];
+    isCommitted: boolean;
+    isRolledBack: boolean;
+}
+export declare const transactionStorage: AsyncLocalStorage<TransactionContext>;
 export declare class Connection {
     private options;
     client: PoolClient;
@@ -34,6 +39,12 @@ export declare class Connection {
     get<T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]): Promise<T>;
 }
 export declare class Transaction extends Connection {
+    savepoints: string[];
+    isCommitted: boolean;
+    isRolledBack: boolean;
+    createSavepoint(): Promise<string>;
+    rollbackToSavepoint(savepointName: string): Promise<void>;
+    releaseSavepoint(savepointName: string): Promise<void>;
 }
 /**
  * Create a new Postgres connection pool with
@@ -49,37 +60,10 @@ export declare function createPostgres({ onError, url, ...postgresOptions }?: Po
     all: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<T[]>;
     get: <T extends QueryResultRow>(text: string | SqlStatement, values?: Value[]) => Promise<T>;
     withConnection: <T>(callback: (connection: Connection) => Promise<T>) => Promise<T>;
-    transaction: <T>(callback: (connection: Transaction) => Promise<T> | T) => Promise<T>;
+    transaction: <T>(callback: () => Promise<T> | T) => Promise<T>;
+    getCurrentTransaction: () => Transaction | null;
     instance: pg.Pool;
     clear: (force?: boolean) => Promise<void>;
     end(): Promise<void>;
 };
-export declare class SqlStatement {
-    stringsAndValues: [string, unknown | undefined][];
-    constructor(strings: string[], values: unknown[]);
-    _extract(strings: string[], values: unknown[]): void;
-    append(statement: SqlStatement | string): this;
-    get values(): ({} | null)[];
-    get text(): string;
-}
-export declare const sql: {
-    (strings: TemplateStringsArray, ...values: unknown[]): SqlStatement;
-    identifier(name: string): {
-        name: string;
-        raw: boolean;
-    };
-    raw(name: string): {
-        name: string;
-        raw: boolean;
-    };
-    literal(name: string | null): {
-        name: string;
-        raw: boolean;
-    };
-    spreadUpdate: typeof spreadUpdate;
-    spreadInsert: typeof spreadInsert;
-};
-declare function spreadUpdate(data: Record<string, any>): SqlStatement;
-declare function spreadInsert<TData extends Record<string, any>>(data: TData | TData[]): SqlStatement;
-export declare function joinStatements(statements: SqlStatement[], separator: string): SqlStatement;
 export {};

package/dist/postgres.js

@@ -1,21 +1,10 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import pg, {} from 'pg';
-import { format } from 'sql-formatter';
 import { config } from './config.js';
+import { formatSql } from './sql.js';
 import { startTimer } from './utils.js';
 export const escapePostgresIdentifier = pg.escapeIdentifier;
 export const escapePostgresLiteral = pg.escapeLiteral;
-/**
- * Returns a pretty-printed SQL statement.
- */
-export const formatSql = (statement) => {
-    const value = statement instanceof SqlStatement ? statement.text : statement;
-    return format(value, {
-        language: 'postgresql',
-        keywordCase: 'upper',
-        tabWidth: 2,
-        useTabs: false,
-    });
-};
 export class DoesNotExistError extends Error {
     constructor(message) {
         super(message);
@@ -34,6 +23,7 @@ export class IntegrityError extends Error {
         this.name = 'IntegrityError';
     }
 }
+export const transactionStorage = new AsyncLocalStorage();
 export class Connection {
     constructor(client, options) {
         this.options = options;
@@ -89,6 +79,28 @@ export class Connection {
     }
 }
 export class Transaction extends Connection {
+    constructor() {
+        super(...arguments);
+        this.savepoints = [];
+        this.isCommitted = false;
+        this.isRolledBack = false;
+    }
+    async createSavepoint() {
+        const savepointName = `sp_${this.savepoints.length + 1}`;
+        await this.query(`SAVEPOINT ${savepointName}`);
+        this.savepoints.push(savepointName);
+        return savepointName;
+    }
+    async rollbackToSavepoint(savepointName) {
+        await this.query(`ROLLBACK TO SAVEPOINT ${savepointName}`);
+    }
+    async releaseSavepoint(savepointName) {
+        await this.query(`RELEASE SAVEPOINT ${savepointName}`);
+        const index = this.savepoints.indexOf(savepointName);
+        if (index !== -1) {
+            this.savepoints.splice(index, 1);
+        }
+    }
 }
 /**
  * Create a new Postgres connection pool with
@@ -103,6 +115,11 @@ export function createPostgres({ onError, url = config.value.POSTGRES_URL, ...po
         onError?.(e, client);
     });
     async function withConnection(callback) {
+        // Check if we're already in a transaction context
+        const txContext = transactionStorage.getStore();
+        if (txContext) {
+            return callback(txContext.connection);
+        }
         const client = await pool.connect();
         try {
             const result = await callback(new Connection(client, {
@@ -128,21 +145,50 @@ export function createPostgres({ onError, url = config.value.POSTGRES_URL, ...po
     }
     /**
      * Run queries inside a BEGIN, COMMIT / ROLLBACK transaction.
+     * Supports nested transactions using SAVEPOINT.
      */
     async function transaction(callback) {
+        // Check if we're already in a transaction context
+        const existingTxContext = transactionStorage.getStore();
+        if (existingTxContext) {
+            // We're already in a transaction, create a savepoint for nested transaction
+            const txConnection = existingTxContext.connection;
+            const savepointName = await txConnection.createSavepoint();
+            try {
+                const result = await callback();
+                await txConnection.releaseSavepoint(savepointName);
+                return result;
+            }
+            catch (error) {
+                await txConnection.rollbackToSavepoint(savepointName);
+                throw error;
+            }
+        }
+        // Start a new top-level transaction
         const client = await pool.connect();
         try {
             await client.query('BEGIN');
-            const result = await callback(new Transaction(client, {
+            const txConnection = new Transaction(client, {
                 onLogStatement: postgresOptions.onLogStatement,
-            }));
+            });
+            // Create transaction context
+            const txContext = {
+                connection: txConnection,
+                savepoints: [],
+                isCommitted: false,
+                isRolledBack: false,
+            };
+            // Run the callback within the transaction context
+            const result = await transactionStorage.run(txContext, async () => {
+                return await callback();
+            });
             await client.query('COMMIT');
+            txContext.isCommitted = true;
             return result;
         }
         catch (error) {
             await client.query('ROLLBACK');
             throw error;
-            /* c8 ignore next 3 */
         }
         finally {
             client.release();
@@ -173,6 +219,14 @@ export function createPostgres({ onError, url = config.value.POSTGRES_URL, ...po
             return connection.get(...args);
         });
     };
+    /**
+     * Get the current transaction from the AsyncLocalStorage context.
+     * Returns null if not in a transaction.
+     */
+    function getCurrentTransaction() {
+        const txContext = transactionStorage.getStore();
+        return txContext ? txContext.connection : null;
+    }
     return {
         insert,
         query,
@@ -181,6 +235,7 @@ export function createPostgres({ onError, url = config.value.POSTGRES_URL, ...po
         get,
         withConnection,
         transaction,
+        getCurrentTransaction,
         instance: pool,
         clear,
         end() {
@@ -188,123 +243,3 @@ export function createPostgres({ onError, url = config.value.POSTGRES_URL, ...po
         },
     };
 }
-const isRaw = (value) => {
-    return (typeof value === 'object' && value !== null && 'raw' in value && !!value.raw);
-};
-export class SqlStatement {
-    constructor(strings, values) {
-        this.stringsAndValues = [];
-        this._extract(strings, values);
-    }
-    _extract(strings, values) {
-        for (let i = 0; i < strings.length; i++) {
-            const string = strings[i];
-            const value = values[i];
-            if (isRaw(value)) {
-                this.stringsAndValues.push([string + value.name, undefined]);
-            }
-            else if (value instanceof SqlStatement) {
-                this.stringsAndValues.push([string, undefined]);
-                this.stringsAndValues.push(...value.stringsAndValues);
-            }
-            else {
-                this.stringsAndValues.push([string, value]);
-            }
-        }
-    }
-    append(statement) {
-        if (statement instanceof SqlStatement) {
-            this.stringsAndValues.push(...statement.stringsAndValues);
-        }
-        else {
-            this.stringsAndValues.push([statement, undefined]);
-        }
-        return this;
-    }
-    get values() {
-        return this.stringsAndValues
-            .map(([, value]) => value)
-            .filter((x) => x !== undefined);
-    }
-    get text() {
-        let i = 1;
-        let result = '';
-        for (const [string, value] of this.stringsAndValues) {
-            if (value == null) {
-                result += string;
-            }
-            else {
-                result += `${string}$${i}`;
-                i += 1;
-            }
-        }
-        return result;
-    }
-}
-export const sql = (strings, ...values) => {
-    return new SqlStatement(Array.from(strings), values);
-};
-function spreadUpdate(data) {
-    const entries = Object.entries(data);
-    if (entries.length === 0) {
-        return sql ``;
-    }
-    return joinStatements(entries
-        .filter(([, value]) => typeof value !== 'undefined')
-        .map(([key, value]) => sql `${sql.identifier(key)} = ${value == null ? sql.raw('NULL') : value}`), ', ');
-}
-function spreadInsert(data) {
-    const rows = Array.isArray(data) ? data : [data];
-    if (rows.length === 0) {
-        return sql ``;
-    }
-    const statement = sql `(`;
-    statement.append(Object.keys(rows[0])
-        .map((k) => escapePostgresIdentifier(k))
-        .join(', '));
-    statement.append(sql `) VALUES `);
-    const toInsert = [];
-    for (const row of rows) {
-        const values = Object.values(row);
-        if (values.length === 0) {
-            continue;
-        }
-        toInsert.push(sql `(${joinStatements(values.map((value) => sql `${value ?? sql.raw('NULL')}`), ', ')})`);
-    }
-    statement.append(joinStatements(toInsert, ', '));
-    return statement;
-}
-/**
- * Inject an identifier into the template string
- */
-sql.identifier = (name) => {
-    return { name: escapePostgresIdentifier(name), raw: true };
-};
-/**
- * Inject a raw value into the template string
- */
-sql.raw = (name) => {
-    return { name, raw: true };
-};
-/**
- * Inject a literal value into the template string
- */
-sql.literal = (name) => {
-    if (name === null) {
-        return { name: 'NULL', raw: true };
-    }
-    return { name: escapePostgresLiteral(name), raw: true };
-};
-sql.spreadUpdate = spreadUpdate;
-sql.spreadInsert = spreadInsert;
-export function joinStatements(statements, separator) {
-    let i = 0;
-    const statement = sql ``;
-    for (const o of statements) {
-        if (i++ !== 0) {
-            statement.append(separator);
-        }
-        statement.append(o);
-    }
-    return statement;
-}

package/dist/rate-limit.d.ts

@@ -0,0 +1,22 @@
+import { type RequestHandler, type Request } from 'express';
+import { type RedisClient } from './redis.js';
+export interface RateLimitOptions {
+    /**
+     * Maximum number of requests allowed within the window
+     * @default 100
+     */
+    max?: number;
+    /**
+     * Time window in seconds
+     * @default 60
+     */
+    windowSizeInSeconds?: number;
+    /**
+     * Function to generate a key for rate limiting
+     * @default IP-based rate limiting
+     */
+    getKey?: (req: Request) => string;
+}
+export declare function rateLimit(redis: RedisClient, { max, windowSizeInSeconds, getKey, }?: RateLimitOptions): RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>> & {
+    clear: (key: string) => Promise<void>;
+};

package/dist/rate-limit.js

@@ -0,0 +1,35 @@
+import {} from 'express';
+import { config } from './config.js';
+import { makeError } from './errors.js';
+import {} from './redis.js';
+export function rateLimit(redis, { max = 100, windowSizeInSeconds = 60, getKey = (req) => req.ip || 'unknown', } = {}) {
+    const handler = async (req, res, next) => {
+        try {
+            const key = `${config.value.REDIS_KEY_PREFIX}rate-limit:${getKey(req)}`;
+            // Use Redis to track requests
+            const currentCount = await redis.get(key);
+            const count = currentCount ? parseInt(currentCount, 10) : 0;
+            // Set headers for rate limiting info
+            res.setHeader('X-RateLimit-Limit', max.toString());
+            res.setHeader('X-RateLimit-Remaining', Math.max(0, max - count - 1).toString());
+            if (count >= max) {
+                throw makeError(429, 'Rate limit exceeded');
+            }
+            if (count === 0) {
+                await redis.set(key, '1', { EX: windowSizeInSeconds });
+            }
+            else {
+                await redis.incr(key);
+            }
+            next();
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+    const clear = async (key) => {
+        await redis.del(`rate-limit:${key}`);
+    };
+    handler.clear = clear;
+    return handler;
+}

package/dist/sql.d.ts

@@ -0,0 +1,33 @@
+export declare class SqlStatement {
+    stringsAndValues: [string, unknown | undefined][];
+    constructor(strings: string[], values: unknown[]);
+    _extract(strings: string[], values: unknown[]): void;
+    append(statement: SqlStatement | string): this;
+    get values(): ({} | null)[];
+    get text(): string;
+}
+export declare const sql: {
+    (strings: TemplateStringsArray, ...values: unknown[]): SqlStatement;
+    identifier(name: string): {
+        name: string;
+        raw: boolean;
+    };
+    raw(name: string): {
+        name: string;
+        raw: boolean;
+    };
+    literal(name: string | null): {
+        name: string;
+        raw: boolean;
+    };
+    spreadUpdate: typeof spreadUpdate;
+    spreadInsert: typeof spreadInsert;
+};
+declare function spreadUpdate(data: Record<string, any>): SqlStatement;
+declare function spreadInsert<TData extends Record<string, any>>(data: TData | TData[]): SqlStatement;
+export declare function joinStatements(statements: SqlStatement[], separator: string): SqlStatement;
+/**
+ * Returns a pretty-printed SQL statement.
+ */
+export declare const formatSql: (statement: SqlStatement | string) => string;
+export {};

package/dist/sql.js

@@ -0,0 +1,134 @@
+import { format } from 'sql-formatter';
+import { escapePostgresIdentifier, escapePostgresLiteral } from './postgres.js';
+const isRaw = (value) => {
+    return (typeof value === 'object' && value !== null && 'raw' in value && !!value.raw);
+};
+export class SqlStatement {
+    constructor(strings, values) {
+        this.stringsAndValues = [];
+        this._extract(strings, values);
+    }
+    _extract(strings, values) {
+        for (let i = 0; i < strings.length; i++) {
+            const string = strings[i];
+            const value = values[i];
+            if (isRaw(value)) {
+                this.stringsAndValues.push([string + value.name, undefined]);
+            }
+            else if (value instanceof SqlStatement) {
+                this.stringsAndValues.push([string, undefined]);
+                this.stringsAndValues.push(...value.stringsAndValues);
+            }
+            else {
+                this.stringsAndValues.push([string, value]);
+            }
+        }
+    }
+    append(statement) {
+        if (statement instanceof SqlStatement) {
+            this.stringsAndValues.push(...statement.stringsAndValues);
+        }
+        else {
+            this.stringsAndValues.push([statement, undefined]);
+        }
+        return this;
+    }
+    get values() {
+        return this.stringsAndValues
+            .map(([, value]) => value)
+            .filter((x) => x !== undefined);
+    }
+    get text() {
+        let i = 1;
+        let result = '';
+        for (const [string, value] of this.stringsAndValues) {
+            if (value == null) {
+                result += string;
+            }
+            else {
+                result += `${string}$${i}`;
+                i += 1;
+            }
+        }
+        return result;
+    }
+}
+export const sql = (strings, ...values) => {
+    return new SqlStatement(Array.from(strings), values);
+};
+function spreadUpdate(data) {
+    const entries = Object.entries(data);
+    if (entries.length === 0) {
+        return sql ``;
+    }
+    return joinStatements(entries
+        .filter(([, value]) => typeof value !== 'undefined')
+        .map(([key, value]) => sql `${sql.identifier(key)} = ${value == null ? sql.raw('NULL') : value}`), ', ');
+}
+function spreadInsert(data) {
+    const rows = Array.isArray(data) ? data : [data];
+    if (rows.length === 0) {
+        return sql ``;
+    }
+    const statement = sql `(`;
+    statement.append(Object.keys(rows[0])
+        .map((k) => escapePostgresIdentifier(k))
+        .join(', '));
+    statement.append(sql `) VALUES `);
+    const toInsert = [];
+    for (const row of rows) {
+        const values = Object.values(row);
+        if (values.length === 0) {
+            continue;
+        }
+        toInsert.push(sql `(${joinStatements(values.map((value) => sql `${value ?? sql.raw('NULL')}`), ', ')})`);
+    }
+    statement.append(joinStatements(toInsert, ', '));
+    return statement;
+}
+/**
+ * Inject an identifier into the template string
+ */
+sql.identifier = (name) => {
+    return { name: escapePostgresIdentifier(name), raw: true };
+};
+/**
+ * Inject a raw value into the template string
+ */
+sql.raw = (name) => {
+    return { name, raw: true };
+};
+/**
+ * Inject a literal value into the template string
+ */
+sql.literal = (name) => {
+    if (name === null) {
+        return { name: 'NULL', raw: true };
+    }
+    return { name: escapePostgresLiteral(name), raw: true };
+};
+sql.spreadUpdate = spreadUpdate;
+sql.spreadInsert = spreadInsert;
+export function joinStatements(statements, separator) {
+    let i = 0;
+    const statement = sql ``;
+    for (const o of statements) {
+        if (i++ !== 0) {
+            statement.append(separator);
+        }
+        statement.append(o);
+    }
+    return statement;
+}
+/**
+ * Returns a pretty-printed SQL statement.
+ */
+export const formatSql = (statement) => {
+    const value = statement instanceof SqlStatement ? statement.text : statement;
+    return format(value, {
+        language: 'postgresql',
+        keywordCase: 'upper',
+        tabWidth: 2,
+        useTabs: false,
+    });
+};

package/dist/validate.js

@@ -56,6 +56,7 @@ function createAjv(options) {
     });
     ajv.addKeyword('$enumNames');
     ajv.addKeyword('$bitiforms');
+    ajv.addKeyword('$forms');
     return ajv;
 }
 export function compileValidateSchema(schema, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.52.3",
+  "version": "0.54.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -46,31 +46,31 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^2.6.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.13.4",
+    "@types/node": "22.13.5",
     "@types/supertest": "^6.0.2",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^3.0.5",
-    "arktype": "^2.0.4",
+    "@vitest/coverage-v8": "^3.0.7",
+    "arktype": "^2.1.0",
     "cookiejar": "^2.1.4",
-    "eslint": "^9.20.1",
+    "eslint": "^9.21.0",
     "faktory-worker": "^4.6.0",
-    "prettier": "3.5.1",
+    "prettier": "3.5.2",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
-    "tsx": "^4.19.2",
+    "tsx": "^4.19.3",
     "typescript": "5.7.3",
-    "vite": "^6.1.0",
-    "vitest": "^3.0.5",
+    "vite": "^6.1.1",
+    "vitest": "^3.0.7",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^9.1.0",
-    "@sentry/profiling-node": "^9.1.0",
+    "@sentry/node": "^9.2.0",
+    "@sentry/profiling-node": "^9.2.0",
     "@types/bcrypt": "^5.0.2",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
-    "@types/jsonwebtoken": "^9.0.8",
+    "@types/jsonwebtoken": "^9.0.9",
     "@types/nodemailer": "^6.4.17",
     "@types/pg": "^8.11.11",
     "@types/superagent": "^8.1.9",
@@ -90,8 +90,8 @@
     "pg": "^8.13.3",
     "redis": "^4.7.0",
     "sonda": "^0.7.1",
-    "sql-formatter": "^15.4.10",
-    "uuid": "^11.0.5"
+    "sql-formatter": "^15.4.11",
+    "uuid": "^11.1.0"
   },
   "prettier": {
     "singleQuote": true